What's new
- DNSFilter (2.37.0): connect DNSFilter under Integrations → DNSFilter with an API key from a user with the Read Only role (Align only reads). Each hourly sync reads your customer organizations (canceled ones left out), matches them to clients by name (fix them on Client mapping), and reads each one's roaming clients, networks and daily request, blocked and threat totals. A client's overview gets a DNSFilter card, and two automatic checks count in the health score, compliance controls, alignment standards, reports and the evidence check: a roaming client on every workstation and laptop the RMM sees (matched by host name; synced within 7 days, a setting, and filtering, not unprotected or bypassed), and office networks filtered (every network has a policy and sent traffic in the last 7 days). The staff QBR's Security section shows threats blocked in the last 90 days and how many computers have DNS filtering. Nothing shows in the client portal; no user names or IP addresses are kept.
- Portal Documents and Tickets search fixed (2.36.2): typing in the search box (or picking a category tab) on the client portal's Documents and Tickets pages now hides the rows that don't match; before, the rows were marked hidden but stayed on screen.
- New sign-in backgrounds (2.36.1): new default background images on the staff sign-in (dark) and the client portal sign-in (light). Backgrounds you uploaded under Settings stay as they are.
- Client portal search and organized documents (2.36.0): every list in the client portal has a search box that filters as you type: devices (name, serial, user, model), contacts, licensing, vendors, the tech closet, tickets, quotes and documents; category headings stay while something under them matches. Documents is now one list with category tabs and counts (All, Policies, How-to guides, Emergency & recovery plans and so on, in plain words instead of WISP, SOP or IR / DR / BCP, plus a tab for documents from your PSA named after your company) and a search box, with anything waiting for a signature or acknowledgment on top. Also fixed, from a review of the whole app: a compliance control's document is only a link for portal users who can open Documents; "Since your last review" has a way back; the setup checklist and the workflow help no longer link people to pages their role can't open (the client checklist's links go to the client's own Connectors page); a one-letter search asks for two letters; help, the setup wizard and messages point to the right places after Administration moved to the user menu (demo data under Settings → Diagnostics, vendor templates under Libraries, Staff); the Client portal users list has a filter box.
Tidier flow, from the same review: in the client portal, Documents has its own tab and Meetings moved under Plan; Home no longer repeats the proposed projects or shows an empty "Next meeting" box; every page has the same header; the tech closet's "who's taking it" list loads once per page. On the staff side, new dashboards hide Due for a meeting, Renewals and Clients needing attention (Needs attention and Client health show the same; they're still under Customize, and saved layouts don't change); a client's Reports button opens the business review pack or all reports; the duplicate "Asset summary (no inventory)" entry is gone (the asset report's own option does it); license and vendor dates are called Renewals everywhere; template pages opened from Libraries have a way back; a meeting's Prepare card links to Since last QBR and the executive summary; Unassigned links both ways with Devices; after the setup wizard, Getting set up keeps only the setup steps (day-to-day upkeep is in To do); and the client portal switches point to each other.
- Fix (2.35.2): an existing client's new contract (a renewal) no longer shows under Onboarding → New clients → Signed, ready to onboard: a client already in MSP Align 30 days or more before its contract was made is left out on its own. Anything else that doesn't need onboarding has a Not needed button. Both are listed under Not needed on the same page, with Undo or Onboard anyway.
- Fix (2.35.1): in the client portal, View & accept on a quote and Reply on a ticket gave "not found" for most quotes and tickets: ITFlow's guest page keys can contain - and _, which were refused. They open ITFlow's page again.
- Administration moves to the user menu (2.35.0): Integrations, Libraries, Staff & portal users, Settings and the Audit log leave the left menu. Click your name (top right) → Administration for an overview of them; their pages have their own menu, with Back to MSP Align at the top. Everyone sees only what they can open: viewers Libraries and the sync history, techs also client mapping, hosted backups and client portal users, admins everything (plus Diagnostics and Updates & backups). A dot on your picture means something there needs a look (an integration error or an update).
- Tickets, quotes, ITFlow documents and bill pay in the client portal (2.35.0): with ITFlow, the client portal can be your clients' one place to go. On a portal user, tick Tickets to let them see their tickets (the ITFlow contact with their email address, or ones they opened in the portal) with your replies and their own (never internal notes), and open new tickets under their contact (up to 10 an hour); tick See every ticket of their company too for the owner or office manager. Reply opens ITFlow's own page for that ticket, where they reply or close it without another sign-in. Quotes lists the quotes you've sent their company (never drafts); View & accept opens ITFlow's page for the quote to accept or decline it. With Documents shared in the PSA ticked (it needs Documents access), the documents ITFlow shows to the client (its client-visible setting: check it first) appear on the portal's Documents page under From ITFlow, read from ITFlow when opened. Invoices are not shown; instead, set a Bill pay address under Integrations → ITFlow (your ITFlow portal or payment provider's page) and tick Pay bills on whoever pays your invoices, and they get a Pay a bill button in the portal's top bar and on Home. The lists come from the hourly sync (a ticket is read again whenever someone opens it); everything is off until you tick it (and an MSP that uses ITFlow's own portal can turn the whole feature off with the Client portal switch on Integrations → ITFlow), each portal user only ever sees their own company's records, and opening tickets, replies and quotes is audited.
- Send documents for signature (2.34.0): on any active client document, Send for signature emails one or more of the client's contacts their own private link. A written document is sent as a PDF, the way it prints; an uploaded PDF is sent as it is (a Word or Excel file has to be uploaded as a PDF first). Everyone signs at once on the same signing page as contracts (typed or drawn, with the consent to sign electronically). Options: Ask for a code emailed to them before they can open it, I countersign after they've signed, how long the links work, a message, and Ask again when this document changes: when a signed document changes later it shows Needs signing again with a Send again button (nothing is emailed until you press it). The document page shows where each request stands (Sent, Signed by 1 of 2, Waiting for countersignature, Completed, Declined, Expired, Cancelled), with Remind, Send again and Cancel; reminders follow the contracts' schedule. When everyone has signed, the signed copy is the PDF that was sent with the signatures and a certificate added at the end (who signed, when, from which IP address and browser, how they were identified, and the SHA-256 of the PDF sent). It's kept with the document and emailed to the signers. Portal users who are signers see Waiting for your signature on the portal home and Documents pages and can sign there without the code; one portal user can never sign for another. The compliance report has Send for signature too: the client's version of the report is kept as a client document, then sent. Create links only makes the links without emailing them (they're shown to you once, with a Copy button, to send from your own email; it works without email set up), and Link on one person does the same for them; Align sends link-only people no reminders. When the document is shared in the client portal, portal users with Documents access can download the signed copy there; signed copies of unshared documents stay with staff. Techs and admins; everything is audited.
- Staff acknowledgments of policies (2.34.0): next to Send for signature, Ask staff to acknowledge emails the client's contacts you tick and/or staff addresses you paste (one per line or separated by commas, Name <address> works; invalid addresses and repeats are left out, up to 500 people per request; pasted people aren't added as contacts). Each person opens their own private link, reads the document (the same PDF as for signature) and ticks I have read and agree to this policy with their name. No drawn signature and no code. Align records the name, address, time, IP address, browser, and the version and SHA-256 of what they read. The document's Acknowledgments box shows who acknowledged, who is waiting and whose link expired, with Remind, Send again, Add people and Cancel; reminders follow the contracts' schedule. Record prints an acknowledgment record for audits and insurance (document, version, fingerprint, date sent, each person with status and time) and saves it as a client document (Assessment) in one click. Optional Counts as evidence for a control of the client's frameworks: Set as evidence writes "5 of 5 staff acknowledged … on php bin/align make:connector <rmm|psa|backup|saas> "Product name" writes a working connector from a template, with a fake API and a test suite, and registers it; Writing a connector explains the rest and the review checklist is what each pull request goes through. Security and SaaS connectors keep their tenants and check results in shared tables (migration 080) and add automatic checks that compliance controls, alignment standards, the health score, reports and the evidence check use like the built-in ones; a check that can't be worked out is unknown, never a pass. Community connectors ship as beta and read-only.
- Asset tags (2.21.0): a device (or tech closet spare) can carry the client's own asset tag, kept in Align with its other values. Type it on the device, or import a client's list from Devices & assets → Import asset tags (a CSV with an Asset tag column and a Serial or Device column; serial numbers are matched first, then names, and every row is shown before anything is saved). Tags aren't unique: one used twice is saved and flagged. Tags show in the device lists, global search, the client portal's Devices, the printed asset reports and the CSV export, and the REST API reads and sets asset_tag. Migration 079. Also fixed: 2.20.0's Word import needs PHP's zip extension, which the installer didn't add; updating installs it (php-zip), Settings → Diagnostics lists it, and without it a Word or Excel upload is still checked by the part names inside it.
- Upload files to Documents (2.20.0): a document can be an uploaded file as well as a page written in Align: PDF, Word (.docx, .doc), Excel (.xlsx, .xls), CSV, PNG or JPEG, up to 25 MB (Upload a file on a client's Documents page or on Documents). Each file is checked against its type and stored under a random name next to the other uploads (and in backups). PDFs are shown in the page with the built-in PDF viewer and pictures as images; Word, Excel and CSV files download. Uploaded files have the same category, status, review date, client portal sharing (clients can view and download them) and compliance evidence links as written documents. Replace file keeps every earlier file in the history, where it can be downloaded or restored. A Word (.docx) file can be imported into a new editable document (text, headings, bold, italic, lists and links; tables become one line per row; pictures, headers and footers are left out). Migration 078; the web server allows 25 MB on the two upload addresses only.
- Easier to find who has a license (2.19.1): each license has a People button (or Assign people) on a client's Licensing page and on Licensing & renewals for all clients, its edit window links to it, and the all-clients Contacts page lists each person's licenses.
- Who has which license (2.19.0): each license lists the people who hold it. Microsoft 365 assignments are read with the hourly license sync (no new permissions: the app already reads users) and matched to contacts by email; accounts that can't sign in but still hold a license are flagged, and accounts that aren't contacts are listed with Add as contact. Any other license (Adobe, AutoCAD, line-of-business software) is assigned to contacts by hand from the license's people page, several at once; more people than seats bought is flagged. The client's Contacts page and a contact's window show their licenses and the devices they last signed in to (matched on the RMM's last user), and the client portal shows who has each license under Licensing and each person's licenses under Your team. New table license_assignments (migration 077).
- Portal devices fit the page (2.18.1): the client portal's device list shows every device without scrolling sideways (type and last user under the name, serial under the make and model, warranty and replacement dates in one column) and turns into one small card per device on a phone.
- Evidence check for the automatic security results (2.18.0): before Align's automatic checks (Huntress, Microsoft 365, Google Workspace, email authentication, security awareness training) are relied on as compliance evidence, a tech answers each one for a client from the client's own systems, without seeing Align's result (Compliance → Evidence check → Answer the checks on the client), and Align shows each answer next to what it found at that moment: agree, disagree, couldn't tell, or no result. Compliance → Evidence check brings the clients together: each check is trusted once answers from at least two clients agree with Align and none disagree, a system passes only when every one of its checks is trusted, every disagreement is listed with what Align found and how the tech checked, and an anonymized CSV can go with a report of a check that's wrong (clients as Client A, B…; no notes or people; the client's and its tenants' names, device and agent names, domains, addresses and IDs taken out of Align's text; read it before sharing, since Align can only remove names it knows). The checks are the same ones alignment standards use, so the answers cover both. Nothing about the checklists themselves changes.
