VSA 10 Updates

The release of VSA 10.8 is another incredibly exciting release. This release includes major enhancements to the integrations with Autotask, KaseyaOne, BMS, and Vorex. Additionally, VSA 10.8 supports device-level policy targeting, recording of remote control sessions, and added 18 new capabilities to the VSA 10 API. Finally, there were several new report templates and end-to-end automation templates added to support managing, securing, and automating your IT ecosystem with the content you need to get started.

Key Feature Enhancements

Policy Extensions – Explicit Targeting 

Policy Extensions now support the ability to explicitly target one or more existing devices, which is useful when Policy changes are required on a device-by-device basis. Policy Extensions operate in one of two selected Targeting Modes:

1. Dynamic Targeting - This is the default Extension mode and is the current operating mode of Extensions prior to changes within this release.
   • a. In this mode, direct assignment of this Policy Extension to specific devices is not available. The selections in the Device Targeting Criteria will be used to dynamically assign this Policy Extension to any devices in the assigned Context, that also match the Device Targeting Criteria. It is possible to further extend this Policy Extension
2. Explicit Targeting – This is a new mode that allows existing devices to be explicitly assigned to the Extension. 
   • a. In this mode, it is possible to explicitly assign this Policy Extension to devices that conform to the following logic: 
     • i. Devices that meet the Device Targeting Criteria as inherited by this Extension’s parent. As an example, if the parent of this Extension is an Extension that has device attributes selected as “Windows Servers”, then only devices that are “Windows Servers” will be available to be selected in this Extension.
     • ii. Devices which are contained within the Context as inherited by this Extension’s parent. As an example, if the Context that has been inherited by this Extension is Organization 1, then only the devices within Organization 1 will be available to be selected in this Extension.
   • b. Refinement of Device Targeting Criteria is not available in this mode. 
   • c. It is not possible to further extend a Policy Extension operating in Explicit Targeting Mode.

Explicit Targeting Extension - Validation Errors – If an Explicit Targeting Extension has been created and the Context selections have been altered within a parent Policy to something other than the Organization, Site, or Group that contains the selected devices, or the Context of the parent has been completely removed, the Explicit Targeting Extension’s device selections will be cleared, and the Extension will display a validation error in the UI.

Remote Control Session Recording

Remote Control sessions can now be recorded manually or automatically. This feature is available for Windows Agents, and both Shared and Private Sessions are supported.  fVSA 10 Remote Control Session Recording Overview Video  There are five product areas to consider as it relates to this feature:

1. Device Configuration: Remote Desktop Profile - Enabling the feature for devices.  To use the feature, it must be enabled within a Device Configuration: Remote Desktop Profile, for any device you wish to record sessions for.   This Profile also includes an option to enforce recording for all remote desktop sessions. When enabled, any User connecting launching a supported Remote Control session will have the session automatically recorded.

   

2. Permissions for User Defined Teams – Specific configurations for members of User Defined Teams.  Two new permissions have been added to User Defined Teams to support this feature:

   

   • a. Enforce recording for all remote desktop sessions – If checked, when a member of this Team launches a supported Remote-Control session, it will be automatically recorded. 
   • b. View remote desktop session recordings – If checked, members of the Team will be allowed to view the newly introduced “Recorded Sessions” section within the Device Card.

   

3. Recording Status Control and Indicator – Changes to the Remote Control application toolbar.  Once session recordings have been enabled for a device, for any supported Remote Control session, a new Recording control will be available in the Remote Control application toolbar.

   

4. Location of Saved Recordings – Where and how recordings are stored  Remote Control session recordings are saved locally on the target Agent, in “Program Files\VSA X\Recordings” folder. Files are formatted using a date and time stamp, the Agent ID, and the user who initiated the recording.

   Note: There is a protection mechanism to ensure that recordings do not result in the total consumption of disk space on the local device. Recordings will not start if there is less than 10% free disk space on the target Agent. If a recording has started, and the target Agent available disk space falls below 10%, the recording will immediately stop.

   A new section has been added to the Remote Control section of the Device Card, named “Recorded Sessions” and will reference any recordings that are currently stored locally on the target Agent, in the related folder.

