Not one of these connectors fills a database of its own. They all fill the same one, which is why a device, a user, a licence and a cloud resource can finally meet on one record.
Coverage by product
Distinct connectors each product provides
Most connectors serve more than one product, because they all land in one asset model.
What the products connect to
Type a name, an abbreviation or the thing you actually care about: PVU, CAL, FOCUS, SSO, offboarding. Filter by category, or by the CerteroX product that provides the connector.
215 integrations, grouped by category.
Nothing matches that.
Try a shorter term, or clear the filters. If we genuinely do not have it, the read-only API and the third-party import route are below.
Billing, usage and resource inventory read from the platform itself, then costed in one model.
Provided by CerteroX Cloud Management CerteroX ITAM CerteroX AI Management
Billing, resource inventory and all twenty-six optimisation checks. Also an ITAM cloud discovery source.
Abandoned Instances, Obsolete Snapshot Chains, Abandoned Kinesis Streams, Reserved Instance opportunities — twenty-six named checks, each with its own thresholds, pool exclusions and account skips.
Billing ingest and resource inventory, in the same cost model as every other provider.
A first-class billing source, and a SaaS subscription with its own seats and last-used dates.
Observability spend as a billing source, and observability seats as a licence position.
Cost Explorer, pool allocation and rightsizing across projects, regions and accounts.
Utilisation by namespace, node and service, with Kubernetes rightsizing as a named check.
Cost and usage, Azure VM tag-hygiene policy, and the same checks applied to ML executors.
Resource inventory and billing ingest, under the same pools, budgets and policies as the rest.
Warehouse spend in the same cost model as the infrastructure underneath it.
Chat, meetings and telephony, counted by licence type and by how recently the seat was used.
Provided by CerteroX SaaS Management CerteroX SAM
Vendor-authoritative user and licence lists, and a provisioning and deprovisioning target.
Mailbox, OneDrive and SharePoint activity land per user behind the one seat, so the licence and the evidence for it are never two records. The offboarding checklist then shows every licence a leaver held, the connector status behind each one, and whether revocation is pending, in progress or complete, with the monthly cost of whatever is still open.
Free seats told apart from paid ones, with the bookings taken against each licence.
Licence tier per user, with the call volume placed on each one sitting behind it.
Which Discord servers the organisation is actually using, and the accounts inside each one.
Mailbox and Drive activity behind each seat, and deprovisioning that runs to completion.
Meeting, webinar, support and remote-access seats read apart, because they are licensed apart.
Community and intranet accounts by licence type, and the spaces each one still reads.
Licensed extensions and digital lines, each with the usage recorded against it.
Members matched to paid seats, with unused-licence detection at thirty days of silence.
Licensed hosts and meeting activity, marking the licences with nothing scheduled on them.
Groups, posts and admin roles on a platform now being retired, and the paid accounts still open on it.
Basic, Licensed and Webinar seats told apart, each with the meetings actually hosted on it.
Who exists, who left, and who still holds a seat. The spine every other connector reconciles against.
Provided by CerteroX SaaS Management
Identity sync including MFA enrolment, and a provisioning and deprovisioning target.
Users, groups and MFA enrolment arrive in one directory read, and the same connector provisions and deprovisions. That is what SSO coverage gap analysis runs on: which applications sit outside the identity provider, and who is still holding a seat inside them.
Members, groups and licence state, on the same person record as everything they sign into.
Tenant users, the connections they authenticate against, and their roles.
Users, groups and account assignments, feeding SSO coverage gap analysis.
Organisation members and groups, with the state of every seat being billed for.
Enrolled devices and MFA state per person, on the same spine as the other identity providers.
Directory sync feeding the same user spine as Microsoft Entra ID and Okta.
Bound systems and the groups behind them, reconciled against what the vendor APIs return.
Every account sits under a node, and the licence it is consuming is read alongside it.
Vault access, groups and seat state, with the licences leavers left behind surfaced.
One of the ten discovery methods imports the users, groups, computers, sites and subnets together.
Identity sync including MFA enrolment, and the input to SSO coverage gap analysis.
Roles and application assignments per person, feeding the same SSO coverage analysis.
Users, groups and application assignments, landing on the one person record.
Files, wikis, boards and signature tools, where a paid seat and a free collaborator are separate positions.
Provided by CerteroX SaaS Management
Deprovisioning transfers file ownership before it deactivates the account.
Deprovisioning is not one action. File ownership transfers first, then the account is deactivated, and the offboarding checklist records whether that revocation is pending, in progress or complete — next to the monthly cost of every licence still open behind a leaver.