- Faster syncs on large installs (2.17.1): measured on a test install with 150 clients and 11,000 devices. The two-minute PSA asset check reads linked devices a hundred at a time (5,193 linked devices: 1.4 seconds and 5,197 database queries before, 0.26 seconds and 56 queries now). A Huntress sync stores its agent, incident, escalation, report and port lists a few hundred rows per statement in one transaction (10,000 agents: 5.6 seconds and 10,114 queries before, 1.4 seconds and 148 queries now), so a failure part way leaves the stored list as it was. Health for a client added since the morning refresh reads only that client's devices (0.26 to 0.03 seconds). Text from NinjaOne, Datto RMM, Tactical RMM, KnowBe4, Huntress and Curricula is cleaned by one shared rule (Huntress and Curricula now follow the RMMs' rule: stray control characters are dropped and a number in a name field is kept as text), and the client portal's tech closet has its own controller (same addresses). Nothing on screen changes.
- A cleaner, more modern look (2.17.0): a white page with softly tinted cards and no borders, rounder corners, the Inter typeface (bundled with Align, so nothing loads from outside) and a blue-grey menu (the current page keeps the brand color), in light and dark mode, on the sign-in pages and in the client portal. Settings → Branding's preview and the light and dark choices under Account show the new look. Every page has a main heading and one tab style (tabs scroll sideways on phones), empty lists show one empty state, and status colours mean the same on every page: anything ended (archived, expired, cancelled, declined, revoked, withdrawn) is grey. Field labels are tied to their fields, so clicking a label focuses its field and screen readers read it; icon-only buttons have names, and keyboard focus has a clear outline. Printed reports and PDFs don't change.
- Tidier navigation, one Connectors page per client and regrouped settings (2.16.0): each client's menu has a Setup group (Connectors, Client portal and Onboarding, which is now always there). A client's Connectors page is the one place for everything specific to that client: a status line with every connection, then its PSA and RMM links, Security (its Huntress organization, and security awareness training: the KnowBe4 token, the Curricula account and Huntress SAT uploads with their history), Email and domains (Microsoft 365, Google Workspace, email authentication and the domains' registrar and expiry, moved from Vendors) and Backups (backup company links and hosted machines to claim, moved from the Backups page). An RMM, backup or security tool link can be changed right there for that client; Client mapping still does many clients at once, and both save the same way. The overview keeps the results, with a Manage link. In the main menu, a new Libraries page leads to every template and list you reuse (alignment standards, compliance frameworks, document, vendor, contract and onboarding templates; Standards left Settings for it, and vendor templates left the Clients menu), Licensing and Renewals are one item with two tabs, and People is Staff & portal users. Settings has a new Health & checks tab with the health score and the pass marks for training, phishing, backups overdue and the SLA goal (moved from Planning & lifecycle and the Huntress, Veeam and PSA integration pages; the values you set are kept). The company address moved from Contract templates to Settings → General, Branding shows the company name from General, and demo data moved to Diagnostics. Phones get a search button.
- Fixes from a code review (2.15.2): a Curricula phishing campaign with a long title no longer stops that client's training results from being read. A reply from Huntress or Curricula that isn't the list Align asked for is now refused instead of being read as "no records" (which could clear stored incidents or results), and Curricula accounts with a long report history read again. Only admins can now connect over, confirm or disconnect a client that uses its own Microsoft 365 app or Google Workspace key (saving those was already admin-only), and techs no longer see Disconnect there. A retired vendor no longer blocks its name: you can add a vendor with that name again and edit it, and restoring the retired one is refused while an active vendor has the name. In the client portal's tech closet, people without the Documents, contacts & meetings permission check things out to themselves instead of picking from a list of every contact, parallel requests can't pass the hourly limits, and a malformed form no longer causes a server error. HaloPSA reads each list to its end, so records added during a sync can't push others out of it (and get them archived); Datto RMM tries devices with no hardware read yet again weekly instead of never or every run. Health score settings can't be saved contradicting each other, and database error details no longer reach pages, the sync log or alert emails from the newer connectors.
- Document templates and tech closet updates (2.15.1): the Acceptable Use Policy now covers AI tools (approved tools only, business accounts whose data isn't used for training, no Confidential or Restricted data in unapproved tools, checking AI output, telling people before recording a meeting, reporting deepfakes), prohibited activities including unapproved cloud apps, single sign-on, personal devices and enforcement. The Incident Response Plan is rewritten around the client reporting and your team running the response: definitions, roles (your Incident Handler and the client's Service Manager), four severity levels with response targets, what staff do first (and don't do), what your team does at intake, a remediation checklist and the steps when sensitive data may be involved. The WISP adds where customer information lives, clean desk and visitor rules, one spokesperson, signed acknowledgments, 90-day log reviews and sending passwords apart from files. The BC/DR plan gets an Emergency mode operation section (downtime procedures, emergency access, backup power, backing up before a move), and the Information Security Policy adds guest Wi-Fi, approving new devices before they join the network and turning off AutoRun. Two new templates: Data Classification & Handling Policy (handling rules per level, plus extra rules for PHI, card data and CUI where present) and Risk Management Policy (NIST SP 800-30 based assessment and treatment steps, yearly assessments and the risk register at each QBR). A new 24/7 security phone under Settings → General fills {{company_emergency_phone}} (the office phone when blank). Built-in templates you haven't edited are updated; ones you've changed, and documents already made, stay as they are. In the tech closet, a new portal permission, Add tech closet items and keep them up to date, lets a client's people add items to their own closet, fix details, update counts and remove what's gone, so your team and theirs keep it current together (every change shows who made it, with a portal badge, and a removed item can be brought back from your side; serials and staff notes stay on your side). The Mark spare button on a device now lines up with the others.
- Tech closet (2.15.0): keep track of spare parts and equipment for each client and for your own offices, and who has what. Tech closet in the main menu is your own stock, kept by office (add your offices there; one is fine), and each client has a Tech closet page for what's kept at their site. Items are either counted stock (cables, mice, headsets: how many are on the shelf, with an optional minimum that puts "running low" on the To do list) or one tracked item with a serial (a monitor, a loaner laptop). Check things out to one of the client's contacts or anyone by name (your own stock: with the client they're at), with an optional due date (overdue ones go on the To do list), then check them back in, or mark counted stock used up. A computer that's already in Align can be marked spare from its page or the client's closet: it stays in replacement plans, budgets and reports with a spare badge and can be checked out the same way, but it isn't flagged stale and is left out of the health score, compliance and alignment indicators, the email digest and backup and Huntress coverage until it's back in use (whether spares count in contract seat counts is a setting under Settings → Planning; they do by default). Every item keeps a full history. In the client portal, a new Tech closet permission shows the client's closet and spare devices, and Check out lets them check their own items out and in and ask you for parts (a ticket in your PSA, else an email); adding items and changing counts stay with your team, and your loaners show as "return it to us".
- KnowBe4 (2.14.0, beta): Align can now read each client's security awareness training and phishing results from KnowBe4. KnowBe4's reporting key belongs to one customer console, so switch it on under Integrations → KnowBe4, then on each client's Security awareness training card an admin picks the client's region and pastes a Reporting API token from that client's console (Account Settings → Account Integrations → API; Platinum, Diamond or SAT Foundations/Advanced). Align checks the token before saving it, encrypted, and reads once a day: the account's seats and risk score, training completion from the last 13 months (enrollments that are due, policy acknowledgements left out, each person counted once) and each phishing test's emails delivered, clicked, reported and data entered. Only totals are kept, never names. The results count in the same two training checks, the health score and the QBR security section as Huntress SAT, in place of uploads; a client with KnowBe4 doesn't also read Curricula. A refused or throttled read keeps the last results and shows the error on the card. It only reads from KnowBe4, and it's marked beta: built from KnowBe4's API documentation, so please report anything that looks wrong on GitHub. The website lists the new integration.
- Datto RMM (2.13.0, beta): Align can now read devices from Datto RMM, on its own or alongside NinjaOne and Tactical RMM. Turn on API access in Datto (Setup → Global Settings → Access Control), generate API keys for a user with a read-only security level that sees every site, then under Integrations → Datto RMM pick your platform (the name in the user's API URL, such as merlot) and enter the API key and secret key. Each sync reads Datto's sites as organizations (its built-in Deleted Devices site left out), linked to Align clients by name on Client mapping, and its devices: host name, operating system and build, last check-in, logged-in user and online status, with servers, laptops, desktops, printers and virtual machines told apart. Datto gives make, model and serial number one device at a time and limits requests for the whole account, so Align reads up to 200 devices' hardware per sync, keeps it, and only asks again when Datto audits a device again: a large account fills in over a few hourly syncs, and Align backs off for the run whenever Datto asks it to slow down. A device deleted in or gone from Datto is marked removed; an answer that isn't Datto's changes nothing. It only reads from Datto, and it's marked beta: built from Datto's API documentation and open-source clients, not yet confirmed against many accounts, so please report anything that looks wrong on GitHub. The website lists the new integration.
- HaloPSA (2.12.0, beta): Align can now use HaloPSA as its PSA, read-only. Under Integrations → HaloPSA enter your Halo web address and the client ID and secret of a Halo API application (Client ID and Secret (Services), logging in as an agent that can see every client, with only the read:customers, read:assets and read:invoices permissions). Each hourly sync reads Halo's clients (inactive ones archived), sites (the main site fills the client's address and phone), users as contacts (Halo's "General User" placeholders skipped), assets (make, model, serial and OS from the asset type's fields, brought in as devices like ITFlow's) and invoices (the managed-services estimate from recurring invoices). Tickets, SLAs, software licences and suppliers aren't read yet, nothing is ever written to Halo, and an answer that isn't Halo's (a sign-in page, an error) changes nothing. An install has one PSA: setting up HaloPSA next to ITFlow shows it as Not in use and never switches your client list. It's marked beta: built from Halo's API documentation, not yet confirmed against many installs, so please report anything that looks wrong on GitHub. The website lists the new integration.
- Tactical RMM (2.11.0, beta): Align can now read devices from Tactical RMM, the open-source self-hosted RMM, on its own or alongside NinjaOne. Under Integrations → Tactical RMM enter Tactical's API address and an API key (for a Tactical user whose role has only List clients and List agents, covering every client: Tactical's keys skip its two-factor sign-in). Each sync reads Tactical's clients (with their sites) as organizations, linked to Align clients by name on Client mapping, and its agents as devices: make and model, serial number (so Dell and Lenovo warranty lookups work), operating system and build, last check-in, logged-in user and online status, with servers, laptops, desktops and virtual machines told apart. An agent gone from Tactical is marked removed; an answer that isn't Tactical's (a dashboard page, an error) changes nothing. It only reads from Tactical, and it's marked beta: it's built from Tactical's API and source code, not yet confirmed against many installs, so please report anything that looks wrong on GitHub. Also: the sync no longer lists RMMs that aren't set up, and with more than one RMM supported, screens say "your RMM" until one is connected. The website lists the new integration.
- Domain expiry, vendors for clients, the QBR pack and the API (2.10.0): each client's domains (its email domains and its website's) are read from their public registration records (RDAP, the successor to WHOIS) every few days, and daily once expiry is close: a Domains card on the client's Vendors page shows each domain's registrar, matched to the client's vendors (or one click to add it as one), and its expiry date, which also shows on Renewals (by vendor too) and has a Check now button. A registry that can't be reached keeps the last good answer; an unregistered domain or an ending without a public service says so. The client portal has a Vendors page for users with Budget & licensing access: who to call and how (support phone, email, website, hours), never account numbers, contacts, notes or costs. The QBR pack has a Your vendors section (switchable; costs only with costs on; in the portal for users with budget access). The REST API reads client vendors and vendor templates (GET /vendors, /vendors/{id}, /vendor-templates) with a new vendors:read scope; existing keys need it ticked. The servers now make HTTPS requests to data.iana.org and the domain registries' RDAP services for these checks.