   

5. Audit Logs – Information about recordings for activity tracking.  

   Each time a Remote Control session recording is started or stopped, a log entry is captured in the Server Admin > Audit Log, under the “Remote Control” category for the target Agent.

   

Upload Screen Recording to external cloud storage services

To accommodate the new Screen Recording feature, we now provide optional scripts to upload recordings to your own dedicated Azure Blob or AWS S3 storage. Learn more by referring to the automation section of these release notes.

macOS Remote Control 

It is now possible to connect to a target macOS Agent with Remote Control when no user is logged in locally to the device.

Note: This feature will be enhanced in a subsequent release when we introduce support for Automatic Reconnect for macOS agents. Until then, although it is now possible to connect with Remote Control before a user is logged in locally, during the login process, the Remote Control session will be disconnected and will require manual re-connection.

Patching notifications

With this release we introduce Patch Policy notifications. Three notification types are available: 

1. Notification for new patches pending review. 
2. Notification upon error during operating system patching. 
3. Notification upon error during software patching.

To better align with the technician’s workflow, the notifications’ priority and schedule can be customized.

Patch Status page enhancements

This release enhances the Patch Status page by adding the ability to filter the patch list and customize visible columns.

Additionally, the number of pending patches is now displayed next to each Patch Policy in the policies list.

Integrations

KaseyaOne: Disabling Local Login and Enforce KaseyaOne Authentication

Introduction

The Require Log In with KaseyaOne feature forces users to login with their KaseyaOne credentials to access VSA 10. When the feature is enabled by an organization, users can no longer log into VSA 10 locally with their local credentials.  Enabling the Require Log In with KaseyaOne feature allows users to authenticate with their KaseyaOne modules using just one set of credentials. This provides a smoother user experience and increased security.

Pre-Requisites:

• You must be a partner administrator for both VSA 10 and KaseyaOne. 
• You must have the same email address for VSA 10 and KaseyaOne accounts. 
• Before the Require Log In with KaseyaOne feature can be enabled, the Enable Log In with KaseyaOne toggle must be activated.  For more information, see Unified Login with KaseyaOne    When you have enabled KaseyaOne Unified Login for your organization, you can enable the Require Log in with KaseyaOne feature on the Settings page.

To enable the Require Log in with KaseyaOne feature:

1. On the Configuration module, click Settings.  The Settings page is displayed with the Log in with KaseyaOne tab. Verify the Enable Log In with KaseyaOne toggle is activated. If it is not, perform the steps in the article Unified Login with KaseyaOne  
2. In the Require Log In with KaseyaOne section, click the Require Log In with KaseyaOne toggle to enable it.

3. To allow specific users, teams or users with specific email domain to continue to log into VSA 10 using their local VSA 10 credentials, in the Exceptions list, select the applicable users/teams/domains.  
4. Click on Save

Exempt users from being required to log in with KaseyaOne

Once the Require Log In with KaseyaOne feature is enabled, you will be able to add any existing users, team or email domain to the Exceptions list.

Any users, teams or email domain part of the Exceptions will still be able to log in using VSA 10 local authentication.

This option is useful if you have users that need to log in to VSA 10 for remote access or reporting, such as customer IT staff, but do not require KaseyaOne accounts.

Login scenarios   The following describes user login scenarios that are possible when Require Log In with KaseyaOne is enabled:

• When a user attempts to log into VSA 10 with their VSA 10 credentials AND Require Log In with KaseyaOne is enabled, the user is redirected to the KaseyaOne login page.

Note: This does not apply to users included in the User Exceptions list.

When Require Log In with KaseyaOne is enabled and a user is included in the Exceptions list, the user can log into VSA 10 using their VSA 10 local credentials or KaseyaOne credentials (if the user has a KaseyaOne account that is linked to their VSA 10 account).

When Require Log In with KaseyaOne is disabled, the user can log into VSA 10 using their VSA 10 credentials or KaseyaOne credentials (if the user has a KaseyaOne account that is linked to their VSA 10 account).

Enforcing KaseyaOne login disables VSA 10 password reset.

