Connecting Your Systems with Integrations

The Integrations Hub is where a tenant administrator connects GrndCtrl to the systems your team already uses, and controls exactly what each extension is allowed to do. This article covers connecting a source and approving access.

Developer-admin access required for most of this page

The Connected integrations and Audit tabs require the developer-admin role. The Composite tables tab is open to any tenant admin. If you are a tenant admin without the developer-admin role, Composite tables is the only tab you will see.

Before you begin

The Integrations Hub is admin-only, and it — plus any integration you connect — has to be enabled with your group granted access, after which you may need to sign out and back in. If the Hub is missing from your navigation, or you see “Access Denied,” start with Getting Access to Apps and Extensions.

What the Integrations Hub Is

Open Integrations Hub from the admin navigation. Its subtitle sums it up: “Connected integration extensions and tenant-defined composite tables.”

An integration is an extension that connects GrndCtrl to an outside system and publishes source tables your other extensions can use. Each integration’s display name comes from the integration itself — for example Google Sheets or Microsoft Graph. As new integrations are installed, they appear here the same way.

GrndCtrl Services

The platform’s own built-in services appear as a pinned GrndCtrl Services entry at the top of the list. That’s where platform features, such as directory sync and photos, request access.

The Three Tabs

Tab	What it’s for
Connected integrations	Installed integrations, their credentials, and which extensions may use them. Developer-admin only.
Audit	A read-only record of what’s allowed, plus the daily conformance findings, with revoke controls. Developer-admin only.
Composite tables	Tenant-defined joins and aggregations over your sources. Any tenant admin — covered in its own article.

Connecting a Source (Credentials)

Select an integration from the left rail. Its page opens on a row of tabs — Credentials, Synced data, Key columns, Consumers, and Settings. Start with Credentials. This is how the integration authenticates to the outside system, and what you see depends on the integration:

• Publisher-supplied (for example, Google Sheets). The credential is provisioned automatically, and the tab reads “there is nothing to create or edit here.” You’ll see the credential listed with the scopes it uses, and you connect your own account through it. Needing separate credentials is a conversation with the publisher, not a setting.
• Tenant-connected. Other integrations let you add your own credential: click Add credential, name it (for example primary), fill in the connection fields it asks for, save, then click Verify to confirm the connection and record its real scopes.

Lower on the same tab, Operations this integration serves lists what the integration can do and which credential each operation uses. The default, “Not set — resolved automatically,” only resolves when exactly one of your credentials fits the operation. If two or more could, it cannot choose and the calls fail — “automatic resolution cannot choose between them and calls will fail. Pick one.” Who may call those operations is approved separately, on the Consumers tab below.

A credential grants nothing on its own

It is just a connection. Nothing runs until you approve who may use it on the Consumers tab.

Synced Data and Key Columns

Between Credentials and Consumers sit two read-only tabs that help you before you build anything on an integration.

Synced data shows “what this integration is returning right now, so you can see the shape before you build a composite on it.” Search the rows and toggle Compact / Full text. It’s how you sanity-check the actual data first.

Key columns are “columns you can join and group by in composite tables. Each one is indexed, so there is a fixed number available per worksheet.” Pick a worksheet and set up the keys you’ll later join or group on. The tab tracks how many are set up — for example, “2 of 8.”

Approving What an Extension Can Do (Consumers)

Open the integration’s Consumers tab, titled “Extensions using this integration.” A consumer — another extension, or a platform service — first declares that it wants to use this integration in its own manifest; it then appears here for your approval. Until one does, the tab reads “Nothing has declared it uses [this integration] yet.” When a consumer appears, this is where you approve, one by one, what it may do. Nothing it requests runs until you approve it here.

Each capability the integration offers is an operation with a direction:

• read — Reads data out of the source.
• write — Writes data back to a target.
• action — Performs an action, for example sending something.

1. Find the consumer’s card and click Approve on the specific operation it needs.
2. For read access you can choose “Only the operations approved below” or the blanket “All read operations — including ones added later.” Write and action operations are always approved individually, never by the blanket.
3. Optionally set the Credential that serves this consumer. The default is “Not set — resolved automatically,” which resolves only when exactly one credential fits; if several could, pick one explicitly or the call fails.
4. If an operation takes parameters, set its Resource patterns to scope exactly what it can touch (for example /users/*/calendar/*). The editor explains the syntax: “These patterns are the wall around what this operation may reach — every call is checked against them. * matches one path segment, ** any remainder. No patterns = reads nothing.”
5. Watch the inline summary beside the operation. It reads Resource scope followed by a pattern count, or “no patterns — reads nothing” in red when the operation is scoped to nothing at all.

Approve the least you can

Start with only the operations an extension truly needs and the narrowest credential. You can always add more later.

The Audit Tab: Findings, Sync Health, and Alerts

The Audit tab is the tenant’s operational record. Approvals aren’t managed here — they live on each integration’s page — and the only action on this tab takes access away. It is a left rail (audit findings, then all-integrations sync history, then one entry per integration) with a Run the audit now button and a Refresh, and it covers four things:

• Audit findings — What the daily credential-conformance audit found: traffic that resolved a credential outside the instance model. It runs daily, or on demand, and a finding clears once its traffic ages out of the window.
• Sync history — Every sync across every integration, with a health strip. This is your main “did it run?” view, and the one place to spot an integration that quietly stopped syncing.
• What went wrong — Refused calls and failed rows, kept until you deal with them, unlike the history, which ages out.
• Alerting — Who gets emailed when a sync fails, a Teams webhook, and per-integration mute. Worth setting up so failures don’t pass silently.

Looking for “Approved services”?

Platform features such as directory sync and Teams notifications are approved on the Connected integrations tab under the pinned GrndCtrl Services entry — not on the Audit tab. The switch for where your directory and profile photos come from lives in Administration → GrndCtrl Access.

Where an Integration Shows Up in Quote Generator

Two connected sources change how a quote starts. With Salesforce connected, + New Quote offers Select a Salesforce opportunity under Start from: the customer, the site, and the contact come across from the opportunity, so the customer step becomes a check of the contact order rather than data entry. With Dynamics 365 connected, the catalog comes from the synced tables, and a quote started from Upload Documents binds its extracted lines against it and checks them against the customer’s approved-manufacturer list. Both flows are described in Creating Quotes with Quote Generator; the connections themselves are made here, in the Integrations Hub.

Troubleshooting

Calls fail and the integration looks connected

Solutions:

• Check for more than one credential that could serve the same operation. When two are equally valid, “automatic resolution cannot choose between them and calls will fail. Pick one.”
• Check the operation’s Resource scope. If it reads “no patterns — reads nothing”, the operation is approved but scoped to nothing, so every call is refused.

The Consumers list is empty

Solutions:

• “Nothing has declared it uses [this integration] yet.” is normal for a new connection — an extension has to declare the integration before it appears here.
• If an extension should be using it, confirm the extension is enabled and that its own configuration points at this integration.

An extension is reading stale or missing data

Solutions:

• Look at the integration’s synced data to see what it is actually returning right now, rather than assuming the shape you expect.
• Check the Audit tab for sync health and any alerts — a source system can stop returning data without the connection appearing broken.
• Only key columns can be joined and grouped on, and there is a fixed number available. If a column you need is not one, it cannot be used that way.

Related Articles

• Composite Tables: Combining Your Data — Join and roll up your synced sources into governed tables
• Getting Access to Apps and Extensions — Start here if the Hub is missing or you see “Access Denied”
• Administration — Users, groups, extensions, and GrndCtrl Access