- Vendors on budget lines, renewals by vendor and vendor import (2.9.0): budget lines (internet, phones, domains and the like) link to the client's vendors by their vendor name, as Align's licenses do: the budget line window suggests the client's vendors, a rename keeps the link, and lines saved before this release are linked when it installs. A vendor now shows its budget lines with its licenses, their monthly cost together and the next renewal or contract date among them (linked to that vendor's dates on Renewals), and vendor names on budget lines that aren't on the list are offered as one click. Renewals shows who each date is with, a By vendor list counting each vendor's dates and clients across every client, and filters to one vendor or one client. Client vendors import from a CSV file (Import on the Vendors page, or Clients → Import → Vendors): a Client and a Vendor column, plus account number, contact, support details, services, notes, a category by name and a template if you like; a vendor the client already has gets only the columns the file fills in, a vendor from ITFlow only takes category, services and notes, and licenses and budget lines that name a new vendor link to it.
- Vendors (2.8.0): each client has a Vendors page for who it buys from (internet provider, domain registrar, phones, software, copiers, hosting and so on), grouped by category, with the account number, contact, support phone, email, website, hours and SLA, the services the client has, the licenses bought from each vendor with their monthly cost, and the next renewal among them. Vendors in the main menu holds vendor templates: the details that are the same for every client, entered once. A client vendor made from a template shows the template's details wherever its own field is blank, so a changed support number shows for every client; filling in a field overrides it for that client. A vendor only one client uses needs no template, and Save as template makes one from it later; deleting a template leaves its vendors showing what they did. Licenses link to their vendor: an Align license by its vendor name (the license window suggests the client's vendors; renaming a vendor keeps the link), and the Vendors page offers to add vendors that licenses name but the list doesn't have. With ITFlow, each client's vendors sync in read-only every few minutes (the MSP's own vendors, like a distributor, are left out), client vendors made from one ITFlow vendor template share one Align template, a license links to the vendor ITFlow gives it, a vendor archived in ITFlow is retired here (not deleted), and one added by hand with the same name is taken over rather than duplicated. A PSA that doesn't share vendors just leaves them to be added by hand. Passwords and PINs don't belong in vendor notes.
- Website found more easily in search (2.7.8): the project website (mspalign.org) now gives search engines what they look for: a sitemap and robots.txt, one canonical address per page, share-card details, a clearer home page title and description, and a description of MSP Align as free software, so Google can list it properly. The not-found page is kept out of search results. Nothing in the app changes, so updating servers is optional.
- Faster test runs on GitHub (2.7.7): the end-to-end suites now run as five groups at once on GitHub, each on its own machine with its own fresh test install, so a run takes about 15 minutes instead of about 50. Every suite still runs, in the same order within its group; a check fails the run if a suite is left out of the groups. Once a week (and on demand, with full), GitHub also runs every suite one after another on main, as before, to catch a suite that only passes because of what runs before it. Two suites that relied on data an earlier suite left behind now make their own. Also finishes 2.7.6's code scanning fixes: the two spots that change raised new alerts for (the text-block wording check, and signature and picture images on a PDF, now shown from their decoded bytes) no longer read page text into HTML or an image address.
- Code scanning fixes (2.7.6): three GitHub code scanning (CodeQL) alerts in the contract builder are fixed: its box list and checks are now built as page elements rather than HTML text (labels and field details always stay text), and removing a text block checks for wording with the browser's own parser rather than a pattern that strips tags. While there, the contract builder's other drop-down lists escape every value, signatures and pictures on a PDF only load from an image or this site, hidden form fields are made as elements, and the sign-in redirects only go to this site's pages. None of these could be misused by someone without admin access to the templates.
- Backed-up servers matched when their names differ (2.7.5): a server could show under Servers with no backup while its backup ran fine, because the virtual machine was named differently from the computer (for example FS01 (DC/File) for FS01). Machines now also match by their name without bracketed parts and by the part before " - ", always against the same client's devices (a loose name never moves a machine to another client). For names with nothing in common, a Backed up as… choice next to the server links it by hand (kept by every sync, shown as "linked by hand", and unlinked the same way).
- Email authentication without false negatives (2.7.4): SPF, DKIM and DMARC are read through public DNS-over-HTTPS resolvers (Cloudflare, then Google), the way online checkers like MxToolbox see them, instead of only the server's own resolver: a record either one finds counts, and when neither can be reached the server's resolver is used (and a server without working DNS gets "unknown", not "No record"). DKIM is looked for at the mail service's selector, any selectors you list for the domain and 24 common ones (mail filters, newsletter tools and other providers). On a client's Connectors page you can now add email domains for any client, with or without Microsoft 365 or Google Workspace connected (the website's domain is suggested), set a domain's DKIM selectors, and leave the connected domain out; with several domains, each check takes the worst of them. The servers now make HTTPS requests to cloudflare-dns.com and dns.google for these checks. Also: the client overview's six tiles go three across when the page is narrower (at 1280px with the sidebar they broke words in half).
- Readable buttons in light and dark mode (2.7.3): the tabs on Client mapping and Hosted backups (All clients, Missing a link, Not matched, Sorted into clients, Yours, All) had white text that disappeared in light mode unless selected; a few other buttons (Show/Hide archived, the meetings page's Calendar and Roadmap, the API's Turn off, and the compliance checklist's Partial) were just as hard to read. All fixed, and a new test checks the buttons, tabs and badges of every kind of staff page in both modes. The demo data now includes security awareness training results, and the website has a one-minute video tour and fresh screenshots, including Huntress and training.
- Security awareness training from Curricula (2.7.2): Huntress SAT runs on Curricula, and its API now replaces the uploads. Under Integrations → Huntress SAT (Curricula) paste the client ID and secret of an OAuth application registered in Curricula (Client Credentials, read scopes only). Each sync matches Curricula accounts to clients through the Huntress organization they belong to, else by name (a Curricula column on Client mapping), and reads each linked client once a day: training completion over the assignments that have ended in the last 13 months (each active learner once, including those who never started), each phishing campaign's results, and the account summary reports (opened through Align, which asks Curricula for a fresh PDF link). Only totals are kept; learner ids count people once and names are never stored. The training card shows where the results came from and when, with a Refresh button; while Curricula has results for a client, its uploads don't count.
- Huntress antivirus fix (2.7.1): the Managed Antivirus check failed every agent, because Huntress reports a healthy Defender as "Protected" (its API documentation shows "Healthy"). Both now count as healthy, as long as the signatures aren't out of date and the policy is compliant.
- Huntress (2.7.0): under Integrations → Huntress (API key and secret, read-only), each sync reads Huntress's organizations, matched to clients by name like an RMM's (fix them on Client mapping), with their agents, Managed Antivirus, incidents, escalations, summary reports, ITDR identity counts and external ports. A Huntress card on the client overview compares agents with the client's RMM workstations and servers (by serial, else host name) and lists devices without one, open incidents and escalations, incidents closed in the last year and the summary reports. Five checks (agent on every device, no open critical/high incident, Defender healthy, no high-risk identity, no risky open port) count in the health score's Security area and suggest compliance answers; the built-in frameworks' anti-malware/EDR controls (CIS, CMMC, HIPAA, ISO, PCI, SOC 2, cyber insurance, MSP baseline and others) and the starter EDR standard are linked. Checks are unknown, not failed, when Huntress hasn't been read for a day or more, or a product isn't in use (ITDR, Managed Antivirus, external recon). Open critical/high incidents and overdue escalations show on the dashboard. The QBR pack gets a Security section.
- Security awareness training results (2.7.0): Huntress's API has no SAT results, so upload a client's Huntress SAT exports (Assignment: Learner Progress, Phishing: Attempts or Phishing: Annual Overview, CSV) on its overview. Align keeps only totals, never names. Two checks: at least 90% of learners finished every assigned episode, in a report whose latest completion is within the last 12 months, and a phishing click rate under 10% with a campaign in the last 6 months (thresholds under Integrations → Huntress); the frameworks' awareness training and phishing simulation controls and the starter training standards are linked. Uploading the same report for the same dates again replaces it. The portal's QBR doesn't include the Security section.
- Google Workspace for clients (2.6.3): connect a client's Google Workspace on its Connectors page and its editions appear in Licensing (users per edition, updated hourly), priced from a Google Workspace price list; a client's license can have its own price. Its security is checked once a day, read-only: every active user and super admin enrolled in 2-Step Verification, 2-Step Verification enforced, two to four super admins, no active account unused for 90 days, Drive sharing outside the organization restricted or warned, unconfigured third-party apps blocked or limited to Sign in with Google, and less secure apps off. Set up once under Integrations → Google Workspace (clients) with a service account key from your own Google Cloud project; each client's super admin allows it under Domain-wide delegation (a client that won't can use a service account in its own Google Cloud). Results show on a Google Workspace security card, count in the health score's Security area and suggest answers for linked compliance controls and alignment standards. The REST API marks these licenses gws and keeps what Google owns read-only.
- Microsoft 365 security without Entra ID P1 (2.6.3): MFA registration (users and admins) and licensed accounts unused for 90 days were unknown for tenants without Entra ID P1 (Business Standard, Basic and the like), because the reports Align read need it. Now Align reads each account's registered MFA methods and Microsoft 365's active users report (Exchange, OneDrive, SharePoint and Teams activity) for those tenants, so the checks work with security defaults alone. The app asks for two more read-only permissions (UserAuthenticationMethod.Read.All, Reports.Read.All): each connected client's admin presses Approve new permissions once.
- Email authentication (2.6.3): for every client with Google Workspace or Microsoft 365 connected, Align reads its email domain's SPF, DKIM and DMARC from public DNS once a day (and on Check now): one SPF record ending in -all or ~all, a DKIM key at Google's default selector or Microsoft's, and a DMARC policy of quarantine or reject. They show on the client overview, count in the health score's Security area (so Microsoft 365 clients' scores can change on upgrade), and the Microsoft 365 baseline's SPF, DKIM and DMARC controls and CIS IG2's 9.5 suggest an answer from them.
- Microsoft 365 fixes (2.6.2): Connect Microsoft 365 and Approve new permissions now open Microsoft's sign-in in a new tab with a normal click (the browser's security policy stopped the redirect, so the page just reloaded; Ctrl+click worked); the Connectors page reloads when you come back to it. Approving no longer waits for the daily run to add new permissions to your app: Align adds them as soon as someone presses Approve or an admin opens Integrations → Microsoft 365 (clients), so one approval grants everything (before, an approval in between re-granted only the old permissions and the request came straight back). The card names any permission Microsoft hasn't granted yet, and right after approving it says Microsoft can take a few minutes, with Sync now to check again, instead of asking for another approval.
- Microsoft 365 security (2.6.1): for clients with Microsoft 365 connected, Align now checks their tenant's security once a day (and on Sync now), read-only: Secure Score, MFA registered for every licensed user and every admin (disabled accounts and shared mailboxes left out), MFA enforced (security defaults or Conditional Access), legacy sign-in blocked, two to four Global Administrators, and licensed accounts unused for 90 days. Checks the tenant's licences can't show (some need Entra ID P1) are marked unknown, never failed. A Microsoft 365 security card on the client overview shows them; compliance controls and alignment standards linked to a check get a suggested answer (you decide), with the Microsoft 365 baseline framework and the starter MFA and legacy sign-in standards linked already; and the health score gets a sixth area, Security, the share of known checks that pass (weight under Settings → Planning & lifecycle; connected clients' scores change on upgrade, so set it to 0 to keep them as before). The app asks for four more read-only permissions: each connected client's admin approves once more (Approve new permissions on the client's Connectors page). A new Connectors page in each client's menu (below Client portal, staff only) holds the Microsoft 365 connection and shows how the client is linked to the PSA, RMM and backup products, with the last sync; Licensing keeps a one-line Microsoft 365 status.