When Require Log In with KaseyaOne is enabled, the user’s ability to reset their VSA 10 password is disabled.

On the My Settings page, the Authentication tab is disabled and a message is displayed indicating that KaseyaOne Login is enforced. Therefore, resetting VSA 10 passwords is not allowed.

Note: This does not apply to users included in the User Exceptions list.

KaseyaOne: Role-Base Access Control 

Introduction

Instructions follow on how to configure role-based access control (RBAC) — by defining mapping rules to control user access — for VSA 10. The purpose of defining mapping rules is to mimic or maintain the same levels of user access between KaseayOne and VSA 10.  

• If you enable Access Groups, then RBAC from KaseyaOne will be allowed for VSA 10 and you will be able to map KaseyaOne groups to (the same or similar) module roles.  
• If you disable Access Groups, then RBAC from KaseyaOne will not be allowed for VSA 10.

Enable Access Groups for VSA 10    To enable Access Groups for VSA 10 do the following:

1. Log into VSA 10 in the usual way and click Configurations > Settings > Log in with KaseyaOne on the left navigation menu.

   

2. In the Access Groups section, turn on the Enable Access Groups toggle to enable the feature.   

3. Create mapping rules to control user access: 

   • Map each KaseyaOne Access Group to the same or a similar VSA 10 team.

Autotask Integration

Pre-Requisites:

• Only admins and those who have PSA Edit permissions are able to create Autotask integration 
• You need your Autotask API credentials 
  • Adding or editing an API user (autotask.net)

To setup the Autotask Integration, you should go to Integrations > Autotask

Once you are logged in with your Autotask API credentials, you will be at the Configuration Wizard page.

Step 1- Mapping Device Type In this screen you will be able to map VSA 10 Device type with an Autotask Product and a Configuration Item type.

The idea behind the Device type mapping is to populate data in Autotask (ConfigurationItemType and ProductType) for each asset. It will be then possible to add dashboard charts in Autotask using these fields.

You can map each VSA 10 device type to their corresponding type on Autotask:

• Autotask Product: Adding product categories (autotask.net)
• Configuration Item type: ConfigurationItems (autotask.net)

1. First you need to define the “Default mapping settings for all device types”.  
2. Once it’s done, you will be able to update each VSA 10 device type and associate it to the corresponding Autotask product and Autotask Configuration Item Type.

3. Once you finish doing the Device type mapping click on Next.

Step 2- Organization Mapping   In this step you will be able to map Organizations / Sites / Agent Groups to Autotask Companies.

1. First you need to define the Default mapping settings for all context field

2. Then you can map each VSA 10 organization, site or agent group to an Autotask Company. 
3. Once you finish doing the mapping click on Next

Step 3- Ticket Attributes Configuration

Alert rules allow you to handle VSA 10 alerts and their corresponding Autotask alert tickets. In the integration tab, begin by configuring your Autotask queue and filter alerts that will generate a ticket in Autotask base in alert priority.    First you need to define the default mapping setting for all context

Queue refers to the Service desk queue the ticket will be created in Autotask. Sets the default values for the Queue field in Autotask tickets. More information: Service Desk queues (autotask.net)

Notification type refers to the criticality of a VSA 10 alert to automatically create an Autotask ticket. For example, you could define that only Critical VSA 10 alerts trigger the ticket creation.

Once you finish with the ticket attributes click on Next.

Step 4- Asset Synchronization   The next step is to configure the asset synchronization between VSA 10 and Autotask.  If “Create new system and map” toggle is enabled, new VSA 10 assets will try to be auto mapped to existing Autotask Configuration items if there is a full or partial match with both  

• Automapping: 
  • If VSA10 device and Autotask configuration item have the same name and company, only in this case auto mapping is possible.  
    • If serial number also matches, it’s a full match. 
    • Otherwise, it’s a partial match.

Select an existing Autotask product to map to your VSA 10 asset or allow the system to create a matching product in Autotask for you.

