NetBird
Administer your NetBird zero-trust network conversationally - peers, users, setup keys, groups, access policies, networks, routes, DNS, and posture checks.
Dex connects to the NetBird Management API so admins can run their zero-trust network (ZTNA) in plain language - browse peers, users, setup keys, groups, access policies, networks, routes, DNS, and posture checks, then make changes with approval. NetBird is an MSP global app: one shared personal access token issued to a real MSP user covers every tenant under the MSP account, and each Dex tenant is confined to its own NetBird account id (an opaque xid). Reads are query-scoped to the tenant automatically, and every write is gated behind approval. Admin-only - there is no end-user self-service surface.
What Dex does with NetBird
Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.
For admins (Dex Pro)
- Browse peers, users, setup keys, groups, and access policies for a tenant
- Review networks, routes, DNS nameservers and settings, and posture checks
- Update or delete peers - with approval
- Invite, update (role, block state, auto-groups), or delete users - with approval
- Create, revoke, or delete setup keys - with approval
- Create, update, or delete groups, access policies, networks, routes, and posture checks - with approval
- Create or update DNS nameservers - with approval
- Deploy as an MSP global app - one shared PAT, each Dex tenant confined to its NetBird account id
Just ask Dex
Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.
Admin prompts
- >List the peers in this NetBird tenant and flag any that are offline
- >Show me the access policies for this account
- >Invite alex@example.com to this NetBird tenant as a regular user
- >Create a setup key for onboarding new laptops this week
- >Which posture checks are configured for this tenant?
Policy actions
Every action Dex can take on NetBird is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.
| Action | What it does |
|---|---|
netbird_list_tenants | List NetBird MSP tenants (MSP master connection only) |
netbird_list_peers | List peers for this NetBird account |
netbird_get_peer | Get one peer by id for this NetBird account |
netbird_list_users | List users for this NetBird account |
netbird_get_user | Get one user by id for this NetBird account |
netbird_list_setup_keys | List setup keys for this NetBird account |
netbird_get_setup_key | Get one setup key by id for this NetBird account |
netbird_list_groups | List groups for this NetBird account |
netbird_get_group | Get one group by id for this NetBird account |
netbird_list_policies | List access policies for this NetBird account |
netbird_get_policy | Get one access policy by id for this NetBird account |
netbird_list_networks | List networks for this NetBird account |
netbird_get_network | Get one network by id for this NetBird account |
netbird_list_routes | List routes for this NetBird account |
netbird_get_route | Get one route by id for this NetBird account |
netbird_list_dns_nameservers | List DNS nameservers for this NetBird account |
netbird_get_dns_nameserver | Get one DNS nameserver by id for this NetBird account |
netbird_get_dns_settings | Get DNS settings for this NetBird account |
netbird_list_posture_checks | List posture checks for this NetBird account |
netbird_get_posture_check | Get one posture check by id for this NetBird account |
netbird_update_peer | Update a NetBird peer in this tenant |
netbird_delete_peer | Delete a NetBird peer in this tenant |
netbird_invite_user | Invite a user to this NetBird tenant (grants network access) |
netbird_update_user | Update a NetBird user in this tenant (role, block state, auto-groups) |
netbird_delete_user | Delete a NetBird user in this tenant |
netbird_create_setup_key | Create a NetBird setup key in this tenant |
netbird_update_setup_key | Update or revoke a NetBird setup key in this tenant |
netbird_delete_setup_key | Delete a NetBird setup key in this tenant |
netbird_create_group | Create a NetBird group in this tenant |
netbird_update_group | Update a NetBird group in this tenant |
netbird_delete_group | Delete a NetBird group in this tenant |
netbird_create_policy | Create a NetBird access policy in this tenant |
netbird_update_policy | Update a NetBird access policy in this tenant |
netbird_delete_policy | Delete a NetBird access policy in this tenant |
netbird_create_network | Create a NetBird network in this tenant |
netbird_update_network | Update a NetBird network in this tenant |
netbird_delete_network | Delete a NetBird network in this tenant |
netbird_create_route | Create a NetBird route in this tenant |
netbird_update_route | Update a NetBird route in this tenant |
netbird_delete_route | Delete a NetBird route in this tenant |
netbird_create_dns_nameserver | Create a NetBird DNS nameserver in this tenant |
netbird_update_dns_nameserver | Update a NetBird DNS nameserver in this tenant |
netbird_delete_dns_nameserver | Delete a NetBird DNS nameserver (MSP master only) |
netbird_create_posture_check | Create a NetBird posture check in this tenant |
netbird_update_posture_check | Update a NetBird posture check in this tenant |
netbird_delete_posture_check | Delete a NetBird posture check in this tenant |
netbird_update_dns_settings | Update NetBird DNS settings (MSP master only) |
How to configure NetBird
Onboarding takes minutes. Dex validates your credentials before saving them.
Setup steps
- 1In NetBird, open Settings > Access Tokens and create a personal access token for a real MSP user (not a service user - service-user PATs do not honor cross-tenant account scoping).
- 2For writes, issue the token from a user with the admin or owner role on the MSP account; a user-role PAT can read but gets a 403 on every write.
- 3In Dex, enable the NetBird integration and paste the personal access token. Leave the account id blank on the MSP-master connection.
- 4Dex looks up each tenant's account id from GET /api/integrations/msp/tenants on the MSP master and saves it to that tenant's connection.
- 5Dex validates the credentials with a live read before saving. Reads are query-scoped to the tenant account automatically, and every write is gated behind approval.
Credentials required
- access_token
- NetBird personal access token for a real MSP user (secret; never surfaced)
- account
- This tenant's NetBird account id (opaque xid, e.g. ch8i4ug6lnn4g9hqv7m0); leave blank on the MSP-master connection
Requirements
- •A NetBird account with MSP features enabled and an MSP-master personal access token for a real user
- •Writes require the PAT user to have the admin or owner role; reads work with any real-user PAT
- •Service-user PATs do not honor cross-tenant account scoping - use a real-user PAT
- •Admin-only - NetBird is not available in Dex Go, so there is no end-user self-service surface
Related integrations
Security & BackupNordLayer
Manage NordLayer client organizations from Dex - roster, service plans, and license counts through the MSP Partner API.
Learn more →
Security & BackupCloudflare
Browse your Cloudflare Accounts, members, roles, and zones from Dex - read-only, with per-tenant isolation for MSPs.
Learn more →
Security & BackupCisco Duo
Administer Cisco Duo MFA across your managed subaccounts - users, groups, phones, enrollment, bypass codes, and authentication logs.
Learn more →
See Dex run NetBird
Book a 30-minute walkthrough with our team and see how autonomous IT works in your environment — or get started for free.