- Microsoft 365 licenses from each client's tenant (2.6.0): connect a client's Microsoft 365 and its subscriptions appear in Licensing, with seats bought and seats assigned, updated every hour (and on Sync now). Under Integrations → Microsoft 365 (clients) you sign in once with an admin of your own Microsoft tenant and Align creates the app it needs there: multi-tenant, read-only in client tenants, signing in with a certificate it replaces by itself every year. Each client's admin then approves it once, the way security tools connect tenants (or you send them a link and confirm the tenant afterwards). Prices come from your Microsoft 365 price list (free and trial subscriptions left out), and any client's license can have its own price. Subscriptions that end are retired; licenses from the PSA or added by hand that look the same are offered for retiring once, so nothing counts twice. A client that doesn't allow outside apps can use an app in its own tenant instead. Problems (a client not syncing, an expiring secret, a tenant to confirm) show on the dashboard. The REST API marks these licenses m365 and keeps what Microsoft owns read-only.
- Installer fix (2.5.2): the installer's random password helper now always gives the length asked for. Before, a long one could now and then come out a few characters short; the installer's own passwords (32 and 20 characters) always had enough, so existing installs aren't affected.
- Your own browser icon (2.5.1): Settings → Branding has a Browser icon: a small square image for browser tabs and bookmarks on every page, staff and client portal alike (re-encoded and scaled down to at most 256 pixels; SVG isn't accepted). Without one, tabs show the MSP Align icon. Logos are no longer used for the tab, so if you uploaded a logo, your tabs go back to the MSP Align icon until you upload a browser icon.
- Client health score (2.5.0): every client gets one score from 0 to 100, made from five areas each scored 0 to 100: lifecycle (supported OS, within lifecycle, servers and network gear under warranty, checking in to the RMM), backups (machines, servers and Microsoft 365 items with a recent backup, less a little for failed jobs), compliance (the client's frameworks), service levels (SLA targets met in 90 days) and alignment (the latest review). An area with no data is left out rather than counted as zero. The client page shows the score and band (Healthy, Needs attention, At risk), a 90-day trend, the change since the last business review and what pulls each area down; a new Client health dashboard card lists every client worst first with the 30-day change and the weakest area; the QBR pack opens with it; the weekly vCIO digest lists clients whose band dropped. Admins set the weights and bands under Settings → Planning & lifecycle and can show the score in a client's portal (off by default; scores only, without the alignment area). A score is saved for every client each day. REST API: GET /clients/{id}/health and /health/history under a new Health score scope (existing keys need it ticked).
- Remove an onboarding (2.4.1): started one by mistake? The client's Onboarding page has Remove onboarding: it deletes the onboarding and turns its link off. Techs can remove one until the client opens it, admins any time; contacts and requests the client already sent stay.
- What changed since the last QBR (2.4.0): each client has a Since last QBR page comparing today with the last completed business review (or an earlier one, or any date): projects finished and what they cost, projects added, approved, started and declined, approved projects whose quarter has ended, devices replaced, added and removed, warranties, end of life and operating system support that ran out, the alignment score then and now with the gaps closed and opened, compliance scores and controls updated, licenses added and retired, and tickets opened and closed. Figures saved when a review is marked completed make the comparison exact; older reviews are worked out from dates. The QBR pack opens with a Since our last review section, the client portal has a Since your last review card and page (each user sees only what their permissions allow; alignment stays staff-only), and the REST API has GET /clients/{id}/changes. Projects now remember when they were finished.
- Licensing and trademark clean-up (2.3.1): the built-in CIS checklists use our own wording, client-facing pages link to the license and source, the License page credits every bundled component, and a trademark policy covers the MSP Align name and logo.
- Alignment reviews (2.3.0): measure each client against your own standards, the way vCIO tools do. Libraries → Alignment standards (Settings → Standards before 2.16.0) holds the library (a starter set built from the MSP Security Baseline plus continuity, documentation and Microsoft 365 standards; edit, add, export and import your own), each standard with a priority, why it matters in client words, how to check it, an optional automatic check and a suggested fix. On a client's Alignment page, a review marks each standard aligned, misaligned or N/A, starting from the last review's answers, with hints from Align's own data and from the client's compliance answers. The score is weighted by priority and banded (On track, Needs attention, At risk); each gap becomes a roadmap project in one click, noting the compliance controls it helps with. The score shows on the client overview and the client list, compliance checklists can fill from it, and the QBR pack gets an Alignment section and highlight. Completing a QBR also saves a quiet snapshot of the client's numbers for a later "what changed since the last review" page. The REST API has it too, under a new Alignment scope (existing keys need it ticked): the standards, a client's score and gaps, its reviews with their answers, and starting, answering, finishing and discarding a review; POST /projects takes alignment_standard_id.
- Clean-up and Portainer (2.2.6): an amount too large for a project, device or license is refused with a message instead of saving as empty (which used to wipe the old amount on an edit). An empty contact list from the PSA no longer archives every contact. The tabs of one sign-in share the idle clock, so a forgotten background tab can't sign you out while you work in another, and signing out in one tab signs out the rest. With .ics invitations, someone taken off a meeting's attendee list now gets a cancellation. New compose.portainer.yaml and a Portainer section in the Docker guide: a stack that deploys with nothing filled in.
- Setup wizard catches up (2.2.5): the wizard's logo is now saved as the Light mode logo (reports, emails and the client portal) and shown on white, with a pointer to Settings → Branding for the dark mode logo. The PSA step says that without a PSA, Ready to start marks projects started instead of making tickets, and the last step points to Settings → Diagnostics. The client portal preview on Settings → Branding now matches the real portal (always light, with the light mode logo), and the portal screenshots on mspalign.org show the portal again instead of its sign-in page.
- Light and dark mode logos (2.2.4): Settings → Branding now takes two logos, so a white logo no longer disappears on white paper. The Light mode logo is for light backgrounds: the sign-in page in light mode, printed reports and the QBR, contracts and their signed PDFs, emails, the client portal and its sign-in, onboarding pages, a light menu and the browser tab. The Dark mode logo is for dark backgrounds: the dark menu and the sign-in page in dark mode. Either one stands in for the other while only one is uploaded, so nothing changes until you add the second. A logo you uploaded before stays as the dark mode logo (it's the one the menu always used).
- Diagnostics (2.2.3): a new Settings → Diagnostics tab for admins shows how the install is doing, read on the spot: the server (uptime, load, memory, time), the app (version, PHP and its extensions, OPcache, site address, debug mode, database updates), the database (size, tables, connections, memory for its data, encryption at rest, slow queries), storage (free disk space, uploaded files, active sessions), how much data there is, and whether the background jobs ran when they should (sync, PSA check, email, nightly audit check, update check, system agent). Each line is marked healthy, needs a look or a problem, with what to do, and a summary row on top. Problems from the last 7 days are listed, and Copy report / Download report give the same facts as text for a support request, without the site address or error text.
- Ready to start: tickets when the work is due (2.2.2): approve a whole year of projects without filling your PSA's ticket board. Each project gets one QUOTE- ticket, made only when you say so.
- Ready to start: an approved or scheduled project with no ticket goes on To do (new Projects tab) on the first day of its quarter, and stays there while it's overdue. Ready to start shows what goes into the ticket (subject, devices or description, quarter and budget) before it's made; Ready to start: all does every project on the list at once. It also works any time from the project window and the new Ticket column on Projects.
- Not yet: hides a project from To do for a month, or 2, 3 or 6 months from its menu. The project shows when it comes back.
- Without a ticket: with no PSA connected, or for a client that isn't linked to the PSA, projects still go on To do when their quarter starts, and Ready to start marks the project started (the date and who, saved on the project and in the audit log) instead of making a ticket. A project started that way can get its ticket later from the project window or Projects page, once one can be made (it keeps who started it and when), and Not started in the project window undoes the mark. If the client is linked or unlinked while a Ready to start window is open, pressing it does nothing and says to reload, so a project meant to get a ticket is never just marked started (or the other way round). The column and filter on Projects say Started when there's no PSA. The API's projects have a new started_at.
- On a test server ('staging' => true): Ready to start works as it would for real, but saves a pretend ticket number (TEST- and the project's number) and sends nothing to the PSA, so the whole flow can be tried on a copy of real data.
- Making projects: Make projects and Add project no longer make a ticket unless you tick Make the QUOTE- ticket now. Projects added by hand work exactly like device projects. Projects that already have a ticket keep it.
- After updating: approved or scheduled projects from this quarter or earlier that have no ticket show on To do right away, older hand-added ones too (and, new, the ones of clients not linked to the PSA, or every client's without a PSA). Mark the finished ones Done and they leave the list.
- Also: purple and teal category labels (Software / licensing, Cloud / M365, some meeting, license and document kinds) had white text on no background and are readable again.
- New logo and name (2.2.2): MSP Align has a new logo, in the app and on mspalign.org, and its name now reads MSP Align (it was MSP-ALIGN). A branding name still set to the old default changes with it; a name of your own stays. The menu, the browser tab and the sign-in pages show it (the sign-in pages in light or dark lettering to match), and the default brand color is now the logo's blue. The built-in client portal sign-in background has teal hills to match. Your own logo, name and color from Settings → Branding still take its place; the color choices there now include the logo's teal and navy, and the old bright blue.
- More device filters (2.2.2): Devices & assets (every client's list and each client's) has a Filters button. Its panel narrows the list by make and model, operating system, age, replacement year, warranty, status, backup, location, whether the device is in a project, and whether it has a last user. Each choice shows how many devices it has.
- Filters work together with the view tabs, Type, the client picker and the search. Active filters show as chips above the list; press one to remove it, or Clear all.
- The filters are part of the page address, so a filtered list can be bookmarked or sent to a colleague. CSV downloads just the filtered devices, and Set replacement comes back to the same filtered list.
- Security and quality review (2.2.1): every file of Align was read line by line, then a separate security audit checked the whole program, and everything found was fixed and tested. Security has the summary. What you may notice:
- Sign-in: wrong two-factor codes after a correct password alert admins at 5 in a row. After 50, the password is replaced and that person's sessions end, because someone else probably knows it. A password change, 2FA change or Sign out everywhere also turns off that person's calendar feed link; make a new one on the Meetings page.
- Integrations: connections use https:// only, don't follow redirects and never reach the server itself or cloud metadata addresses. Servers on your own network work as before. An integration installed on the same machine needs 'allow_local_integrations' => true in config.php. If Veeam's list of protected machines can't be read, the machines from the last sync are kept.
- Contracts: editing a draft you already signed removes your signature, so you sign again. A contract the client signed counts as signed even after it's cancelled, so only an admin can delete it. Only an admin can link the contract of a deleted client again. A drawn signature needs visible ink.
- Onboarding: only admins can remove an onboarding, finishing needs every step done, and the welcome page can save contacts 30 times a day.
- Settings: the company email on Settings → General is checked only when you change it. The email settings form is checked as a whole before anything is saved. An interrupted backup download keeps the backup on the server, so you can try again within the hour.
- Audit log: more is recorded: views of the contract and document lists, portal users and unassigned hardware, every visit to an onboarding page, PSA checks that only changed contacts or licenses, Sync now on a device, and which records a CSV import changed.
- Docker: ALIGN_STAGING also accepts true, yes or on, and any other value stops the start-up. Scheduled jobs have time limits. The image now includes the release key file, so the update notice only offers signed releases.
- Contracts, signed online (2.2): send your own contracts to be signed online, and keep the signed copies with the client. They're under Onboarding in the menu, with the welcome email and the onboarding guide (moved from Settings).
- Your own agreement: upload it as a PDF and Align keeps it exactly as it is. Place boxes on it for the client's details, the contract start date, your prices (quantities counted from the client's devices, users and licenses), signatures, names, titles, dates and initials. Find the blanks suggests them for you. Or write the contract in Align instead.
- Send and sign: make a contract for a client or a new lead, check the preview and send it. The client opens a private link (with a code emailed to them, if you turn that on) and is taken box by box through filling in, initialing and signing, or declines. Reminders go out automatically.
- The signed copy: after you countersign, Align makes the signed PDF with a signature certificate (who signed, when, from which IP address and browser, and a fingerprint of the content), keeps it with the client and emails a copy. Check a signed PDF tells you whether a copy someone sends you is exactly the signed one.