You can filter assets by:

• All types 
• Mapped 
• Unmapped: full match 
• Unmapped: partial match 
• Do not map 
• Create new

Matching logic between VSA 10 and Autotask asset records: 

• Fully Match 
  • Organization 
  • Serial Number 
  • Mac Address 
• Partial Match

• When a device is deleted in VSA 10, the corresponding Autotask configuration item will be inactivated. 
• An asset sync will be triggered once every hour. 
• During setup, for any unmatched asset, you can either accept the suggested match, search for an Autotask configuration item, or create a new configuration. Once you click “Save” you will be able to save changes.

Once integration updates are done, you will be redirected to the settings page automatically.

ADDITIONAL section for the Autotask Integration module     Create Tickets from Agent Tray    To enable users to create a support ticket, you need to create a “User Sessions” profile and enable “User Support Request”.     Then the profile should be applied to Organization / Site / Devices via Policies.

Integrated Customer Billing via Autotask and Kaseya BMS 

  Integrated Customer Billing is a new feature introduced as part of billing automation.   MSPs require an efficient and accurate way to bill for services provided to their customers, but manual billing processes are error-prone and tedious, and they can result in lost revenue. Having granular billing metrics for various Kaseya IT Complete modules available in Autotask and Kaseya BMS allows for flexible automated billing.

• How to enable integrated customer billing in BMS: BMS Finance | Integrated Customer Billing – Kaseya
• How to enable integrated customer billing in Autotask: Integrated Customer Billing via Autotask and Kaseya BMS (datto.com)

VSA 10 synchronizes billing metrics daily to a data lake accessible by both Autotask and Kaseya BMS via the KaseyaOne unified login portal.

The information provided is the total number of managed devices with a breakdown by the following types:

• Number of devices under management (defined as having consumed a single device license whether it is network-enrolled, has an agent, is mdm-enrolled. A device will only count once regardless of its enrollment types). 
• Number of enrolled devices that do not have an agent installed and are not enrolled in MDM. 
• Number of devices that have an Agent installed. 
• Number of devices that are enrolled in MDM (includes Agentless and Agented devices). 
• Number of devices that have an Agent installed and have Webroot installed. 
• Number of devices that have an Agent installed and have Bitdefender installed. 
• Number of devices that have an Agent installed and have Ransomware Detection installed. 
• Number of devices that have an Agent installed and have an active Patch Policy applied. 
• Number of enrolled Network Devices (enrolled devices that do not have an agent and are not enrolled in MDM) that have Monitoring assigned directly or through a Monitoring Policy. 
• Number of Agented devices that have a Monitoring Policy assigned. 
• Number of devices that have an Agent installed and are listed as a “workstation” 
• Number of devices that have an Agent installed and are listed as a “server” 
• Number of devices that have an Agent installed and are listed as a “server” and OS = Windows 
• Number of devices that have an Agent installed and are listed as a “workstation” and OS = Windows 
• Number of devices that have an Agent installed and are listed as a “mac” 
• Number of devices that have an Agent installed and are listed as a “Linux” 
• Number of devices that have an Agent installed and were online in the last 30 days

Prerequisites and further information   KaseyaOne must be enabled for your VSA 10 account. Refer to Unified Login with KaseyaOne.

KaseyaOne must be enabled for your Autotask or Kaseya BMS instance, and you must have Admin permissions to configure Integrated Customer Billing in either of the products.    For detailed information, refer to the following guides: 

• Autotask: Integrated Customer Billing 
• Kaseya BMS: BMS Finance | Integrated Customer Billing

Other Feature Enhancements

Left Navigation and Terminology Updates

Changes have been introduced in the 10.8 release to align with the terminology used across the IT Complete product suite. The changes are detailed in the release notes here.

Rename Devices 

  This release introduces the ability to rename devices directly from the Device Card, including Agents. To take advantage of this feature, open the Device Card and click the pencil icon next to the device name.     This feature also includes an ability to Reset to Default, which will allow you to reapply the default name to the device after it has been renamed. For example, for mobile devices, the default name would be the serial number, and for Agented devices, the default name would be the computer name.

Storage Monitoring 

  The existing Monitoring: Storage Profile has been enhanced to support individual conditions for granular storage monitoring of Windows Agents.  Note: Support for macOS, Linux, and BSD Agents will be included in a subsequent release. 

