Data and security
ConnectActive reads your clients’ directories, compares them with your ConnectWise, and writes the result to your ConnectWise. This page says what it reads, what it keeps, and how access is removed.
What ConnectActive reads
Section titled “What ConnectActive reads”| From | What | How |
|---|---|---|
| Microsoft 365 / Entra ID | Users, groups, licenses, users’ last sign-in dates | Read-only Microsoft Graph permissions the client’s administrator approved |
| Microsoft Partner Center | Your customer tenants; then each added tenant like Microsoft 365 | Your partner authorization |
| Google Workspace | Users, groups, organizational units, domains, sign-in activity | Read-only scopes delegated by the client’s administrator |
| Active Directory | Enabled users, groups and OUs | Uploaded by the script you run on the client’s network |
| Your ConnectWise | Companies, contacts, sites, agreements and additions, products, configurations, custom fields | Your account’s ConnectWise API member |
Every source permission is read-only: ConnectActive never changes a client’s directory. The permissions are listed in Permissions.
What it writes
Section titled “What it writes”Only to your ConnectWise, as configured: contacts, their sites, Contact Types and custom fields; agreement additions and prorated additions; configurations’ contacts; and, after you commit an Inactive Contact Cleanup plan, merged and deleted contacts. A sync you run by hand writes nothing until you click COMMIT.
What it keeps
Section titled “What it keeps”To keep a sync going, ConnectActive keeps the ConnectWise ids of the companies and contacts it syncs, the directory’s identifiers for the matched users, and one-way hashes of user names. The names and addresses on the Matching Form are read from the directory and ConnectWise when you open it.
It also keeps:
- Covered users of mapped additions: the name, email address and invoice line of each user counted against an addition, encrypted, so it can list the changes since the last invoice and show change logs.
- People added or excluded by hand on a mapping, with the note you typed.
- The latest Active Directory upload, for companies synced by the PowerShell script, replaced by each upload.
- Authorizations: what is needed to read each Microsoft 365, Partner Center and Google Workspace source, including the Google administrator’s email address you entered.
- Your settings: mappings, filters, keywords, pricing schedules, and the email addresses for failure and change reports.
- Client report access: the email addresses you give access to MyUserList.com, and what each may see.
Who can see it
Section titled “Who can see it”- In Nilear, only members of your company with ConnectActive on (Access levels).
- A client contact you add under Customer Report Access sees their own company’s reports, read-only, and only those you allow.
- A client administrator who approves ConnectActive through an approval link sees only whether the approval was recorded: nothing of your account, companies or data.
Removing access
Section titled “Removing access”| Source | How the client, or you, removes it |
|---|---|
| Microsoft 365 / Entra ID | Delete ConnectActive under Enterprise applications in the client’s Entra ID |
| Google Workspace | Delete the Client ID’s entry under Domain-wide Delegation in the Google Admin console |
| Active Directory | Delete the Scheduled Task and the script’s folder |
| A whole company | Delete it from ConnectActive (the bin icon on its Settings); its Microsoft authorizations are deleted with it |
Approval links and the instructions you copy for a client contain no password or secret: only the link and ConnectActive’s public Application ID.