- Also: keep contracts signed elsewhere (DocuSeal or paper) by uploading them, and turn a new lead into a client in one click, ready for the welcome email. New clients lists every onboarding.
- Sign-in backgrounds (2.1.1): the sign-in pages now have a background: a built-in dusk landscape for your team and a calm, light one for the client portal. Under Settings → Branding you can upload your own for each (JPG, PNG or WebP up to 8 MB), choose how much to darken it, or pick No image for the plain page. The logo and the sign-in box stay readable on any photo, on desktop and phones, in light and dark mode. Images are re-encoded before they're shown, so no camera or location details go out with them.
- Replacements become projects, with a quote ticket (2.1): when a client approves replacing devices, tick them on the client's Devices & assets page (or open one device) and choose Make projects. You get one project per device, or one for several replaced together, in their replacement quarter or one you pick, at their budgeted cost or the quote amount. Align can also create a QUOTE- ticket in ITFlow for each one, listing the devices, serials, users and budget, with no client contact so it's simply a new ticket to assign. The devices leave the automatic replacement plan while the project stands, so the roadmap and budget never count them twice; decline or delete the project and they go back to their replacement dates. Each device links to its project, and the project lists its devices and ticket.
- Microsoft 365: old backups kept are no longer counted (2.0.2): Veeam keeps the backups of people who left and of tenants no longer used, and lists them for years. A user, group, team or site with no new backup for 30 days now moves to a No longer backed up list on the client's Backups page (old backups kept, still restorable) and isn't counted as protected or overdue anywhere, including reports and the client list. Until then a stopped backup still shows as overdue. Change the days, or turn this off with 0, under Integrations → Veeam. A tenant whose last backup Veeam doesn't report now shows its newest restore point instead of "never".
- Microsoft 365 backups in two repositories (2.0.1): when a tenant's backups moved from a legacy repository to a new one, Veeam lists each user, group, team and site once per repository, and Align could keep the legacy copy (months old) and show a current mailbox as overdue. Now the copies are one object and the newest restore point counts. The Backups page shows days with a backup for each one (several restore points on one day count once, across repositories), marks objects kept in more than one repository, and lists every protected user, group, team and site, not only the overdue ones. Align counts the days from its first sync after the update, since Veeam reports each repository's newest restore point rather than every date.
- "Are you sure?" before big changes (2.0.1): changes that are wide, hard to undo, email clients or write to your PSA now ask first, in a dialog in the app's own style (light or dark) that says what will happen and to how many, e.g. "Change the replacement plan for 14 devices? Their place on the roadmap and in the budget moves with it." It only asks when it matters: saving the lifecycle policy asks only when a lifespan or cost changed, and says how many devices are recalculated.
- Wide changes: bulk replacement plans and device types, the lifecycle policy, budget year and OS support dates, client mapping and hosted-backup moves, deleting framework controls (with how many clients lose their answers), turning off the API, client suggestions or online requests, and staff role changes (Cancel puts the old role back).
- Emails to clients: meeting invitations and updates (and whole series), welcome emails, new portal invite and reset links, digests sent now, documents shared to the portal, and client emails being switched on.
- Writes to the PSA: turning on two-way sync, asset creation or warranty write-back, bulk type changes sent to the PSA, syncing a device again and restoring a retired one.
- Unsaved changes: closing an edit window (project, budget line, license, contact, device, meeting, portal user) with changes asks before discarding them, and leaving a long form (compliance checklist, framework editor, mapping, settings, integrations) asks before the page closes.
- Enter is safe: pressing Enter in a field saves the form; it no longer runs a Delete, Retire, Restore or "new link" button that happened to come first.
- MSP Align 2.0: ready for everyone (2.0.0). The first public release: everything from 1.27 to 1.45 (REST API, no-PSA mode, setup wizard, demo data, the new look and dark mode, Docker, the security audit) is now the base for other MSPs to install. New in 2.0:
- Signed releases: a server installs only releases signed with the MSP Align release key, which is never stored on GitHub or a build machine, and checks the signature itself against the key file it already has. A release that isn't signed with it is refused and raises a security alert, so a stolen GitHub account can't push an update to your server. Settings → Updates & backups shows the key's fingerprint. Docker images are signed too. See Signed releases.
- API: PSA ids are text. psa_id (clients, contacts, licenses) and psa_asset_id (devices) are now always text, for example "57", so every PSA fits the same field. If an integration compares psa_id with a number, update it or use the itflow_* fields, which stay numbers. From 2.0, the v1 API only adds things; anything that would break an integration will come as v2. See REST API.
- Docs: new pages for the REST API (every endpoint, generated from the API itself), Troubleshooting, the FAQ and Contributing, fresh screenshots, and corrected install and Docker steps.
- For contributors: a code of conduct, issue and pull request templates, sign-off on commits (DCO) and GitHub Discussions for questions.
- Also: sudo msp-align-update with nothing new installs the current release again, which repairs packages, permissions and services. A restore no longer sets off a false audit log alert at the next nightly check. A Docker container can be a test server (ALIGN_STAGING). The installer waits for a backup or update that's running instead of overlapping it.
- Branding page in the new look (1.45.2): Settings → Branding now matches the 1.43 interface: cards for name & logo, colors (suggested colors, and dark or light menu as picture choices) and the sign-in page message. The live preview shows the app, the staff sign-in page and the client portal as they look now, in light or dark mode, and follows every change as you type. Nothing else about branding changes, and your settings are kept.
- Remember this browser, and yearly invoices (1.45.1):
- Remember this browser: after the two-factor code, staff and client-portal users can tick Remember this browser to skip the code on that browser for 14 days. Their password is still asked for at every sign-in. Admins set the number of days, or turn it off, under Settings → General → Security. Each person sees and can forget their remembered browsers on their Account page, and a password or authenticator change, Sign out everywhere, a 2FA reset or disabling the account forgets them all.
- Yearly recurring invoices: the managed-services estimate from ITFlow now follows each recurring invoice's own frequency. A yearly one counts as a twelfth a month instead of the whole amount every month. ITFlow's API doesn't say how often a recurring invoice repeats, so each one's frequency is worked out from the dates of the invoices it made. One billed only once counts as yearly until a second invoice shows it's monthly, and one that stopped billing drops out. The budget line says how it was worked out, e.g. "1 monthly, 1 yearly".
- Security audit (1.45): before 2.0, every file of the app, installer, backup agent and Docker setup was reviewed line by line and tested against a live install; Security has the summary.
- Serious fix: with code already running as the web user, the root backup agent (and the installer and Docker start-up) could be tricked by a symlink into handing a root-owned folder to the web user. The agent now does everything in the web user's folders as that user.
- The audit log: its start and end are sealed too, and the nightly check keeps an outside checkpoint, so entries cut off either end, or an old copy written back, are caught.
- Portal:
- The QBR's key contacts and next meeting need the contacts permission.
- A reset link on a 2FA account asks for the code before anything changes.
- Service requests are rate limited.
- Sign-in and 2FA:
- Removing someone's 2FA also gives them a one-time password.
- Moving 2FA to a new phone needs a code from the old one.
- Lockouts and one-time codes hold up against parallel requests.
- Integrations and email: changing an integration's address or the SMTP server needs the key or password typed again.
- API: client-limited keys can't reword or cancel a meeting whose invitations went out, and a key stops when its creator is no longer an admin.
- More in the audit log: scheduled syncs, PSA changes, document autosaves, license restores, meeting notes and views of device lists, compliance and contacts.
- Also:
- Brand logos are re-encoded.
- Only admins can delete a document.
- Onboarding links end a week after onboarding is done.
- GitHub Actions are pinned to exact commits, with Dependabot watching them and the Docker images.
- Contacts sync both ways with ITFlow, archiving too (1.44.1): archiving or restoring a contact in Align now does the same in ITFlow (ITFlow's own archive, so it also clears the contact's Important/Billing/Technical flags and archives their client-portal login there); a contact archived in ITFlow comes back in Align when it's restored there. Each client's Contacts page says whether its contacts sync both ways, come in only, or stay in Align (not linked, with a link to Client mapping), and the Integrations switch is now called Two-way sync (devices and contacts). If ITFlow refuses, or is too old to archive from other apps, Align says so and archives in Align only.
- Install with Docker (1.44): MSP Align also ships as a container image (ghcr.io/msp-align/msp-align, amd64 and arm64) with a compose.yaml for the app and MariaDB and an optional compose.caddy.yaml for automatic HTTPS. One container runs the web app, the scheduled jobs and the backup agent; data lives in named volumes. Backups and restore work from Settings as before, and a backup moves between Docker and a dedicated server. Updates in Docker are docker compose pull && docker compose up -d. In Docker, trusted proxies can be narrow address ranges, and the database is encrypted at rest as on a dedicated server. Dedicated installs are unchanged, and CI now proves it: every change runs a fresh install.sh and an update from the previous release in a Debian 13 VM. See Install with Docker. The docs site has a new Screenshots page, and the docs are brought up to date with the 1.42 menus and 1.43 look.
- A cleaner look, and dark mode (1.43): the interface moves to AdminLTE 4 and Bootstrap 5.3 with a cleaner design: white cards on a light gray page, softer borders and badges, one accent color (your brand color from Settings → Branding) and a compact dark sidebar. Each person picks Light, Dark or Match my computer under Account → Light or dark; printed reports and PDFs always stay light. The client portal gets a friendlier look: the client's logo and name at the top, larger text, more white space and simpler section tabs. jQuery is no longer used.
- Faster at scale, and one layout (1.42): tested at 150 clients and 10,000 devices, where every page now loads in under a second. The hourly sync takes half as long, the 2-minute PSA check and the digest emails a quarter to a half, and the Licensing, Contacts, Projects and Client mapping pages send a tenth of the HTML (edit forms load when opened). The main menu is shorter: a new To do list (hardware to categorize, licenses to price, clients to link, hosted backups to match, client suggestions), a Devices & assets list across every client, and Admin pages with tabs (Integrations: connections, client mapping, hosted backups, sync history; People: staff and portal users). The top search also finds devices by name, serial or user, contacts and licenses. Client menus are grouped (Their IT · The plan · Meetings, with a Reports page), every list has the same header, tiles and one-row filter bar with 100 rows at a time and search over every row, the device table shows 7 columns with a Columns menu, device pages have tabs, and the client portal has six tabs instead of ten. The installer now sets PHP's memory limit to 512 MB and sizes the MariaDB buffer pool to a quarter of RAM; tests/perf/ builds a large test install and times every page.
- Demo data (1.41): try MSP Align before adding your own clients: on an install with no clients, Load demo data (setup wizard → Clients, or Settings → Diagnostics → Demo data; on General before 2.16.0) adds four made-up clients with contacts, devices of every age (some past end of life or on an unsupported OS), licenses, budget lines and contracts, roadmap projects, meetings, a compliance assessment, documents, 30 days of backup results, a client portal user and a license suggestion waiting for review. Dates are relative to the day it's loaded. A banner shows while it's there, and Remove demo data deletes exactly the demo clients and everything attached to them. Names, email addresses (.example) and serial numbers are invented; service levels are left out because they come from a PSA.
- Setup wizard (1.40): a new install opens a step-by-step wizard for the first admin: company details, logo and colour; currency, dates and timezone; PSA (ITFlow or none); RMM; backups and warranty lookups; email (Microsoft 365, Google Workspace or SMTP); first clients (first sync, RMM organizations, CSV import or by hand); and staff accounts. Every step can be skipped and shows as skipped; steps done elsewhere are ticked too. The forms are the app's own settings, integration, email and user forms, so nothing is saved differently. Existing installs are marked as set up when they update and never see it pop up; any admin can open it from Settings → General.