• Each individual Monitoring: Storage Profile supports a maximum of 20 conditions 
• When specifying a drive letter, acceptable formats are “DriveLetter” and “DriveLetter:” and are case insensitive

Services Monitoring 

  In VSA 10.7, we enhanced Service monitoring for Windows Agents, to support the ability to trigger notifications when a monitored service is missing on an agented device, and when a monitored service was in place but has been removed.

In this release, this feature has been extended to support Linux, and BSD Agents.

Mobile Application: Add MDM Commands 

  With this release, we have added a dedicated section for MDM commands on the system details of MDM-enrolled devices. This is in addition to the Agent-based commands:

Advanced Reporting  

This release will bring new reporting features, datasets, report templates and performance improvements.

New datasets

• “Rmm - Tags” 
• “Rmm - Application Extended”  

New templates

• “Tags” 

• “Tags tabular” 

• “Applications tabular”  

• “Unsupported Windows OS” (new version) 

• “Servers, Workstations, and Network devices per Organization” 

• “QR codes for Devices”    New features

• Document binder - users can now seamlessly view, export, and schedule collections of templates 

• Multi-Section RDL - allows for the incorporation of ‘sections’ within RDL reports.

API Improvements 

  This release includes new API endpoints, and enhancements to existing endpoints to allow integrators and customers to programmatically drive automation. These enhancements include GET and POST methods and the ability to register webhooks during automation executions.

Automation Scripts

• Get a Script (GET) 
• Get All Scripts (GET) 
• Run a Script (POST) 
• Get Script Executions (GET) 
• Get Script Execution Details (GET)

Automation Tasks

• Get Script Executions (GET) 
• Get Script Execution details (GET) 
• Get a Task (GET) 
• Get all Tasks (GET) 
• Run a Task (POST) - enhanced 
• Get Task Execution Scripts (GET) 
• Get Task Execution Output (GET)

Automation Workflows

• Get a Specific Workflow (GET) 
• Get All Workflows (GET) 
• Run a Workflow (GET 
• Get Workflow Executions (GET) 
• Get Workflow Execution Details (GET)

Automation 

  New Workflow Templates

Several new Workflow Templates have been added. Discover the available and growing list by clicking on “Action, Create from Template” while in the Workflow tab.   New Workflow Templates:

• Ad-Hoc/Scheduled: Run Disk Cleanup 
• Low HDD Space: Disk Cleanup 
• Ad-Hoc/Scheduled: Set Desktop Wallpaper 
• Ad-Hoc/Scheduled: Ask User To Reboot YES/NO 
• Ad-Hoc/Scheduled: Set Screen Lock Policy To 5 Min 

New Script Templates

To accommodate the new Screen Recording feature, we now provide optional scripts to upload recordings to your own dedicated Azure Blob or AWS S3 storage.   New scripts in the “VSAX Start Pack” folder: 

• Upload Screen Recordings to Azure Blob Storage 
• Upload Screen Recordings to AWS S3 Storage  Note: The Script templates do not include any subscription to external cloud services. Individually owned subscription to the respective storage services is required.

Double-byte Language Support

We now support saving data objects containing double-byte characters. Prior to this release, double-byte characters would be replaced by “?” when written to the database.

Agent Diagnostic Logging

To streamline the Support process, we have added the ability to enable diagnostic logging on Windows agents remotely from the web application and collect them from the machine without interrupting the end user:  Added a new option to the Configuration > Settings page called “Enable agent diagnostic logging on device card”.

If enabled, Diagnostic Logging can be enabled on Windows systems for up to 72 hours from the Device Card. The Download Logs action will automatically package the logs and download them to the technician’s computer.

Log duration shows the remaining time that diagnostic logging will be enabled for, after which the agent will automatically revert to standard logging. The Disable action can be used to immediately stop diagnostic logging.

Note: diagnostic logging is resource intensive, and it can impact the performance of the target machine. It should only be enabled when recommended by a Kaseya Support representative. 

We plan to extend this functionality to macOS and Linux agents in future releases. 