Seats and agreement-sending activity, with unused signature licences listed ahead of renewal.
Paid seat types separated from reviewers, with the roadmaps each one actually edits.
Seat sync with Active Usage Rate, so a quiet licence is visible well before renewal.
Paid members feeding App Rationalization, where tool overlap is ranked by recoverable saving.
Account and project membership, with per-user activity behind the subscription.
Which workspace members occupy a paid seat, which are guests, and what activity sits under each.
Doc Makers distinguished from editors, because only one of the two consumes a licence.
Licence tier per user, with the spaces and pages behind each seat.
Envelope senders and renewal dates, under a budget with its own warning and critical thresholds.
Seats with per-user file activity, so a licence with no files behind it stands out early.
Storage and sharing activity held against the licence position each plan tier creates.
Business seats with last-used dates, ranked by what each idle licence is costing.
Power users and dormant seats separated in the usage summary, board by board.
Paid seats, viewers and guests are three separate counts, with the boards behind each one.
Usage attributed per member, with every leaver’s Notion licence on the offboarding list.
Sender roles and the documents behind them, so a licence that has sent nothing is visible.
Licensed members counted apart from free collaborators, so the paid number is the real one.
Workspace members and board activity, with free and paid seats told apart.
Regular users, collaborators and external users, each counted against the licence it holds.
Model and run tracking, the AI subscriptions people sign up to, and the compute burning underneath both.
Provided by CerteroX AI Management
Task, run and runset tracking with console logs, artifacts, stages and milestones.
The model registry versions each run, the dataset it trained on is versioned with lineage, and the executor underneath is visible, so the leaderboard entry and the GPU bill behind it are the same record.
AI seats and spend, with OAuth grants risk-scored on sensitivity, scope, consent and dormancy.
Instrumented through the Delight agent collector, down to the executors running the job.
Pipeline workloads costed as cloud instances, with the full twenty-six checks applied.
GPU-dense compute costed on the same terms as the hyperscalers, and billed into the same pools.
AI seats and spend, ranked on the Shadow AI dashboard by share of the organisation using it.
Training runs tracked with custom metrics, target values and goal tendency.
Training runs ranked on leaderboards by the metric you actually care about.
Revenue and service platforms, where seat counts grow with headcount and almost never shrink with it.
Provided by CerteroX SaaS Management CerteroX SAM
The authoritative seat source, with every assignment read from Salesforce itself.
Sales Cloud, Service Cloud and Platform licences are read as separate positions, each carrying its own last login and feature use. A tier recommendation then holds up in front of the licence owner.
Numbers, the people holding them, and the calls placed on every licence.
Seats and credit-consuming users, so an unopened licence surfaces before the renewal window.
Recording licences and the number of calls actually captured on each one.
Every user, the role they hold, and how recently they used the seat.
Which users hold a licence, in what role, and how active each one is.
Members and seat types, with sending activity read alongside the other document tools.
Full and occasional agents counted separately, with ticket activity against each.
Agent seats and requester counts, with utilisation set against what was actually purchased.
Teammates by licence type, with the shared-inbox activity behind every paid seat.
Licensed users and recording activity, so a seat that records nothing does not survive renewal.
Full seats and lite seats counted apart, each with the conversations handled on it.
Seat assignment and last activity, well ahead of the contract date.
Per-application licences and security roles, with usage behind each seat.
Sequence activity per seat, so an unopened licence is caught well before renewal.
Roles per member, with the documents produced under each paid seat.
Seats, permission sets and last activity, held against the licence position for each plan.
Proposals sent from each licence, held against the seat type that paid for it.
Cadence activity behind every seat, with the dormant ones surfaced before the renewal date.
Deprovisioning locks the account and strips every role and group membership.
Agent and light-agent seats read as two licence positions, each with its own ticket activity.
Seat assignment and credit usage, per user, as the vendor itself reports it.
Deployment, management and third-party inventory systems, imported into the schema the agents already write to.
Provided by CerteroX ITAM CerteroX SAM
Applications, packages and jobs imported, then driven from the same console that sees them.
The same console that imports Configuration Manager runs software distribution for MSI, EXE and Click-to-Run, Windows 11 upgrade orchestration, and WSUS-integrated patching with downstream servers.
Administrative users and licence assignment, alongside the Apple fleet it manages.
Zero-touch enrolment inside the iOS and Android mobile device management stack.
Third-party ITAM import (one of the ten discovery methods), landing in one schema.
Console users and their licence assignment, next to the Macs each one administers.
Admin roles and licence state per console account, held on the same person record.
