Overview

Kaseya VSA 10 Inspector (Beta)

Kaseya VSA X (marketed as "VSA 10") is Kaseya's cloud-native rebuild of its VSA remote monitoring and management platform — a separate product from the legacy Kaseya VSA, with its own API and data model. The Kaseya VSA 10 Inspector (Beta) connects to your VSA X tenant's REST API with a third-party token and reports each managed Customer's device and agent inventory, hardware and software assets, antivirus posture, and admin-user roster back into Liongard — so a device dropping offline, an agent going missing, or a new admin appearing lands on the same timeline as every other system you manage.

This inspector runs alongside Liongard's existing Kaseya VSA Inspector, so Partners on either product are covered.

What you can monitor

The Kaseya VSA 10 Inspector collects account-wide and per-Customer data, including:

• Managed Organizations (Customers), Sites, and Groups across your VSA X tenant
• The VSA X admin-user roster, including role, scope, and enabled state
• Per-Customer device inventory: OS, online state, agent installed, MDM enrollment, agent version, and last seen
• Per-Customer hardware and software inventory (Device Assets)
• Device antivirus protection status

How it works

A parent launchpoint holds a single VSA X third-party token and discovers every Organization in your tenant, along with account-wide Sites, Groups, and admin Users. Liongard creates a child launchpoint for each Organization, mapped to its own Liongard Environment, so each Customer's devices and assets are tracked independently.

Benefits

• Track each Customer's managed-device count and catch unexpected drops from decommissioned or non-reporting agents.
• Surface device online/offline state and agent-installed coverage per Customer.
• Watch the VSA X admin roster for new or newly enabled admins before privilege drift becomes a security gap.
• Bring antivirus protection status into Liongard's change feed so a degraded endpoint gets attention.
• Roll up Organization, Site, and admin-user counts for an at-a-glance view of your VSA X estate.

Inspector Setup Preparation

Step 1: Create a Third-Party Token in VSA X

1. In VSA X, go to Configuration → API Access → Third-Party Tokens.
2. Select Create Token.
3. (Optional) Set a start date, expiry date, IP allowlist, and per-Organization / per-endpoint scope. For full collection, the token must allow Organizations, Sites, Groups, Users, Devices, and Device Assets. If you set an IP allowlist, include the Liongard agent's egress IP.
4. Copy the Token ID and Token Secret immediately — VSA X displays the Token Secret only once. If it's lost, regenerate the secret.

Inspector Setup:

Step 2: Configure the Kaseya VSA 10 Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the Kaseya VSA 10 Inspector > Select Add System.

Since VSA X is a multi-tenant system where a single tenant manages many Customers, you'll set up a single "Parent" Inspector that will then auto-discover a "Child" Inspector for each VSA X Organization.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] Kaseya VSA 10 Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• VSA X Server Host: Your VSA X server, e.g., acmemsp.vsax.net (or your custom on-prem FQDN)
• Token ID: The Token ID created in Step 1
• Token Secret: The Token Secret created in Step 1
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 3: Child Inspector Setup

After the first run of the Parent Inspector, each VSA X Organization will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > Kaseya VSA 10 page. Each Organization maps one-to-one to a Liongard Environment, and child launchpoints inherit the parent's token automatically.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Optional: Turn on Flexible Asset/Configuration Auto-Updating

If you would like this Inspector's data to be sent to ConnectWise and/or IT Glue, turn on Flexible Assets/Configurations for this Inspector:

• ConnectWise: Admin > Integrations > ConnectWise > Configuration Types > Confirm the "Configuration Auto-Updating" toggle is enabled
• IT Glue: Admin > Integrations > IT Glue > Flexible Assets > Confirm the "Flexible Asset Auto-Updating" toggle is enabled

Troubleshooting

• HTTP 401 on the parent: The Token ID/Secret is invalid, expired, or outside its start/expiry window. Regenerate the token under Configuration → API Access → Third-Party Tokens and re-enter it on the parent launchpoint — child launchpoints inherit it.
• HTTP 403, or a child Organization returns no devices: The token is scoped too narrowly. Widen its per-Organization / per-endpoint permissions to cover Organizations, Sites, Groups, Users, Devices, and Device Assets.
• Requests blocked or connection refused: The token's IP allowlist may exclude the Liongard agent's egress IP — add it to the allowlist.
• Slow runs on large estates: VSA X caps the Device Assets endpoint at 60 requests per hour. The inspector throttles that endpoint to one call per Organization and honors Retry-After automatically.

Inspector FAQs