How connectors work
Every integration in Plugboard is a connector. The application never depends on Jamf, or Synergetic, or Zendesk. It depends on a capability, and a connector declares which capabilities it implements.
That is why a school running Intune and one running Jamf use the same repairs screen, and why swapping an MDM is a configuration change rather than a project.
The three words
Section titled “The three words”Capability. A named operation the platform can ask for:
device.lookupBySerial, sis.getRoster, email.send. Full list in
capabilities.
Connector. A definition: a category, an authentication kind, a configuration form, a secret form, and the capabilities it implements.
Connector instance. A connector you have configured, with your URL and your credentials. Credentials are encrypted before they touch the database.
When a feature needs something done it asks for a capability. The platform finds an enabled instance implementing it and calls the handler. If there is no such instance, the feature says so plainly rather than failing obscurely.
The catalogue
Section titled “The catalogue”Twenty-six connectors ship in the box.
Device management (MDM)
Section titled “Device management (MDM)”| Connector | Auth | Notes |
|---|---|---|
| Jamf Pro | OAuth client credentials | The most capable. Supports smart group pull for loan pools |
| Microsoft Intune | OAuth client credentials | Via Microsoft Graph |
| Kandji | API token | |
| Mosyle | API token | Manager and Business. Common in Apple-heavy schools |
| Chrome Enterprise | Service account | Chromebooks, via the Google Admin SDK |
| Mock MDM | Any | For demos and tests |
Student information (SIS)
Section titled “Student information (SIS)”| Connector | Auth | Notes |
|---|---|---|
| Synergetic | API token | Common in independent schools. Reaches a private network |
| Sentral | API key plus tenant key | Widespread in New South Wales |
| Compass Education | Service account credentials | Dominant in Victoria |
Identity and directory
Section titled “Identity and directory”| Connector | Auth | Notes |
|---|---|---|
| LDAP and Active Directory | Bind account | Authenticate, look up, reset passwords. Reaches a private network |
| Directory management | Client credentials | Licences, lock, inbox delegation, password reset |
Email and SMS
Section titled “Email and SMS”| Connector | Auth | Notes |
|---|---|---|
| SMTP | Username and password | Any SMTP server. The simplest option |
| Google Workspace | Service account | Sends via the Gmail API with delegation |
| Console email | None | Logs instead of sending. Development only |
| Twilio | Account SID and auth token | SMS |
Ticketing
Section titled “Ticketing”| Connector | Auth | Notes |
|---|---|---|
| Zendesk | API token | Create, comment on and close tickets |
| Web Help Desk | API key | SolarWinds. Reaches a private network |
Warranty and repair vendors
Section titled “Warranty and repair vendors”| Connector | Auth | Notes |
|---|---|---|
| Apple GSX | API token | Warranty and AppleCare coverage |
| Dell warranty | Client credentials | Entitlement by service tag |
| CompNow | API token | Lodge external repairs and sync status |
Printing
Section titled “Printing”| Connector | Auth | Notes |
|---|---|---|
| Printers over SNMP | None | Toner, status and errors. Reaches a private network |
| PaperCut | Auth token | Balances, page counts, and writing the tap card. Reaches a private network |
Everything else
Section titled “Everything else”| Connector | Category | Notes |
|---|---|---|
| ThreatLocker | Security | Endpoint allowlisting approvals |
| Salesforce | CRM | Accounts, contacts and cases |
| Google Sheets | Spreadsheet | Induction roster import |
| Ollama | AI | The assistant, on a model you host |
| Stripe | Billing | Subscriptions and metered billing |
Choosing between connectors that overlap
Section titled “Choosing between connectors that overlap”More than one MDM. You can configure several, and a device resolves through whichever one knows it. That is genuinely useful in a mixed fleet: Jamf for Macs, Intune for Windows, Chrome Enterprise for Chromebooks.
More than one SIS. Unusual, but supported. Rosters merge and people are de-duplicated.
Email. Pick one. SMTP is simpler and works with anything. Google Workspace sends as a real mailbox in your domain, which some schools prefer for deliverability.
Ticketing. If you already run Zendesk or Web Help Desk, connect it and switch
off the built-in module.tickets. Running both queues means work gets lost
between them.
Demo mode
Section titled “Demo mode”Most connectors have a demo mode that returns realistic fictional data instead of calling the real system.
Turn it on to see a feature work before credentials arrive, then turn it off. Leaving it on in production is the most common configuration mistake in the product. The compliance page counts connectors still in demo mode, precisely so it gets noticed.
Connectors that need a private network
Section titled “Connectors that need a private network”Some connectors talk to something that normally lives inside a school network: Active Directory, a Synergetic SQL Server, PaperCut, a printer answering SNMP, Web Help Desk.
A self-hosted install on that network reaches them directly and needs nothing extra.
A managed deployment cannot, and uses a connector agent: a small program installed inside your network which dials out, collects queued work and returns results. No inbound firewall rule.
Note the framing: whether an agent is needed depends on where the deployment runs, not on the connector.
Security
Section titled “Security”Connector credentials are protected with envelope encryption. They are encrypted before they reach the database and decrypted in memory only for the duration of a call. A connector handler never gets database access; it returns data and the platform decides what to persist.
The master key is SECRETS_MASTER_KEY. See secrets and
keys.
- Configuring a connector for the mechanics.
- Connector agents if you are hosted and need private systems.
- Getting one built if the system you run is not in the catalogue.