Modern-managed devices folded into the one device record the agents already write to.
Patch management with downstream server support, driven from the asset record itself.
Third-party ITAM import, reconciled against agent and agentless inventory.
Campaign, survey and analytics tools, where the seat outlives the campaign that justified it.
Provided by CerteroX SaaS Management
No suspend API exists, so there is a soft mode that strips roles and a hard mode that deletes.
Deprovisioning here respects what the vendor actually allows rather than what a generic connector assumes. The soft mode strips every role and the hard mode deletes outright, and the offboarding checklist records which one ran and whether it finished.
Permission levels and last activity, attributed to the department that is paying for them.
Named users and product profiles read from the Admin Console, with last access on each.
Workspace access by role, with the campaigns each licence has actually been used to run.
Licence type per account user, and the survey activity underneath it.
Project access by role, and the dashboards each paid seat is still opening.
Account users and permission levels, each with the date they last signed in.
Property access and user roles, with the reports each licensed account still opens.
Developer, Standard and Viewer users held apart, because they are licensed apart.
Report and data-source access per user, and the accounts that have opened neither.
Sends behind every paid seat, held against the permission level each account carries.
Project members and roles, with the boards and reports each seat has opened.
Access to each workspace read per account, with the reporting produced under every licence.
Workspace users and the roles they hold, against the sources each one still touches.
Team members and seat types, with the surveys each paid seat has actually run.
Creator, Explorer and Viewer seats, each feeding the Optimization Score for the application.
Repositories, pipelines and monitoring, read for who holds a seat and for what the build is spending.
Provided by CerteroX SaaS Management CerteroX Cloud Management
Organisation members and seat types, with the repositories and the CI/CD spend on one record.
Enterprise and Team seats are read as separate positions, each carrying its own last activity, and the same connector attributes Actions spend to a cost pool. A seat and the compute it burns stop being two conversations.
Application reach per licensed seat, held against the role the account actually carries.
Who holds a workspace seat, which deployments they can reach, and when they last used it.
Basic, Stakeholder and Test Plans access levels read as three separate licence positions.
Repository activity per workspace member, against the licence tier they sit on.
Members and seat types, with the projects each licensed seat is still active in.
Roles per account, with the pipelines actually run under each licence.
Management zones each seat can reach, with the last activity recorded against it.
Roles on each account, attributed to the team that owns the service they run.
Seat sync for licence reclamation, and CI/CD spend attributed to a cost pool.
Error projects and the seat type entitled to reach each one, per team member.
Who is a member, what role they hold, and when they were last active.
Licence sync with cost per licensed user set against cost per active user.
Upcoming renewals with days-to-renewal and the utilisation rate behind each seat.
Collections and API activity per seat, held against the role each member was given.
Seat types and project access per team member, and the seats that watch nothing.
Error-tracker seats read against the others in App Rationalization, seat by seat.
Module entitlement per licence, next to the roles each console user actually holds.
Users, roles and last activity, attributed to the team that owns the index.
Messaging projects, the roles on each, and the last sign-in behind every account.
HR, payroll and workforce systems. They carry the joiners and leavers every other licence position depends on.
Provided by CerteroX SaaS Management
The joiner, mover and leaver record that the rest of the connector set reconciles against.
Worker, organisation and employment-status records arrive on the same person spine as the identity providers and the vendor APIs. Every licence a leaver held then lands on one offboarding checklist, with the state of each one and the monthly cost of anything still open.
Employee, department and employment-status records: the leaver signal the rest of the list needs.
Team and lifecycle records, feeding the same person spine every seat reconciles against.
Headcount, department and reporting-line records, read alongside the licence position for each person.
Users by location and licence tier, and the rostering done on each.
Workplace accounts and admin roles, held against the sites each licence actually covers.
Departures land on the contract record first, and on every application list right after.
Payroll and employment status arrive together, keeping the person spine current.
People, sites and lifecycle status read from Bob, on the same record as the directories.
Profiles, departments and reporting lines, matched to the seats each of those people holds.
Worker records, job data and employment status, joined to the seats each person holds.
Contract status and department records, so nobody keeps a seat past their last day.
Device and application-assignment records next to the person, so one system holds three signals.
Employment status and organisation structure, on the same spine as the identity providers.
Worksite employee records and employment status, joined to the spine the licences hang off.
Worker, job and employment-status records, read alongside the licences each person holds.
The publishers with dedicated licence engines, where the entitlement maths is the product.
Provided by CerteroX SAM
Options and packs with evidence and override, core factors, licence pools and cover-down.