- Client portal update (1.39): clients can suggest licenses (product, vendor, how many, price, billing, renewal date) and budget items (internet, phones, hosting, other costs) from the portal. Each waits for staff: it shows on the dashboard and at the top of the client's Licensing or Budget page, where Review and add opens the normal Add form filled in from the suggestion (edit anything first) and Decline takes a note. The client sees it as waiting, added or declined (with the note) and can withdraw it while it waits; an optional email tells them when it's reviewed. New portal permission Suggest licenses and budget items (existing users with Budget & licensing get it) and an admin switch on Client portal users. Portal contacts are now view-only (new user and termination requests stay), and the portal has a new layout: the client's name in full, every section on its own bar with icons (scrolls sideways on a phone), and a home page with four summary tiles and a Your IT team card with quick actions.
- Currency & dates (1.38): Settings → General → Currency & dates sets the currency (20 common ones, symbol before or after the amount), how numbers are written (1,234.56, 1.234,56, 1 234,56 or 1'234.56), the date style (Sep 29, 2026, 29 Sep 2026 or 2026-09-29), a 12- or 24-hour clock, the first day of the week and the timezone (which used to be set only in config.php). One choice for the whole install, used on every page, report, email and the client portal, with a live preview. Amounts are never converted; CSV exports and the API keep plain numbers and ISO dates, and the API's budget says which currency it is in. The defaults are the US style MSP Align always used.
- Email through any SMTP server (1.37): Integrations → Email now offers a third connection next to Microsoft 365 and Google Workspace: any SMTP server or relay (your own mail server, SMTP2GO, Mailgun, SendGrid, Amazon SES, or the Microsoft 365 / Google relay). STARTTLS or TLS from the start, an optional user name and password (never sent without encryption), and a certificate check that can be switched off for an internal relay. Everything goes through the same queue and retries; a recipient the server refuses for good fails straight away instead of retrying. Meeting invitations are sent as .ics emails that mail apps show with Accept / Decline, and a test server still sends only to its test mailbox.
- No-PSA mode (1.36): MSP Align works without a PSA. With only an RMM connected, Client mapping adds a client for each RMM organization (once each, already linked; optionally on every sync), and Clients → Import brings in clients and contacts from a CSV file, showing what each row will do before anything is saved (existing ones are updated, not duplicated; details from a PSA are never overwritten). Clients are linked to RMM organizations by name on every sync even without a PSA, and screens leave out PSA-only features (tickets and service levels, invoice estimates, two-way asset sync) instead of showing them empty. Help has a Run MSP Align without a PSA guide.
- Server names match the app (1.35): the update moves an existing server from the old mountaineer-align names to msp-align: /opt/msp-align (code), /etc/msp-align (config), /var/lib/msp-align (data), the msp-align-* services and timers, the Apache site and its logs (/var/log/apache2/msp-align-*.log). Each old folder is left as a link to the new one, so anything that used the old paths keeps working, and the mountaineer-align-update / -restore commands still work. Nothing is copied or lost: the folders are moved in place, the database keeps its name, and a server that was already moved (or installed fresh) is left alone.
- Ready for PSAs with text ids (1.34): PSA ids (clients, contacts, licenses, assets, tickets, service requests) are stored as text, as RMM ids already were, so a PSA that uses GUIDs can plug in. Existing ids are kept exactly; the REST API still reports ITFlow's ids as numbers and reports any other id as text. The PSA poll timer is now mountaineer-align-psa (the update removes the old mountaineer-align-itflow one), and Help names your own RMM and backup products.
- Project home (1.33): documentation now has its own site at mspalign.org, built from this README and docs/ on every release. The copyright notice reads Mountaineer IT Inc. and MSP Align contributors; security issues are reported privately through GitHub (see docs/SECURITY.md); calendar invitations identify as MSP Align. Optional update_check_url lets a server check a small version file before GitHub.
- Tests pass in any timezone (1.32.2): the test suites now run in the app's timezone whatever the machine is set to, so they pass on GitHub's UTC runners as well as locally (no change to the app). Tests also run on pushes to develop.
- Test servers (1.32.1): a test server can follow the develop branch (update_branch in config.php; Settings → Updates & backups shows the channel) and run on a restored copy of production in staging mode: reads from connected tools still work, nothing is written back to the PSA, every email and invitation goes only to one test mailbox marked [TEST], real calendar events are never touched, the client portal and API are off, and every page says "Test server". See docs/TEST-SERVER.md.
- Tests in the repository (1.32): the 28 end-to-end suites (about 1,100 checks: every screen, the client portal, the REST API and its attack tests, email through Microsoft 365 and Google, sync with ITFlow / NinjaOne / Veeam, updates and backups, upgrades from 1.27, 1.28 and 1.29, and a crawl of every page for each role) now live in tests/e2e/, with one command to run them and GitHub Actions running them on every push. They start from a seed built from scratch with fictional data, so nothing from a real install is needed or stored.
- One client mapping screen (1.31): Client mapping works the same for every connected tool that keeps its own customer list (each RMM's organizations, each backup product's companies): a card per tool with how many clients are linked and which records aren't, a Missing a link view, and plain labels for each link (by name, by hand, kept unlinked). Connectors plug in through one interface (LinksClients), and RMM and backup auto-matching now share one routine (same results as before). Forms from older pages still save. Help has a new Link clients guide.
- Fictional test data (1.30.2): the mock servers used by the test suites now use made-up businesses, people, addresses and 555 phone numbers. Nothing changes in the app.
- New home (1.30.1): the project now lives at github.com/MSP-ALIGN/MSP-ALIGN. Updating to 1.30.1 switches an install that pulls from the old repository to the new one automatically (if the new one can't be reached, it keeps the old one and says so). The license page's source link points to the new repository too.
- Provider-neutral backup data (1.30): Veeam Service Provider Console is now one backup provider (src/Providers/Backup/BackupProvider.php), and an install can run several backup products. Backup companies live in backup_companies, each client's company link moves to client_links, and every job, machine and Microsoft 365 record notes its provider, so one product's sync never removes another's data. Client mapping shows a company column per backup product (the old veeam[] form field still saves). Screens, reports, the portal and the API work exactly as before; see docs/PROVIDERS.md.
- Provider-neutral RMM data (1.29): NinjaOne is now one RMM provider (src/Providers/Rmm/RmmProvider.php), and an install can run several RMMs at once. Each device records the RMM it came from and that RMM's device and organization ids (devices.rmm_provider, rmm_device_id, rmm_org_id, stored as text because some RMMs use non-numeric ids). Client ↔ organization links moved from clients.ninja_org_id to a client_links table (one link per client per provider), and ninja_orgs became rmm_orgs. Client mapping shows a column per RMM. The API still reports NinjaOne devices with source: "ninja" and ninja_device_id, plus a new rmm object.
- Provider-neutral PSA data (1.28): ITFlow is now one PSA provider behind a common interface (src/Providers/Psa/PsaProvider.php). The sync, screens, reports and API only see neutral records, so another PSA can feed the same areas by adding a provider; see docs/PROVIDERS.md. ITFlow-named tables and columns were renamed (itflow_assets → psa_assets, clients.itflow_client_id → psa_id and so on) by an automatic migration; nothing changes in how Align behaves. The API keeps its itflow_* fields as deprecated aliases of the new psa_* ones.
- REST API (1.27): read and write access for automation tools (n8n, Zapier, Power Automate), AI agents, scripts and other systems, under Settings → API (off until an admin turns it on). Base URL /api/v1, JSON, Authorization: Bearer msa_…. Keys are hashed and shown once; each has read/write scopes per area (clients, contacts, devices, projects, budget, licensing, meetings, compliance, backups, service levels), an optional limit to specific clients, an optional expiry and a per-minute rate limit. Writes cover device lifecycle details (pushed to ITFlow like the device page), projects, budget lines, license prices and contracts, meetings (with optional calendar invitations), compliance controls and frameworks, backup exemptions and hosted backup assignments. PATCH changes only what you send; unknown fields are refused; POST accepts an Idempotency-Key; lists paginate and take updated_since. Every change is in the audit log under the key's name, and every request in a 30-day request log. The OpenAPI 3.1 description is at /api/v1/openapi.json and rendered as a reference page under Settings → API. The full reference is also on the docs site: REST API.
- Hosted clients' backups (1.26): backups that run on your own Veeam server (your BDR) are filed by Veeam under your company. Align now sorts them into clients on every sync: a machine goes to the client with a device of the same name in NinjaOne or ITFlow; Client mapping → Hosted backups lists every job and machine on your servers, where each went and why, and lets you assign a job (its machines, including ones added later, follow it) or a single machine to a client, or mark it as yours. Jobs shared by several clients count for each; client reports and the portal leave out their error details. Jobs mapped to companies in VSPC keep working as before. If your own company is linked to a client, flag it as your backup server there.
- Reports in meeting order (1.25): the QBR pack runs executive summary → service levels → assets & lifecycle → software & licensing → backup & recovery → compliance → roadmap → budget → decisions & next steps (projects awaiting approval with tick boxes, key contacts, next meeting), with the full inventory as an appendix. Devices are grouped servers & virtualization (hosts, servers, virtual servers) → storage → network & security → power → computers (desktops, laptops, virtual desktops) → printers & other, in the device-type table, devices needing attention, inventory and protected machines. The budget report goes this year → line items → three-year chart and outlook → contracts & renewals; the roadmap report starts with where things stand today.
- Security:
- Two-factor sign-in required for every staff and client-portal account; codes can't be reused.
- Argon2id passwords, and common passwords refused.
- Temporary passwords must be changed at first sign-in.
- Automatic logoff after 15 idle minutes (configurable, with a warning) and a 12-hour session limit.
- Password and 2FA changes end other sessions.
- A tamper-evident audit log (hash-chained, verified nightly, kept 6 years) that also records who viewed which client records.
- Encrypted database (MariaDB encryption at rest), encrypted backups downloaded through the browser and never kept on the server (age, private key kept offline), and TLS 1.2+ with HSTS.
- Strict security headers, no-store caching, firewall, and fail2ban.
- Signed releases: a server installs only updates signed with the project's release key.
- See docs/SECURITY.md for how each control works, the security audits and what you're responsible for outside the app.
- Client onboarding (1.22): from a client's Onboarding page (under Setup in its menu since 2.16.0), send a branded welcome email (from Microsoft 365 / Google Workspace, or create the link to paste into your own email) with a Start onboarding button. It opens a private page for that client, no sign-in needed (links expire after 30 days by default, only a hash is stored, and sending again replaces the old link). The client fills in their team's contacts in an editable table or pastes them from a spreadsheet, marking who approves changes, receives invoices and is the main IT contact (saved to Align and created or updated in ITFlow); reads your guides (how to reach you, billing, email security, with optional PDF versions) and confirms them; gives getting-started details (current IT provider, whether they've been told, preferred onsite week, pain points); and can submit new user setup and user suspend/termination requests, which become ITFlow tickets (or email your company address). Staff follow progress on the client's Onboarding page and get notified; the dashboard flags stalled onboardings, expired links and undelivered requests. The welcome email and guide pages are editable in Onboarding → Welcome email & guide (Settings → Onboarding before 2.2), with placeholders, PDF attachments, and import/export. The request forms are also in the client portal for users who can send requests.
- Dashboard (1.21): opens with Needs attention, one list across every client ordered by urgency: open tickets past SLA target, failed backup jobs and items without a recent backup, sync and integration errors, approved projects without a quarter, proposals waiting over 30 days, clients due for a meeting, contract notice deadlines and renewals in the next 30 days, compliance items past due and reviews due, and devices past end of life that aren't planned. Filter by area; each line opens the page that fixes it. Below it, Portfolio health tiles in four groups: service & backups (SLA targets met, open past target, failed jobs, backup success), lifecycle & security (replace now, unsupported OS, warranty expiring, average compliance), client engagement (due for a meeting, meetings in the next 30 days, projects awaiting a decision, planning complete) and money (renewals in 90 days with their annual value, this year's hardware and projects, licenses per month). Then the 3-year forecast, clients needing attention, service levels, planning, meetings, backups, contracts & renewals and portal activity. Customize lets each person drag cards (or use the arrows) between the full-width row and the two columns and hide what they don't use; the layout is saved to their account and Reset to default restores it.