The VSA 10.2 Release is major step towards the Unified RMM vision of managing any device, any endpoint, any anything the same way. The 10.2 Release empowers you to discover, map, and manage Virtual Desktop Infrastructure as easily as you would manage any other endpoint. Additionally, this release included major enhancements to the VSA 10 API to support deeper and more secure integrations with third party applications. Based on client feedback, the EAP of Release 10.2 also includes a major change to Advanced Search to increase information density. Finally, this release includes several new SNMP profiles to easily manage HP iLO networking devices.

Please see below to dive deeper on the many new enhancements of release 10.2 that continue our mission to empower you to manage your IT ecosystem faster and easier.

Key Feature Enhancements

Virtualization Discovery, Topology, and Management

VSA 10 now includes the ability to configure Hyper-V and VMware Connectors, allowing you to discover, view, and manage hosts and virtual machines.

By connecting directly to the hypervisor, VSA offers a single, consolidated view of your entire virtual infrastructure across multiple platforms.

You will need to create a new Integrations / Connector for each Hyper-V and VMware hypervisor you wish to manage.

• Note: For Hyper-V, you must first install an agent directly on the host and then select the same host as the Hyper-V Connector probe.

Once a Connector has been added, we will expose the hypervisor and its child entities on the Topology Map and the new Systems / Active Connectors page. You can view version information, status, events, and other information from these product areas.

If you enroll the hypervisor’s “Host”, you will unlock the management features of both hosts and virtual machines, such as powering on/off, restarting, suspending, and working with snapshots.

• Note: Enrollment of a host will consume a single device license.

VSA 10 APIs and Token-based Access Control

VSA 10 now includes a set of API Endpoints that are only accessible by using a secure token. The API documentation and sample data can be found by accessing https://<your_server_URL>/api Token-based API access allows technicians to grant explicitly controlled authorization tokens for a more secure API-only access entity that is distinctly separate from user accounts, while also consolidating the management of API access controls.

There are two methods of API access authorization that can be granted:

• Trusted Applications – This allows a simple OAuth-based authorization process to be used to enable VSA 10 integration from an implicitly trusted product – for example, products that are part of Kaseya’s IT Complete product suite.

Note: Although the VSA 10 Trusted Application infrastructure is now ready, integrated products will be working with our team to convert their existing VSA 10 integration and legacy API calls to the new Token-based APIs.

We will be working with internal product teams over the coming months to coordinate such changes. Once the changes are in place, there will no longer be a need to hard-code a VSA 10 username and password into the integration configurations for such Trusted Applications. Instead, a simple OAuth process will be initiated from the integrated product and used to establish the implicit trust with VSA 10.

• Third-Party Tokens – This allows the creation of a unique API Token that requires explicit trust configurations for controlling when, what, and from where the Token is authorized for use with respect to the API. Once the token is generated, the Token ID and Token Secret would be used to gain access to the API and its use would be restricted based on any authorization controls defined.

To increase security, you can define start and expiration dates, whitelist IP addresses for access restrictions, and control granular access to specific Organizations and individual API endpoints.

You can also revoke an existing token to immediately prohibit further use. By revoking an existing token, you will have 30 days until it is automatically deleted. To reinstate the token, simply regenerate the token secret prior to end of the 30-day period.

Note: Third-party tokens should not be used to establish integration with VSA 10 from other Kaseya products that currently support integration. Such products use a different VSA 10 API today and will be changed to use Trusted Application tokens in the future.

Content: Additional SNMP Profiles

New SNMP profiles to support the management of HP iLO devices

Other Improvements

Onboarding Checklist Update

This release includes new additions to the Onboarding Setup Checklist so that new users can learn how to get the most out of VSA 10.

New Default Columns for the Advanced Search / All Systems View

We expanded the data columns that are displayed in the Advanced Search / All Systems view to enhance your productivity and streamline your search experience.

Upgrade Wizard - API Time-Out Fix

A bug has been fixed where API connection timeout could occur when querying large amounts of Orgs in the upgrade process.

SNMP Content: Network Device Profile Fixes

The built-in SNMP Template library is constantly improving with added devices and fixes. Refer to the “created at” date in the Description field for each device template for the latest version.