Processor types and core factors, licence pools with hosting rights and geographic rules, cover-down logic for Enterprise Edition, uncapped quantity for unlimited agreements. Oracle accepts our measurement data in place of running its own scripts.
Named-user entitlement with usage evidence over a rolling ninety-day window.
PVU and Virtual Processor Core metrics, compliance gap analysis and Component Resolution.
Subscription entitlement read into the same Microsoft licence position as the servers.
Mailbox entitlement evidence behind the Microsoft licence position.
Core and processor licensing with cluster and virtualisation awareness.
Device CALs, user CALs, named user and external connectors, alongside core licensing.
Responsibilities read for entitlement rather than inferred from what happens to be installed.
One of six publishers with a dedicated licence engine, not a generic seat count.
A non-invasive ABAP connector reading named users, roles, engines and authorisations.
Hiring, learning and engagement tools, bought per person and renewed long after the last login.
Every user has a manager, a licence assignment and a last-use date.
Participation per member, held next to the licence status of every account.
Account users and access levels, with the surveys each licensed seat has run.
Permission levels and hiring activity per seat, set against the number of seats bought.
Licence assignment per account, and the assessments actually run under each one.
Reviewers and their managers, each with the licence they hold and the reviews run on it.
Recruiting activity per user, against the permission level they hold.
Licensed learners and last activity, with unopened training seats reported for reclaim.
Viewing activity per learner, ranked by what each idle seat is costing.
Course activity per learner, with idle seats surfaced before the renewal window opens.
Who holds a seat, at what permission level, and the hiring done on it.
Hypervisors and hardware managers, read for inventory and for the host relationships licensing turns on.
Provided by CerteroX ITAM CerteroX SAM
Host and guest relationships: what per-core and per-processor licensing actually turns on.
SQL Server and Windows Server core licensing, Oracle licence pools and IBM sub-capacity PVU are all computed against which guest ran on which host. The connector reads those host and guest relationships directly, so cluster membership and virtualisation are inputs the licence engine already holds.
Network device inventory alongside SNMP switch port and routing tables.
LPAR and frame topology, the basis of IBM sub-capacity PVU calculation.
Virtual machine inventory with the cluster and host awareness core licensing needs.
Hyperconverged host and guest inventory, in the same schema as everything else.
Partitioning evidence behind Oracle licence pools, hosting rights and cover-down.
Guest inventory across the open KVM virtualisation stack, host relationships included.
Machine inventory, plus the Access Control rules that streamed-application licensing turns on.
Creative, prototyping and content tools, where an editor seat and a viewer seat are separate licence positions.
Provided by CerteroX SaaS Management CerteroX SAM
Named-user seats by product, with usage evidence over a rolling ninety-day window behind each one.
The Admin Console says who holds a licence. The usage evidence says who opened it. Both land on one record, next to every other creative tool the same person is licensed for, and App Rationalization reads that record.
Version-control seats on a wound-down service: a dead tool still holding accounts is a finding.
Team members separated from paid seats, and the design work each has done.
Every seat carries a space, a role, and the date the space was last opened.
A FigJam-only seat carries its own licence, so it is counted on its own.
Editor, developer and viewer seats told apart, so a full seat doing viewer work is visible.
Reviewers and collaborators counted apart, with the projects each licence is still working in.
Retired platform, live account list. The seats a shut-down tool still holds are the licence finding.
Full and lite seats held apart, with the documents behind each licence.
Members, guests and licence assignment, with the boards each has worked on.
Editor seats and last activity, feeding App Rationalization against the other design tools.
Seat types and the projects behind them, so an idle handoff licence is easy to spot.
Where a finding has to travel before it becomes a change, and how the platform answers other systems.
Provided by CerteroX AI Management
Every product exposes an MCP server, with scoped tokens and every tool call audited.
It is an MCP client as well as a server, so an agent working here can reach a system through the MCP server that system already publishes. Tokens are scoped per organisation and every call is audited and quota-tracked, so a security review has something to sign off.
Platform users and roles, with the integrations each licensed seat still maintains.
CI/CD cost pools and shareable environments with booking, SSH keys and webhooks.
CI/CD attribution, so build spend lands in a named cost pool rather than a shared bill.
A finding becomes a ticket, and the ticket carries the evidence that produced it.
A documented data source over the read-only Certero API, so your BI tool reads it in place.
Scheduled reporting-agent delivery into the channel that owns the decision.
Anypoint users and roles, with the environments each licence is entitled to reach.
Report delivery, plus a bot for pool alerts, TTL management and expense tracking.
Declared infrastructure read into shareable environments, with booking, SSH keys and webhooks.
