Ironscales Now Works in Harmony With HaloPSA

Starting November 1, IRONSCALES works hand in hand with HaloPSA.

Since we started working with MSPs, the question behind most of what we build has stayed the same: what would make our partners' days easier? Sometimes the answer is detection. Sometimes it is a console that runs every client from one place. This time, the answer can be found in the system where an MSP's day actually occurs.

The PSA is where the business runs for our partners. Tickets, SLAs, contracts, client history and billing all move through it. When a security tool sits outside that system, every event it produces creates a second job, because someone has to carry it into the PSA by hand. The HaloPSA integration removes that second job for email security.

Before getting into how it works, it is worth being clear about why that second job keeps growing.

Native Protections Have Limits

Microsoft 365 (M365) and Google Workspace (GWS) both ship with built-in email filtering, which is a beautiful thing. The efficacy of their email filtering is the not-so-pretty side of things. M365's native protection misses about 293 phishing emails per 100 mailboxes, and GWS misses about 350.

To the credit of these titans of industry, the reasons are structural and not a lack of effort. Native filters protect an enormous range of customers with one set of defaults, so they lean on signals that hold across that whole population: sender reputation, known malicious links and attachments, and authentication results. The attacks that get through are the ones built to look clean.

A message from a compromised vendor account passes authentication because it actually came from the vendor. A credential harvesting page hosted on a legitimate file-sharing service can easily hide behind that service's (generally) good reputation. A request to update payment details may carry no link or attachment at all, only words. A link that is harmless at delivery can be weaponized hours later, long after the filter has already reached a verdict.

All of these attacks are more or less the status quo for phishing in 2026. And each one that lands in a client's inbox becomes work for the MSP: a user report to answer, a message to investigate and remove, a client to update, and a record of what happened.

The question then becomes: where does all of that work get recorded, and how much of it has to be done by hand?

Security Work Belongs Where the Business Runs

Security work that never reaches the PSA is easy to lose track of. It does not count against an SLA or show up in the client's history, and it does not appear when you review how much time a client actually consumes. The work still happens. It just happens (more or less) off the books.

This is where a leading PSA solution like Halo comes into play. Email security events flow into HaloPSA as tickets, and IRONSCALES usage flows into HaloPSA as license data, so your PSA reflects the security work and the protected mailboxes as they actually are.

Security Events Turn Into Tickets

When a qualifying event happens in IRONSCALES, the integration creates a ticket in HaloPSA within a minute. A user-reported phish or a remediated incident, for example, arrives under the right client, using the ticket types, statuses, priorities and teams you chose during setup.

For an MSP technician, that changes the order of operations. Instead of noticing an event in one console and retyping it into another, your team starts from a ticket that already exists, in the queue it already works. The incident has a timestamp, an owner and a place in the client's history from the first minute.

License Counts Stay in Step

Clients add staff, remove staff and create shared mailboxes all year. When the mailbox count in your security platform drifts from what you track in your PSA, you either protect mailboxes you are not billing for or spend time reconciling at month end.

Once a day, the integration syncs IRONSCALES usage to HaloPSA software licenses, with a retry later in the day for any record that failed. The numbers in your PSA follow the numbers in your security platform.

What the Integration Touches in Your Halo Instance

PSA administrators reasonably want to know what an integration does before they connect it. Here's a summary so we can (hopefully) get ahead of your questions.

The integration authenticates with OAuth2 client credentials. You create an API Application in HaloPSA, and we recommend running it under a dedicated API-only agent so its activity stays separate and easy to audit. Its permissions cover reading your clients, contracts, items and ticket settings, creating and updating tickets, and reading and updating software licenses.

Its schedule is light. Usage syncs once a day. Tickets are created when events happen, not on a timer. Setup data is read only while you run the setup wizard. There is no hourly polling, and no data syncs back from HaloPSA to IRONSCALES.

How to Integrate

Setup takes three simple steps. Create the API Application in HaloPSA, enter the Client ID and Secret in IRONSCALES, then run the setup wizard to map your HaloPSA clients and ticket settings. It's that easy.

Security work your PSA can see is security work you can manage, measure and bill for. The integration is available November 1. To learn more about this new integration between Ironscales and HaloPSA, contact MSPPartners@ironscales.com.

We hope you're as excited about this announcement as we are. It is the first of several changes coming to the platform before 2027, all with the same goal of making your work easier. Stay tuned.