Skip to main content
Connect ConnectWise Manage so Rallied picks up new service tickets the moment they land, gathers the context your technicians would normally have to chase, and either resolves the ticket or hands it back with a clear plan.
ConnectWise Manage is configured in MSP Settings → Integrations.

​
Before you connect

Rallied signs in to ConnectWise using an API member you create. Rather than pointing that member at an existing role, give it a dedicated security role so its access is scoped to what Rallied actually needs, and nothing more.

​
How permissions work

Think of it like onboarding a new team member: you give them a security role in ConnectWise so they can access the areas they need, then their manager decides which tasks they actually work on.
  • The ConnectWise security role is the ceiling — the maximum API access Rallied could use.
  • Rallied’s approval settings are the actual controls — you decide which actions run automatically, which need a technician’s approval, and which are disabled.
Granting access here doesn’t mean Rallied will use everything. It means Rallied can operate when you enable a capability in your approval settings.

​
Create the “Rallied” security role

In ConnectWise, go to System → Security Roles and create a new role called Rallied. Configure the role with the permissions below. Read access — set Inquire Level to All (all entries) for these modules: Reading is safe; it never changes anything in ConnectWise. Write access — set Add Level and Edit Level to All for these entries:
Manage Attachments is what lets Rallied attach files to tickets — for example, a screenshot a user shares in a chat. Without Add: All on this entry, attachments fail with a “You do not have security permission to perform this action” error.
Delete access — one entry only: Rallied registers a webhook when you connect and removes it when you disconnect. Without delete access here, disconnecting leaves an orphaned callback firing at Rallied.
Leave everything else read-only. Keep Add, Edit, and Delete at None for anything not listed above — including Finance write entries (Invoicing, Agreements, Billing Rate Maintenance, Accounting Interface), Procurement write entries (Purchase Orders, Purchasing Approvals, Products), Project entries, Sales, Marketing, and the sensitive System entries (Member Maintenance, Security Roles, Add Licenses).This is the least-privilege configuration for what Rallied writes today. If you want the agent working in a new area later, see Granting more later below.

​
Granting more later

The role above covers what Rallied writes to today. Rallied also ships generic ConnectWise API tools (GET, POST, PATCH to any endpoint) that are disabled or approval-gated by default. If you want the agent working in areas this role doesn’t cover (projects, agreements, purchase orders):
  • Grant those entries in the ConnectWise security role.
  • Enable the corresponding tools in your approval settings.
Start narrow; widen when you have a reason to.

​
How to connect

1

Create an API member

In ConnectWise Manage, go to System → Members → API Members and create a new API member:
  • Security Role — the Rallied role you created above.
  • Member ID — a descriptive identifier like rallied.
  • Email — an address you control.
Then, under that member, create a new API key pair. Note the Public Key and Private Key — the private key is shown only once.
2

Optional: map your technicians to ConnectWise members

ConnectWise doesn’t let API-only members create time entries, and time has to be attributed to the technician who did the work. If your team will use the Rallied ticket workspace to log time or post customer-visible replies:
  • Create a regular (non-API) member for each technician under System → Members.
  • Map them in Rallied under MSP Settings → Integrations → ConnectWise → member mappings.
Rallied still authenticates with the API member’s keys. The mapped members are used only as the author of notes and time entries.Unmapped users can still work in the ticket workspace — they just can’t create time entries or customer-visible replies. Internal notes fall back to bot attribution with a generated author line.
3

Open MSP Integrations

In Rallied, go to MSP Settings → Integrations.
4

Connect ConnectWise Manage

Find the ConnectWise Manage card and click Connect. A credentials form appears.
5

Enter your credentials

Fill in:
  • ConnectWise URL — your ConnectWise instance URL (e.g. https://na.myconnectwise.net)
  • Company ID — your ConnectWise company identifier (the exact name from the ConnectWise login screen)
  • Public Key — the public key from the API member
  • Private Key — the private key from the API member
6

Save and confirm

Click Save. Rallied validates the credentials, registers a webhook in ConnectWise, and imports your existing companies as clients. The card shows Connected when complete.
When you first connect ConnectWise, Rallied imports your ConnectWise companies as clients. New clients get an agent provisioned automatically.

​
What happens when a ticket comes in

When a new service ticket is created in ConnectWise, Rallied picks it up right away. Your technician sees:
  1. The ticket appears in ConnectWise as usual.
  2. Within moments, Rallied posts an internal note with what the ticket is about, who it’s from, and what it plans to do.
  3. Anything Rallied can safely handle on its own (looking up context, drafting a response, running approved actions) happens without waiting.
  4. Anything you’ve flagged for review shows up as an approval request on the ticket — approve or deny by replying to the note.
  5. The technician approves the plan, denies it, or takes over. Rallied only acts on what you’ve cleared.

​
If Rallied missed the ticket when it was created

ConnectWise only announces a new ticket once, and Rallied can skip that first announcement in a few cases:
  • The ticket’s company wasn’t yet mapped to a Rallied client.
  • The ticket’s status wasn’t one of the accepted statuses at creation time.
  • ConnectWise was temporarily unreachable when Rallied went to fetch the ticket.
You don’t have to do anything to recover. When a later note or update lands on the ticket and the client and status now qualify, Rallied starts the agent at that point. The agent picks the ticket up from its current state, including the note that triggered it.

​
Sensitive tickets and identity verification

For sensitive tickets (password or MFA resets, for example), Rallied can verify the requester’s identity before doing anything. If you’ve connected an identity provider like Traceless, Rallied sends the challenge and pauses until the requester approves, denies, or the request expires. The outcome is posted as an internal note so your team always sees what happened.

​
Approving actions without leaving ConnectWise

When Rallied wants to take an action you’ve flagged for review, it posts an internal note on the ticket describing exactly what it plans to do. Reply to that note to approve or deny. Rallied classifies the intent of the reply. A neutral reply (a status update, a comment for another tech) is ignored, so it won’t accidentally approve or deny anything.

​
Notes vs. customer-visible replies

The defaults are conservative. You can roll Rallied out without worrying about it messaging your customers in a tone you haven’t approved:
  • Internal notes — visible only to your technicians. This is what Rallied uses by default for its plans, updates, and reasoning.
  • Customer-visible replies — visible to the end customer. Rallied only sends these when a workflow or instruction explicitly asks for one.

​
Approval settings

Fine-tune what Rallied does automatically vs. what needs a technician’s approval from MSP Settings → Integrations (ConnectWise detail page). See Approval settings for the full model.