Security, vulnerability and awareness tooling: licensed per person, and just as capable of being over-bought as anything else.
Provided by CerteroX SaaS Management
Falcon console accounts, the roles on each, and the modules that licence actually reaches.
Security tooling is bought per person and reviewed by nobody. Reading the console users, their roles and their last activity puts the security stack on the same licence position as everything else, and on the same offboarding checklist, where an administrator account outliving its owner is the finding that matters.
Workspace members and roles, with the repositories each licensed seat is scanning.
Administrative roles per console account, and the policies each one is able to change.
Account members, roles and Zero Trust seats, attributed to the team that owns the zone.
Which users hold which safes, under which licence type, and when they last opened one.
Administrator accounts and their roles, reconciled against the same identity spine.
Each console seat carries a role, and the workloads behind it are read with it.
Licensed users and training activity, so an idle awareness seat is visible before the renewal.
Portal users, roles and licence assignment, on the same record as the Microsoft seats.
Tenant administrators and roles, with the console each one has actually signed into.
Subscription seats and their assignment, and the licences that were never activated.
Console users and roles, with the module entitlement sitting behind each licence.
Contributing developers counted apart from members, because the vendor licenses them apart.
Sophos Central administrators, their roles, and the seats licensed under them.
Users and roles, with the licence each one holds and the scans it has run.
Finance, procurement and spend systems, where an approver role outlives the reason it was bought.
Users, approval roles and last activity, attributed to the department that holds the budget.
Card roles and last activity, on one record with the software the same person holds.
Approval roles and last activity, including the seats that have approved nothing in months.
Members by policy, with the claims submitted behind each seat since it was bought.
Full, employee and self-service licence types held apart, each with its own last login.
Paid licences, the role each one carries, and the date it was last signed into.
Who can reach the dashboard, under which team role, and when they last did.
Reporting workspaces, the roles inside them, and the seat that still owns each report.
Sign-in dates per seat, held next to the permission level each one carries.
A card marked writes back can perform a named action against that system. Every other card in the directory only reads.
A competitor with five acquired products carries five sets of connectors and a reconciliation project between them. We run one set into one model, and every connector in the directory above feeds it.
Connectors in 221 listings
Users, devices, licences, billing and activity, each read from the system that owns it.
One asset model
Five disciplines,
one set of records.
Answers out 3 surfaces
Read-only API
A documented Certero API with a published Power BI data source. Your BI tool reads our data where it sits.
MCP server, on every product
Scoped per-organisation tokens, with every agent tool call audited and quota-tracked. External MCP plugins let it call out to other servers too.
Export and delivery
Raw billing export to external BI, scheduled email reporting, and reporting agents delivering into Slack and Microsoft Teams.
One integration surface for the whole platform, and these three routes out of it.
A connector is a small, unglamorous object: an authentication method, a schedule, a scope, a list of what it reads, and a list of named actions.
The interface and the data shown here are illustrative. The reads and all four write actions are CerteroX SaaS Management capabilities.
Reads
Writes 2 of 4 enabled
Every use of a write action lands in the audit log.
Security teams ask two questions about any integration: what can it see, and what can it change. Both answers are below.
01
What a connector reads depends on what the system will hand over.
02
17 of the 215 connectors can write anything at all.
03
Every action a connector performs stays attributable afterwards.
Verified by Oracle License Management Services. Oracle’s audit team can accept data from Certero during an official audit, as an alternative to installing Oracle’s own measurement tools.
Read the verificationThree of these need nothing from us at all, and the fourth starts with a conversation.
Send the system name and what you need out of it, whether that is inventory, seat lists, billing or a named write action. Where one of the four routes above already covers it, we will point you straight at the documentation for it.
A documented Certero API over the whole asset model, with a published Power BI data source. If your system can read HTTP, it can read everything you own.
A dedicated collector ingests the FinOps Open Cost and Usage Specification. Any provider that emits FOCUS is costed correctly without a bespoke connector at all.
Third-party ITAM import, network discovery across NetBIOS, SNMP and ICMP, agentless inventory and standalone inventory for air-gapped systems. Ten discovery methods, and every one of them writes to the same schema.
The platform is an MCP server, and it is also an MCP client. External MCP plugin support means it can call tools published by your own servers, under the same scoped, audited tokens.
An AD forest nobody has pruned since 2014, an Oracle environment with options nobody can account for, a Microsoft 365 tenant with more licences than people. Name it, and the demo is built on that connector — what it reads, what it returns, and the record every result lands in.
Nothing to connect, nothing to approve, no gated PDF.