- Client portal: give people at a client their own sign-in at
/portal. Invite them from the client's Client portal page and tick what each person can see (Roadmap & projects; Budget & licensing; Devices & compliance; Documents, contacts & meetings) and do (approve or decline proposed projects; suggest licenses and budget items, reviewed by you first; send new user and termination requests). Contacts are view-only in the portal since 1.39. Align makes a one-time link (valid 7 days) that you send them yourself, by copying it or with the Open in email button; they set their own password. Portal users are completely separate from staff accounts: they have their own session cookie and user table, and every page is scoped to their own client, so changing an ID in the URL never shows another client's data. Internal notes never reach the portal: device, license and contact notes, meeting notes, compliance evidence and internal meetings stay private. Documents show only when they're Active and shared (policies, plans, procedures and WISPs are shared by default; toggle it on the document). Prices appear only for users with Budget & licensing access. Security: two-factor sign-in is required (set up right after choosing a password), 12-character minimum passwords, lockout after 5 failed attempts, and the same idle timeout as staff. Project decisions show on the roadmap ("Approved by … (client)") and in a Client portal activity card on the dashboard; everything a portal user does is in the audit log. Clients can print their own roadmap, budget and asset reports. - Guided workflow: each client's overview has a Planning checklist: linked to ITFlow and NinjaOne, key contacts marked, hardware categorized, in-service dates known, licenses priced, managed services in the budget, a compliance framework assigned, projects on the roadmap and the next review scheduled. Each step links straight to the page that fixes it. The dashboard adds a setup checklist and a Client planning list showing each client's next step. The meeting page lists talking points (projects waiting for approval, upcoming renewals, open compliance items) and links the Assets, Roadmap and Budget reports. Help & how-to (the ? in the top bar) walks through the whole process.
- Clients: synced from ITFlow or added by hand. For ITFlow clients the address and main phone come from the client's primary location, and the contact name, title, email, phone (with extension) and mobile come from the primary contact (falling back to an "important" contact), plus the website; the client type fills the industry if it's blank. These refresh hourly and with the 2-minute ITFlow check, and they're read-only in Align. Anything empty in ITFlow can be filled in Align. Clients also have industry, meeting cadence (yearly by default) and vCIO owner. A hand-added client links to ITFlow automatically once a client with the same name shows up there.
- Last logged-in user: NinjaOne's last logged-in user for each computer shows on the client's device list (with when the device last checked in), the device page, the CSV export, the client portal's device list and the printed asset report (turn it off with the report's Last user option). The device list's Filter box matches it, so typing a username finds that person's machine.
- Devices & assets: from three sources. NinjaOne supplies computers, servers and anything it monitors. ITFlow assets NinjaOne doesn't manage are imported too: firewalls/routers, switches, access points, printers, UPS units (recognized by make/model) and NAS by default, with more types available on Integrations → ITFlow. You can also add devices by hand. Anything already matched to a NinjaOne or hand-added device is skipped. Virtual machines group with Servers (server OS) or Desktops as VDI (desktop OS) and are tracked for OS support only. You can change the type of any device.
- Two-way ITFlow asset sync: edits in Align (name, type, make, model, serial, OS, purchase and warranty dates, retired status) go to the ITFlow asset as soon as you save. Edits made in ITFlow come into Align within about 2 minutes, via the PSA poll timer (
msp-align-psa), because ITFlow has no webhooks. IP address and location come from ITFlow. If both sides change the same field, the most recent edit wins and the other value is kept in the device's sync history. Devices added in Align are created in ITFlow for clients linked to ITFlow, and any device can be set to Align-only. Retiring a device in Align marks the ITFlow asset Retired; deleting, archiving or retiring an asset in ITFlow retires the device in Align, and it can be restored. Sync never permanently deletes anything. For NinjaOne devices, NinjaOne owns the hardware facts; only the type and dates you set in Align are sent to ITFlow. - Unassigned hardware: ITFlow assets whose type Align doesn't recognize ("Other", Display, Tablet, custom types) are imported as Unassigned. Categorize them in bulk from To do (or Devices & assets → Unassigned hardware), and the ITFlow asset type is updated to match.
- Projects: add projects to any client's IT plan with a target quarter, budget, recurring cost, priority, status and description. You can add them from the global Projects page, the client overview or the client roadmap. Project budgets are stacked with hardware replacements in the 3-year IT plan on the dashboard and client overview.
- Backups (Veeam Service Provider Console, 1.8): each client gets a Backups page with backup health, protected machines (current vs overdue), job results with Veeam's failure messages, a 30-day success strip and success rate, Cloud Connect storage against quota, Microsoft 365 (1.9: Veeam Backup for Microsoft 365 tenants, jobs, and users, groups, teams and SharePoint sites current vs overdue, plus licensed users), and servers with no backup (NinjaOne/ITFlow servers that no Veeam job protects, matched by computer name). The client overview shows a backup card, the device list and device page show each machine's newest restore point, the dashboard lists clients whose backups need attention, and the portfolio report adds a Backups column. VSPC companies link to clients by name on sync, or by hand on Client mapping, which shows the NinjaOne organization and Veeam company side by side with how each was linked and what's protected. Read-only: Align never changes anything in Veeam. The overdue threshold (48 hours by default) is on Integrations → Veeam. Backup not required (1.10): mark any server, device, protected machine or Microsoft 365 item as not needing a backup (from the Backups page or the device page), with a required reason. It then stops counting as missing or overdue everywhere (dashboard, portfolio, QBR and backup reports), agent jobs for it stop counting as failures, the backup report lists it under "Not requiring a backup" with the reason, and every change is in the audit log. Monitor again undoes it.
- Email & notifications through Microsoft 365 or Google Workspace (1.12, 1.13): Integrations → Email (called Microsoft 365 / Google Workspace before 1.37) connects Align to Microsoft 365 with OAuth through Microsoft Graph, either app-only (Entra app with Mail.Send / Calendars.ReadWrite, client secret or certificate, ideally limited to the sending mailbox with Exchange RBAC for Applications) or Connect with Microsoft (sign in as the sending mailbox; Align keeps an encrypted refresh token and renews it). Google Workspace (1.13): pick Google instead of Microsoft at the top of the page and connect with either a service account with domain-wide delegation (Gmail API
gmail.sendand Calendarcalendar.events, sending as the mailbox you choose) or Connect with Google (OAuth web client on an Internal consent screen; sign in as the sending mailbox). Mail is sent through the Gmail API, and meeting invitations become Google Calendar invitations with an optional Google Meet link. The Microsoft and Google connections use no SMTP or stored passwords; an SMTP server is the third choice (1.37). Mail goes through a queue sent every minute by themsp-align-mailtimer, with automatic retries and an email log. - Staff notifications: backup job failed, daily backup summary, sync problems and recovery, contracts & renewals, meetings due, warranty & end of life, weekly vCIO digest, meeting reminders, client portal activity and security alerts (lockouts, staff account and role changes, two-factor resets, integration keys changed, audit log problems). Admins switch each one on or off, pick default roles, "always the client's vCIO" and extra addresses (for example a ticketing inbox), and can preview or send digests now. Each staff member chooses their own under Account → Email notifications, for all clients or just their own.
- Client emails: portal invitations and password links emailed directly, self-service "Forgot password" on the portal (1-hour single-use link, still needs two-factor), meeting invitations as real Outlook or Google Calendar invitations (with an optional Teams or Meet link, updates and cancellations follow automatically) or as .ics emails, and optional reminders to attendees.
- Lifecycle: warranty (Dell/Lenovo lookups), end-of-life, OS support, stale devices, and a 3-year replacement budget by quarter with a total for each year. Replace in (1.17): set the quarter a device will actually be replaced (with an optional reason) when a client defers it or brings it forward, on the device or for several devices at once from the client's device list. It overrides the end-of-life date on the roadmap, 3-year plan, budget, reports, client portal and lifecycle emails; a device past end of life that was put off shows as "Replacement deferred" instead of "Replace now". Devices without an in-service date can be planned this way too. Drag and drop (1.18): on a client's Roadmap & projects, drag a device, a quarter's whole "Replace … devices" group, or a project (including from the backlog) to another quarter. Devices ask for an optional reason (and offer "Back to end of life" for ones already moved); projects move straight away. Techs and admins only; every move is audited. Calendar or fiscal years, set in Settings → Planning & lifecycle.
- 3-year roadmap per client: a quarter-by-quarter board with a total for each year. It combines planned items you add (category, cost, monthly recurring cost, priority, status) with what the data says is coming: hardware reaching end of life, OS support ending, warranties expiring, meetings and compliance due dates.
- Menus and settings (1.15): the sidebar follows the vCIO workflow: Dashboard and To do, then Clients (Clients, Contacts, Devices & assets), Planning (Projects, Budgets, Licensing, Renewals), Meetings & reports, Compliance (Compliance, Documents) and Admin (Integrations, People, Settings, Audit log). Pages with two views have tabs (Meetings | Calendar, Compliance: Overview | Frameworks). Settings is one place with tabs: General (company details, sign-out timers), Planning & lifecycle, OS support dates, Notifications (which emails, who gets them, digest times, meeting invitations, email log), Onboarding, Branding, API and Updates & backups. Help & how-to has the workflow, searchable step-by-step guides (each page's help button opens the right one), a map of where things are, and where data comes from. Help (1.23.1) covers onboarding and request forms, service levels, the dashboard, the framework crosswalk and templates and the update progress window, and has a What's new tab linking each recent feature to its guide.
- Service levels from ITFlow SLAs (1.20): with ITFlow 26.08+ and SLAs set up there, the hourly sync copies each ticket's number, subject, priority, category and SLA times and results (never the ticket body; tickets older than 36 months aren't kept). Once a day every ticket is read; the hourly syncs in between read only the newest page and re-check open tickets one by one. Each ITFlow-linked client gets a Service levels page (responded and resolved on time against your goal with the change from the period before, tickets opened, average first response, open tickets past or close to target with links into ITFlow, 12 months by month, by priority, and missed tickets; 30 days to 12 months or the last full quarter). It also shows on the client overview, the dashboard (clients below goal, open tickets past target), meeting prep (talking point and report button), a printable Service Level Report, a Service levels section and highlight in the QBR pack, an internal all-clients report, and the client portal (summary and report, no ticket list). The switch and the goal percentage are on Integrations → ITFlow. The API key's user needs read access to Support tickets.
- Integrations (1.15): every connected service has its own card on Integrations with a live status (connected, not set up, or the error from the last sync) and its own page with the settings, setup steps and a Test connection button: ITFlow, NinjaOne, Veeam Service Provider Console, Email (Microsoft 365, Google Workspace or SMTP), Dell TechDirect and Lenovo. Client mapping, Hosted backups and Sync history are tabs on the same page. Connections are admin only; keys are encrypted and never shown again. The menu shows a badge when an integration has an error.
- Updates & backups (1.14): Settings → Updates & backups. Progress (1.23): pressing Update (or Restore) opens a "please wait" panel with a progress bar, the current step and the time so far; it follows the job, keeps waiting through the web-server restart and reloads on its own when it's finished (or shows what went wrong). Anyone else opening Align meanwhile sees a please-wait page with the same progress bar that refreshes itself every few seconds.
