Security & Backup

Afi Backup

Run your Afi Backup tenants conversationally - check protection coverage, quotas, and tasks, trigger backups, and protect resources.

Dex connects to the Afi Backup Platform API so admins can run SaaS backup conversationally - read tenant detail and quotas, list resources and protection statistics, review protections, archives, policies, tasks, and the tenant audit log, trigger an out-of-schedule backup, and protect a resource with a backup policy. Unprotecting a resource is possible from the MSP master connection only. Available as an MSP global app: one shared Application API key covers every org and tenant that installed the app, and each Dex tenant is confined to its own Afi tenant via a tenant_id ULID. The MSP master connection additionally reads installations, the org roster, and licensing.

Start free →

What Dex does with Afi Backup

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

Read a tenant and its usage and quotas - and lead with any quota that is exceeded when backups are failing
List resources and read protection statistics to see what is and is not backed up
Review protections, archives, and the backup policies available to the tenant
Read tasks and task statistics, and the tenant audit log of who changed what
Trigger an out-of-schedule backup (backup now) for a protection job
Protect a resource by assigning a backup policy - with approval, since it can consume a licence seat
Unprotect a resource from the MSP master connection only - with approval, since backups of it stop
On the MSP master, list installations, walk the org roster, and read licensing subscriptions and seat history
Deploy as an MSP global app - one shared Application API key, each customer confined to its Afi tenant_id

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Why are backups failing for this tenant - are any quotas exceeded?
>Is everything backed up? Show me resources that are not protected
>Run a backup now for the mailbox resource that keeps falling behind
>List the backup policies available to this tenant
>Show me the audit events for the last 7 days
>On the MSP master, how many seats does the Contoso org have and how has that changed?

Policy actions

Every action Dex can take on Afi Backup is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`afi_list_installations`	List Afi Application installations (MSP master connection only)	—
`afi_list_child_orgs`	List child organizations under an Afi org (MSP master connection only)	—
`afi_list_org_tenants`	List tenants under an Afi org (MSP master connection only)	—
`afi_get_org`	Read one Afi organization by id (MSP master connection only)	—
`afi_list_subscriptions`	List an Afi org's licence subscriptions (MSP master connection only)	—
`afi_get_subscription_history`	Read an Afi org's subscription seat history (MSP master connection only)	—
`afi_get_tenant`	Read this Afi tenant (path-forced)	—
`afi_get_tenant_quotas`	Read this Afi tenant's usage and quotas (path-forced)	—
`afi_list_resources`	List Afi resources for this tenant (path-forced)	—
`afi_get_resource`	Read one Afi resource of this tenant (path-forced)	—
`afi_get_resource_stats`	Read Afi resource protection statistics for this tenant (path-forced)	—
`afi_list_protections`	List Afi protections for this tenant (path-forced)	—
`afi_list_archives`	List Afi archives for this tenant (path-forced)	—
`afi_get_task`	Read one Afi task by id for this tenant (path-forced)	—
`afi_get_task_stats`	Read Afi task statistics summary for this tenant (path-forced)	—
`afi_list_audit_events`	List Afi audit events for this tenant (path-forced)	—
`afi_list_policies`	List the Afi backup policies available to this tenant (path-forced)	—
`afi_trigger_job`	Run an out-of-schedule backup (backup now) of one of this tenant's protection jobs (path-forced)	—
`afi_protect_resource`	Assign a backup policy to one of this tenant's resources; may consume a licence seat (path-forced)	approval
`afi_unprotect_resource`	Remove a backup policy from one of this tenant's resources; backups of it stop (MSP master only; refused on a scoped child)	approval

How to configure Afi Backup

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the Afi Backup portal, open the Apps tab and create an Application API key for Dex.
2
Prefer copying the full Authorization header value including the appkey- prefix; a key without the prefix is prefixed once at connect time.
3
In Dex, enable the Afi Backup integration and paste the Application API key. Leave tenant_id blank for the MSP master connection.
4
For each customer tenant, discover its tenant_id ULID from installations or the org tenant roster on the MSP master and save it on that tenant's connection.
5
Dex validates the key with a live read before saving - against the tenant on a scoped connection, or installations on the master.

Credentials required

api_key: Afi Application API key (prefer the full value including the appkey- prefix)
tenant_id: This tenant's Afi tenant ULID (26-char Crockford base32) - leave blank on the MSP master connection

Requirements

•An Afi Backup account with an Application installed for the target orgs and tenants
•An Application API key created in the portal Apps tab
•Each customer tenant mapped to its own Afi tenant_id ULID - blank tenant_id means the MSP master connection
•Installations, org roster, and licensing routes are MSP master only; unprotecting a resource is MSP master only