Security & Backup

CyberQP

Run CyberQP privileged access management from Dex - retrieve vaulted passwords, grant Just-In-Time admin elevation, and verify helpdesk callers.

Dex connects to CyberQP (formerly Quickpass), the privileged access management platform built for MSPs, so technicians can work its three products conversationally: retrieve rotated privileged and service account passwords, grant and revoke Just-In-Time admin elevation with an audited reason, and push a self-serve identity verification prompt to prove a helpdesk caller before performing a sensitive action. CyberQP deploys as an MSP global app - the master holds one shared credential set covering the whole CyberQP tenant, and each Dex child tenant is mapped to one CyberQP customer by its customer_id. The app is admin-only: privileged credentials and elevation are never exposed to end users, so there is no Dex Go self-service surface.

Start with $100 free →See Dex Live

What Dex does with CyberQP

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

List CyberQP customers and read a customer's account-type breakdown (end-user, admin, service, JIT counts)
List a customer's end-user, admin, service, and JIT accounts
Retrieve the current plain-text password for a vaulted privileged or service account, with its last rotation date - with approval
Push a self-serve identity verification prompt to a helpdesk caller and write the result onto a PSA ticket - with approval
List JIT policies and their allowed durations, and check whether a JIT account already exists before creating one
Create a JIT admin account and elevate it for a bounded duration with an audited reason - with approval
De-elevate a JIT account immediately to revoke active admin access (remediation path, intentionally not approval-gated)
Retrieve JIT account passwords and OTP codes, and manage a JIT account's stored OTP secret - with approval
Deploy as an MSP global app - one shared credential set, each customer scoped by its customer_id

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>How many admin accounts does Contoso have in CyberQP?
>Get me the password for the Contoso backup service account
>Verify the caller on SR-12345 before I reset their password
>Grant jsmith 4 hours of JIT admin on the OFFICE directory - reason: installing accounting software per SR-12345
>Disable the JIT elevation on that account now, the session is done

Policy actions

Every action Dex can take on CyberQP is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`cyberqp_list_customers`	List CyberQP customers for a directory type, with the customer id used to map child tenants	—
`cyberqp_list_accounts`	List a customer's end-user, admin, service and JIT accounts (cursor-paginated)	—
`cyberqp_view_account_counts`	Read a customer's account-type breakdown (end-user, admin, service, JIT counts)	—
`cyberqp_get_account_password`	Retrieve the current plain-text password for a vaulted privileged or service account, with its last rotation date	approval
`cyberqp_verify_identity`	Push a self-serve identity verification prompt to an end user and write the result note onto a PSA ticket	approval
`cyberqp_list_jit_accounts`	List a customer's JIT accounts with enabled state, expiration, mode and policy	—
`cyberqp_check_jit_account`	Check whether a JIT account already exists for a customer and directory type before creating one	—
`cyberqp_list_jit_policies`	List the JIT policies available to a customer, with the durations and privileged groups each grants	—
`cyberqp_create_jit_account`	Create a JIT admin account for a customer under a named policy, duration and audited reason	approval
`cyberqp_enable_jit_account`	Elevate a JIT account for a bounded duration with an audited reason (privilege escalation)	approval
`cyberqp_disable_jit_account`	De-elevate a JIT account immediately, revoking active admin access (remediation path - intentionally not approval-gated)	—
`cyberqp_delete_jit_account`	Delete a JIT account entirely (destructive and not reversible through the API - prefer disable)	approval
`cyberqp_get_jit_password`	Retrieve the current plain-text password for a JIT admin account	approval
`cyberqp_get_jit_otp`	Read the current OTP codes for a JIT account, with their expiry timestamps	approval
`cyberqp_set_jit_otp`	Store a base32 OTP secret (a permanent MFA seed) for a JIT account	approval
`cyberqp_delete_jit_otp`	Remove a JIT account's stored OTP secret, breaking its MFA until a new secret is stored	approval

How to configure CyberQP

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the CyberQP dashboard, sign in as a Primary or Super role holder using a dedicated System User technician account (not a person's login).
2
Generate API credentials and grant all offered scopes - offline_access, profile, customer, and password_rotation_write.
3
Copy the Access Token, Refresh Token, and ClientID from the credential-generation step.
4
In Dex, enable the CyberQP integration and paste the region, ClientID, Refresh Token, and Access Token. Leave customer_id blank on the MSP master connection.
5
For MSPs, map each Dex child tenant to its CyberQP customer by setting customer_id to the 24-character hex id from GET /api/v1/customers on the master connection.

Credentials required

region: CyberQP region key - one of exactly us, eu, or ca (not a URL)
client_id: ClientID issued with the API credentials, identifying the CyberQP tenant
refresh_token: Refresh Token from the CyberQP credential-generation step - the primary credential
access_token: Access Token from the same step - fallback when refresh is rejected
customer_id: The CyberQP customer id (24-character hex) this tenant maps to - leave empty on the MSP master connection

Requirements

•A CyberQP subscription with API access, and credentials generated by a Primary or Super role holder
•A dedicated System User technician account - credentials are bound to the user that generated them
•All offered scopes granted (offline_access, profile, customer, password_rotation_write) - password routes return 403 without password_rotation_write
•Admin-only: the app is not available in Dex Go, so end users reach CyberQP through a technician
•For MSPs, deploy as a global app with one shared credential set and per-tenant scoping by customer_id