Halo Integrator¶
The Halo Integrator is the background service responsible for scheduled data imports and synchronization between the GRC-ITSM platform and connected third-party systems. When you enable an integration like Microsoft Entra ID, the Integrator is what handles the recurring import of users, groups, assets, and other entities into the platform.
On cloud-hosted deployments, the Integrator is built into the platform and requires no additional setup beyond configuring the integrations themselves. For self-hosted deployments, the Integrator is installed and configured by the engineering team that implemented the platform.
Navigation
The Halo Integrator is configured per integration. Navigate to Configuration > Integrations, select the integration you want to configure, then look for the Halo Integrator section within the Imports tab.
What the Integrator Does¶
The Integrator runs on a schedule and handles the automated synchronization of data between external systems and the GRC-ITSM platform. Rather than requiring manual imports each time data changes in a connected system, the Integrator keeps the platform up to date automatically.
| Function | Description |
|---|---|
| User imports | Synchronizes user accounts from identity providers (e.g., Microsoft Entra ID) into the platform, keeping the user directory current |
| Asset imports | Pulls asset and device data from RMM tools, cloud platforms, and asset management systems |
| Contact/site imports | Synchronizes organizational contacts and site information from connected directories |
| Appointment sync | Imports calendar appointments and schedule changes from Exchange |
| Deactivation handling | Automatically deactivates entities in the platform when they are no longer found in the source system |
| Continuous sync | After initial import, only recently updated records are retrieved with each sync cycle, reducing processing time and load |
How It Works¶
The Integrator operates as a scheduled background process:
- Schedule fires - the Integrator runs at its configured interval
- Connects to source - reaches out to the configured integration (Entra ID, RMM tool, etc.) using the credentials and API access defined in the integration setup
- Retrieves changes - pulls new or updated records from the source system (continuous sync mode only fetches changes since the last run)
- Imports/updates - creates or updates the corresponding entities in the GRC-ITSM platform
- Deactivates stale records - optionally deactivates entities that no longer exist in the source system
Sync Frequency¶
The appropriate sync frequency depends on the integration and the volume of data:
- Identity providers (Entra ID, Active Directory) - imports can involve large numbers of users and should run less frequently to allow each sync to complete before the next one starts
- RMM and asset tools - frequency depends on how often asset data changes in the environment
- Calendar sync - can run more frequently since the data volume is typically small
Frequency Guidance
Set the sync frequency based on how much data the integration processes. An integration that imports thousands of users needs more time between runs than one that syncs a handful of calendar appointments. If the interval is too short, syncs may overlap and never complete.
Example: Microsoft Entra ID User Sync¶
A common use of the Integrator is synchronizing users from Microsoft Entra ID into the GRC-ITSM platform. This keeps the platform's user directory in sync with the organization's identity provider, so new hires appear automatically and departing users can be deactivated.
Configuration¶
- Navigate to Configuration > Integrations > Microsoft Entra ID
- Select the target tenant and configure site/agent mappings
- Open the Imports tab
- In the Halo Integrator section:
- Enable the Halo Integrator for the Microsoft Entra ID integration
- Select the entities to import (e.g., Users)
- Enable Deactivate Users when they are not found in Entra ID to automatically disable accounts for users removed from the directory
- Save the configuration
Once configured, the Integrator handles ongoing synchronization automatically. New users added to the mapped Entra ID groups appear in the platform, and users removed from those groups are deactivated.
Compliance Relevance¶
Automated user synchronization supports several access control requirements:
- FedRAMP AC-2 (Account Management) - ensures the platform's user directory reflects the current state of the identity provider
- FedRAMP PS-4 (Personnel Termination) - automatic deactivation of users removed from Entra ID helps ensure timely access revocation
- CMMC AC.L2-3.1.1 (Authorized Access Control) - only users present in the identity provider retain access to the platform
Integrations That Use the Integrator¶
The Halo Integrator is available for any integration that supports scheduled data imports. Common integrations that leverage it include:
| Integration | What the Integrator Syncs |
|---|---|
| Microsoft Entra ID | Users, groups, organizational contacts |
| Active Directory | Users, groups, organizational units |
| Google Workspace | Users and groups |
| Microsoft CSP | License and subscription data |
| Intune | Managed devices and compliance status |
| RMM tools (NinjaOne, Datto, Connectwise, etc.) | Assets, devices, and monitoring status |
| Exchange Calendars | Appointments and calendar events |
| Asset management tools (Lansweeper, Snipe-IT, etc.) | Hardware and software inventory |
Troubleshooting¶
| Issue | Likely Cause | Resolution |
|---|---|---|
| Import not running | Integrator not enabled for this specific integration | Check the Imports tab for the integration and verify the Halo Integrator section is enabled |
| Users not appearing after sync | Group mappings not configured, or users are not in the mapped groups | Verify site/agent mappings and that the correct Entra ID groups are selected |
| Sync taking too long | Too much data being processed per cycle, or sync interval is too short | Increase the interval between syncs, or reduce the scope of what's being imported |
| Users not being deactivated | Deactivation setting not enabled | Check that the "Deactivate when not found" option is enabled in the Integrator configuration |
| Duplicate records | Source system has duplicate entries, or mapping rules are creating new records instead of matching existing ones | Review the mapping configuration and check for duplicates in the source system |