Overview

ImmyBot Inspector (Beta)

ImmyBot is an MSP endpoint-automation platform for software deployment, patching, and computer onboarding, run as a single per-MSP SaaS instance (https://<subdomain>.immy.bot) that manages every customer tenant. The ImmyBot Inspector (Beta) discovers each customer tenant as its own Liongard Environment and tracks the automation and software-deployment posture that matters for change detection — integration health, recurring maintenance failures, computers excluded from patching, deployment and license changes, and new tenants or computers — without logging into the ImmyBot console tenant by tenant.

What you can monitor

• Instance-wide software library (global and local), maintenance schedules, and connected RMM/PSA integrations and their health
• Per-tenant managed computers, online/offline state, and computers excluded from maintenance
• Recent (7-day) maintenance and patch session results, including failures
• Configured software deployments (target-assignments) and licenses per tenant
• New tenants and new computers as they appear

How it works

A parent launchpoint authenticates to your ImmyBot instance using either an ImmyBot Personal Access Token or a Microsoft Entra ID (Azure AD) App Registration, and automatically discovers each customer tenant. Liongard creates a child launchpoint per tenant, giving each customer its own Environment for independent tracking of computers, maintenance sessions, deployments, and licenses.

Benefits

• Catch a patching or maintenance failure streak for a customer before it becomes a support ticket.
• See an RMM/PSA integration go unhealthy the moment it happens, instead of at the next manual check.
• Track computers quietly excluded from maintenance — the classic way patch coverage erodes unnoticed.
• New ImmyBot customer tenants are picked up automatically on the next parent run.

Inspector Setup Preparation

Inspector Setup:

Step 1 (Option A): Create a Personal Access Token in ImmyBot

Requires ImmyBot v0.82.0 or later. This is the simpler path — no Azure App Registration, no client secret to rotate.

1. In ImmyBot, create a Personal Access Token for a user whose role can read the API.
2. Copy the token immediately.

Then skip to Step 3 and fill in only ImmyBot Instance Subdomain and ImmyBot Personal Access Token, leaving the three Azure fields blank.

Step 1 (Option B): Create the Entra ID App Registration

1. In the Microsoft Entra admin center, go to Identity → Applications → App registrations → New registration. Give it a name (e.g., "Liongard ImmyBot") and register it.
2. On the app's Overview, copy the Application (client) ID and the Directory (tenant) ID.
3. Go to Certificates & secrets → Client secrets → New client secret. Copy the secret Value immediately — it is shown only once.
4. In Enterprise applications, open the app and copy its Object ID.

Step 2 (Option B only): Create the Matching User in ImmyBot

1. In ImmyBot, go to Show More → People → New, paste the Object ID into AD External ID, and save.
2. Create a User from that Person and assign a role that can read the API.

Step 3: Configure the ImmyBot Inspector in Liongard

In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the ImmyBot Inspector > Select Add System.

Since ImmyBot is a multi-tenant system where a single instance manages many customer tenants, you'll set up a single "Parent" Inspector with your credentials that will then auto-discover a "Child" Inspector for each customer tenant.

Fill in the following information — only the instance subdomain and one of the two credential types below are required; leave the other credential type's fields blank:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [Customer Name] ImmyBot Parent
• Agent: Select the appropriate Agent
• Inspector Version: Latest
• ImmyBot Instance Subdomain: Your ImmyBot instance subdomain from Step 1's setup
• ImmyBot Personal Access Token: (Option A) The token generated in Step 1
• Azure Directory (Tenant) ID: (Option B) The Directory (tenant) ID from Step 1
• Azure Application (Client) ID: (Option B) The Application (client) ID from Step 1
• Azure Client Secret Value: (Option B) The client secret Value from Step 1
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule

Select Save. The Inspector will now be triggered to run within the minute.

Step 4: Child Inspector Setup

After the first run of the Parent Inspector, every ImmyBot customer tenant will be auto-discovered and surfaced on the Discovered Systems tab on the Inspectors > ImmyBot Inspector page. The MSP's own tenant is excluded from discovery.

• Activate your Discovered Systems by ensuring they're mapped to the correct Environment > Select the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints.
• Archive Discovered Systems the same way, using Archive Launchpoints instead.

Flexible Asset/Configuration Auto-Updating

This inspector does not yet contribute to Flexible Assets/Configurations — no ConnectWise or IT Glue asset mappings ship with it today, so turning on those auto-updating toggles will not produce any data for this inspector.

Troubleshooting

• Authentication fails (Option A): Confirm the ImmyBot instance is on v0.82.0 or later, the Personal Access Token hasn't been revoked, and the token's user role can read the API.
• Authentication fails (Option B): Confirm the Azure Tenant ID, Application (Client) ID, and Client Secret Value are correct and that the secret hasn't expired or been rotated. Regenerate the secret in Certificates & secrets if needed and update the launchpoint.
• Zero tenants discovered: For Option B, confirm the ImmyBot User created for this App Registration has a role that can read the tenants API, and that the Object ID pasted into ImmyBot's AD External ID field exactly matches the Enterprise Application's Object ID. For Option A, confirm the token's user role can read the tenants API.
• Child tenant data (Computers, Recent Sessions, Deployments, Licenses) is empty: These are child-only reads scoped by tenant. A too-narrow ImmyBot user role can cause secondary endpoints to be skipped — review the assigned role's permissions.
• Recent Sessions looks incomplete: Recent Sessions only covers the last 7 days by design. Check the ImmyBot console directly for older maintenance history.

Inspector FAQs