NinjaOne Integration
Connect your NinjaOne RMM instance so agents can look up the organizations you manage, their sites and end users, and the devices NinjaOne monitors: status, disks, installed software, OS patches, active alerts and custom fields. Every NinjaOne tool is read-only. Agents cannot run scripts, change settings or act on devices.
Partner tool. NinjaOne is only available to a tenant that is also an Outermind partner, on Workforce plan and up. The integration card carries a Partner tool badge; a tenant that is not an active partner (including a partner whose billing is suspended) cannot connect it.
Before you start
- A NinjaOne account with API access enabled, and the right to create an API client application in it.
- Your NinjaOne region. It is the host you sign in to NinjaOne at:
| Region in Outermind | NinjaOne host |
|---|---|
| North America | app.ninjarmm.com |
| Europe | eu.ninjarmm.com |
| Asia Pacific | oc.ninjarmm.com |
| US2 | us2.ninjarmm.com |
| Canada | ca.ninjarmm.com |
- A tenant admin in Outermind with permission to manage connections.
Create the API client in NinjaOne
Outermind signs in to NinjaOne as an application, with the OAuth 2.0 client credentials grant. No NinjaOne user signs in, and no password is stored.
- In NinjaOne, go to Administration > Apps > API and add a new client application.
- Choose the machine-to-machine (API services) application type.
- Allow the client credentials grant type.
- Give it the Monitoring and Management scopes. Outermind requests exactly
monitoring management; it does not need the Control scope, which allows remote actions on devices, so leave that off. - Save the application and copy its Client ID and Client Secret. NinjaOne shows the secret only once.
Connect in Outermind
- Open the Capabilities hub, go to Connections, and open NinjaOne. The page is at
/capabilities/integrations/ninjaone; the form is on the same page. - Click Connect NinjaOne.
- Choose your Region, then enter the Client ID and Client Secret, and submit.
- Outermind requests a token from your NinjaOne region to check the credentials. When it succeeds, the page shows the region, the client ID and how many organizations the connection can see.
- Grant the NinjaOne tools to each agent that needs them from the agent's Tools tab (Workforce > Agents > Agents & SMEs).
What your agents can do
Every action below is class read and tier read, so it runs without asking a person at every autonomy level.
| Tool | Actions | What it covers |
|---|---|---|
ninjaone_organizations | list, get, search, list_locations, list_end_users | Your customer organizations, their sites (locations) and the end users NinjaOne holds for each. |
ninjaone_devices | list, get, search, list_disks, list_software, list_os_patches, list_alerts, get_custom_fields | Devices across every organization or one, found by name, DNS name or serial number, with their drives, applications, pending and failed patches, active alerts and custom field values. |
Searches that have to filter in Outermind read at most 1,000 records and say so when they stop there.
Safety
- Read-only. No NinjaOne tool has a write, delete or admin action, and the API client has no Control scope.
- The API client bounds what agents see. Agents see the organizations and devices the client application can read.
Testing, rotating and disconnecting
- Test Connection checks that NinjaOne still issues a token for the credentials.
- To rotate credentials, disconnect and connect again with the new client ID and secret. There is no in-place update.
- Disconnect NinjaOne removes the connection and the NinjaOne tools; agents using them lose access immediately. Delete the client application in NinjaOne as well if you no longer need it.