- Updates: Align checks GitHub every 6 hours. Admins see a banner and can get an email when a new version is out, with the release notes. Update to
makes a safety copy, pulls the new version, runs the installer (packages, migrations, services) and shows the live log. The safety copy is deleted once the update succeeds, and kept for download if it fails. sudo msp-align-updatedoes the same from the command line. - Backups are downloaded, never stored on the server. Download backup builds one file: the database, uploaded files and the key that decrypts saved API keys and two-factor secrets. It's encrypted with this server's backup key (age) and deleted from the server as soon as it's downloaded, or after an hour. Only encrypted data touches the disk. The file is a plain tar, so it can also be opened by hand:
tar -xf backup.tar, thenage -d -i key.txt db.sql.gz.age | gunzip. Admins get a reminder email when nobody has downloaded one for 7 days (adjustable). - Restore: upload a backup, paste the backup private key (used once, never saved), and Test this backup or Restore the database, the uploaded files or both. Restoring needs your two-factor code and typing RESTORE. Align goes into maintenance mode, makes a safety copy and puts it back automatically if anything fails. Afterwards it applies any newer migrations and signs everyone out. A backup from another server (moving to new hardware) brings its encryption key along, so saved API keys keep working. Backups larger than the browser limit (2 GB):
sudo msp-align-restore FILE. - How it works: the web server can't run other programs (shell functions are disabled in PHP except the one the background sync uses), so a small root service (
msp-align-agent) does the work. The page drops a request in/run/msp-align/requests(in RAM), and the agent runs only a fixed list of jobs with validated input. Databases are imported as the app's own database user in sandbox mode, so a crafted backup can't run commands or touch other databases. Uploaded files are extracted aswww-data, with unsafe paths refused. - Reports hub (1.11): Reports in the sidebar runs everything from one screen: pick a client, then open the QBR pack, asset, roadmap, budget (any plan year) or backup report with its options, download the compliance checklist or device list as CSV, or print a client document. Reports that need data the client doesn't have yet (Veeam link, a framework, documents) say so. All-client reports: portfolio summary, backup status (every Veeam client with failed jobs, overdue items and servers without backup) and contracts & renewals. Each client has a Reports page (1.42: in its menu, and under the header's Reports menu) that opens each report and links to the hub with that client selected.
- Printable reports (redesigned in 1.7): clean, brand-coloured Letter reports with page numbers and a running footer. Print → Save as PDF.
- Business review pack (QBR): a cover page with contents, then an executive summary (health, budget and compliance tiles, plain-language highlights, the next six months, decisions needed), then service levels, assets & lifecycle, software & licensing, backup & recovery, compliance, roadmap & projects, technology budget, and decisions & next steps (your team and next meeting). With costs turned off, the budget and licensing sections are left out. Each section can be switched off, and the full inventory can be added as an appendix. It's linked from the client's Reports menu and the meeting page, and clients can print their own from the portal, limited to the sections they may see.
- Asset & lifecycle report: fleet at a glance, health by device type, operating systems and their support dates, the replacement plan by quarter, priorities, the devices needing attention (with last user), and a full inventory grouped by type.
- 3-year roadmap: year tiles, a stacked quarterly chart (hardware vs projects), a quarter-by-quarter timeline, and projects with status and client decisions.
- Technology budget: summary tiles, the three-year quarterly chart, categories with share bars, line items, contracts & renewals, and the three-year outlook.
- Backup & recovery: backup KPIs, the 30-day result strip, a single "needs attention" list (failed jobs, overdue machines, Microsoft 365 items, unprotected servers), backup jobs, protected machines and Microsoft 365 coverage. Also in the client portal for users with Devices access.
- Portfolio (internal): every client ranked by risk, with health bars, compliance, last review date and hardware spend by year.
- Options: costs, notes, last user, virtual machines and line items can be turned on or off from the toolbar.
- Planning scope: remove any client from planning (bulk or one at a time, with a reason). Removed clients stay hidden through syncs. Clients added by hand can be deleted.
- Meetings & calendar: QBRs and other meetings, repeating series, agenda and notes, a flag for clients due for a meeting, a month/week/list calendar,
.icsinvites, and a private feed you can subscribe to in Outlook. - Compliance: built-in frameworks assigned per client, with a checklist (status, owner, due date, notes, evidence), scores, device-data hints, review dates and CSV export. Frameworks can be edited or copied.
- Built-in frameworks (1.19): MSP Security Baseline, Cyber Insurance Readiness, CIS Controls v8 IG1, HIPAA Security Rule, WISP (FTC Safeguards), plus CMMC Level 1 (15 FAR 52.204-21 requirements), CMMC Level 2 (110 NIST SP 800-171 Rev 2 requirements with SPRS point values and POA&M eligibility), NIST CSF 2.0 (106 subcategories), CIS Controls v8.1 IG2 (130 safeguards), PCI DSS v4.0.1 (253 requirements), SOC 2 Trust Services Criteria (61), ISO/IEC 27001:2022 (clauses 4–10 plus the 93 Annex A controls), CCPA/CPRA (60) and a Microsoft 365 security baseline (57). Each control has plain-English guidance on what "met" looks like and the evidence to collect. Copyrighted standards (PCI, ISO, SOC 2, CIS) are paraphrased with their official reference numbers. They're summaries for running an assessment, not legal advice or the official text.
- Compliance crosswalk (1.19): controls carry crosswalk tags (e.g.
iam_mfa,backup_offsite,log_retention). When a client has several frameworks, each control lists the matching controls in the others with the client's answers, and Use this answer copies the status, notes, evidence and linked document. Fill from matching answers fills every not-assessed control with a strong, consistent match for review before saving, so an MFA answer given once for CMMC is offered for PCI 8.4.x, CSF PR.AA, HIPAA and the rest. Admins can tag custom frameworks on the framework page. Long checklists post only the rows that changed. - Evidence check (2.18): techs answer Align's automatic security checks for a client from the client's own systems without seeing Align's result, and Compliance → Evidence check shows, per check, whether the answers agree (trusted after two clients agree and none disagree), with an anonymized CSV for reporting a check that's wrong.
- WISP (FTC Safeguards Rule): a compliance framework with 24 items covering 16 CFR 314.4(a)–(j), including every required element of the information security program. The framework notes which items the small-institution exemption in 314.6 waives (fewer than 5,000 consumers), so you can mark those N/A.
- Documents: per-client and internal documents edited in the app, or uploaded as files (PDF, Word, Excel, CSV, pictures; 2.20). Changes autosave as you type, and Ctrl/Cmd+S saves immediately. You can see who else has a document open, and their saved changes appear live. If two people edit at once, the second save gets a warning to load the other version or overwrite it, so no one's work is silently lost. Full version history lets you view or restore any version and save a named version. Each document has a category, a status (draft, active or archived), a review date, and Print / Save as PDF with a DRAFT watermark on drafts.
- Templates: 29 built-in templates: WISP (FTC), Incident Response Plan, Acceptable Use and Data Retention & Disposal; core policies (information security, data classification & handling, access control, password & MFA, remote access, mobile & BYOD, encryption, vulnerability & patch, logging & monitoring, change management, asset management, security awareness, vendor risk); continuity & risk (BCDR plan, backup & recovery, risk management policy, security risk assessment report); the CMMC package (System Security Plan, POA&M, CUI handling policy, Level 1 self-assessment & affirmation); and healthcare & privacy (HIPAA security risk analysis, breach notification procedure, BAA checklist, CCPA/CPRA privacy policy). Assessments and records have their own category and aren't shared to the portal by default. Templates fill in the client's name, contact, address, your company details and today's date automatically. You can edit templates, add your own, or save any document as a template.
- AI (2.29.0 to 2.32.0, optional): under Integrations → AI pick Claude, OpenAI, Grok, Gemini or a self-hosted Ollama, with a hard monthly token limit for everyone, emails at 80% and when it stops, a usage table by person and month, and a switch for each feature. Read a document turns vendor invoices, quotes, contracts and emails into vendors (to ITFlow too with two-way sync) and licenses; Review documents with AI answers a client's framework controls from their own policies with quotes as evidence, lists gaps and stale documents, and drafts missing or outdated policies from the templates; QBR summaries, meeting agendas, meeting notes to actions and alignment write-ups save time before and after each meeting. Every suggestion is reviewed and ticked before anything changes, AI's text never appears in the client portal, AI is off on a test server, and Align keeps token counts, not the text. See Security for what is sent.
- Evidence links: any compliance checklist item can link to one of the client's documents, for example the WISP item to the client's WISP. The link appears on the checklist, on the document page and in the CSV export.
- Contacts: every client has a Contacts page, and there's a searchable Contacts page across all clients. Contacts sync from ITFlow every few minutes: name, title, department, email, phone with extension, mobile, location, notes, and the Primary, Important, Billing and Technical flags. Ones archived or deleted in ITFlow are archived in Align. In Align you can mark decision makers and meeting invitees, keep notes and add contacts. With two-way sync on (Integrations → ITFlow → Two-way sync (devices and contacts)), contacts added in Align are created in ITFlow, edits to name, title, department, email and phones (made in Align or on the client's onboarding page) are sent to ITFlow, and archiving or restoring a contact in Align does the same in ITFlow (1.44.1; ITFlow also clears the contact's flags and archives their client-portal login when it archives them). The Primary flag and location stay managed in ITFlow. Each client's Contacts page says which way its contacts sync; a client not linked to ITFlow keeps its contacts in Align. The client overview shows key contacts, and the meeting form can add the client's meeting invitees, or any contact, to the attendees in one click.
- Licensing: every client has a Licensing page, and there's a Licensing page across all clients. Licenses come in from ITFlow's Software section every few minutes: name, vendor, user or device license, seats, purchase and renewal dates, and notes. Ones archived or deleted in ITFlow are retired, never deleted. ITFlow doesn't store prices and its API can't write software, so price, pricing basis (per seat or flat), billing cycle (monthly, quarterly, annual or one-time), category, seats in use and notes are kept in Align. You can also add Align-only licenses. Totals are shown per month and per year, with renewal warnings for the next 90 days, over-assigned seats flagged and a filter for licenses that still need a price.
- Who has which license (2.19): Microsoft 365 assignments come from the client's tenant every hour and match contacts by email; other licenses are assigned to contacts by hand. Contacts show their licenses and the devices they last signed in to, and the portal shows who has each license.
- Technology budget: a 3-year budget by quarter for each client that builds itself from licensing (charged in the months each license bills), hardware replacements (in their end-of-life quarter), projects (one-time budget plus any recurring cost) and managed services. Managed services is estimated from the last three months of ITFlow invoices; recurring-invoice bills are preferred and drafts and the current month are left out. Add a Managed services line to use your exact agreement amount. Add manual lines for internet, phones, cloud, contracts and anything else, billed monthly, quarterly, annually or one-time with optional start and end dates. There's a stacked chart by category, a quarterly detail table, a 3-year summary, a printable client-facing budget report, and an all-clients Budgets page.
- Contracts & renewals: licenses and budget lines carry a purchase or start date, contract term (month-to-month, 1, 2, 3 or 5 years, or a custom number of months), contract end date, notice period and a renegotiate-by date. The end and renegotiate dates are worked out from the start date, term and notice period if you leave them blank. A contract that doesn't auto-renew stops being budgeted at its end date. Upcoming dates show on the client's Licensing and Budget pages, a Renewals page across all clients (30, 90 or 180 days, or 12 months), the dashboard (next 90 days), the calendar (color-coded all-day events) and the printed budget ("Contract dates in
"). - Client logos & profile pictures: upload a logo for each client from the client's Edit form. It shows in the client header, the client list and on that client's printed reports next to your own logo. Each user can add a profile picture under Account; it shows in the top bar, the user list, next to the vCIO's name, and when they have a document open. Images are resized and re-encoded on upload (PNG/JPG/WebP/GIF, 5 MB max; SVG is refused) and are only served to signed-in users.
- Branding: under Settings → Branding you can set the app name, upload a logo (PNG/JPG/WebP/GIF, re-encoded; also used as the browser icon and on printed reports), pick a brand color and a light or dark menu, and edit the sign-in page message. A live preview shows the app, the sign-in page and the client portal, in light or dark mode.
- UI: built on AdminLTE 4, Bootstrap 5.3 and Font Awesome, with no jQuery. Each person picks light or dark under Account. It's bundled locally, with no CDN.
Planned: budget vs. actual spend.