CrowdStrike Integration Guide – Deel

Crowdstrike Integration Guide

Connect your CrowdStrike instance to Deel to view endpoint insights directly from your Deel account, and take actions on detections and devices. This guide walks you through the integration setup and answers the most common questions and blockers.

About the CrowdStrike Integration

CrowdStrike Falcon is a cloud-native endpoint security platform. By connecting it to Deel, you can view endpoint protection insights and status directly from your Deel platform, without switching between platforms.

To access your CrowdStrike insights from within Deel, you need a paid Deel IT subscription with Endpoint Protection enabled, and an Endpoint Protection contract purchased through Deel.

If you already have a CrowdStrike subscription, contact Deel IT sales to understand the steps needed to transfer your CrowdStrike account under Deel and benefit from a consolidated platform experience.

How to Connect CrowdStrike

To connect your CrowdStrike instance to Deel, you'll need your Client ID and Client Secret from CrowdStrike, plus the required API scopes. You also need write access in your Deel account.

Step 1: Generate your CrowdStrike credentials

Log in to your CrowdStrike Falcon console as an administrator.
In the sidebar, go to Support > API Clients and Keys.
Click Add new API client (top right corner).
In the OAuth2 API clients section, name the client (for example, Deel) and select the required scopes listed below.
Click Add (or Create). Copy your Client ID, Client Secret, and Base URL immediately and store them securely. The Client Secret appears one time only.

Required CrowdStrike API scopes

Detections:read: Overview dashboard, Recent detections grid, and AI investigation input.
Alerts:read: alert data shown on the dashboard and in the detection details.
Hosts:read: Device Management tab and device metadata.
Host groups:read: device group information, as configured in your CrowdStrike instance.
Sensor Download: downloading the Falcon sensor installer, and showing your Customer ID on the Settings tab.
Alerts:write: taking action on alerts, such as closing or reopening an alert and updating detection status and resolution.
Hosts:write: containing or lifting containment on a device.

If your API client was created without Alerts:write and Hosts:write, the action buttons fail with a permissions error until you regenerate your credentials with those scopes and reconnect.

Step 2: Connect with Deel

Log in to your Deel account.
Go to Apps > Connectors, or search for CrowdStrike. You can also go to Apps and Automation > App Marketplace, or to IT > Endpoint Protection. CrowdStrike is also accessible from the Endpoint Protection page in the Deel IT section.
Click Connect in the upper right corner.

Select the region of your CrowdStrike instance. Most instances are in EU1. If you are not sure, check the region in your CrowdStrike console or ask Deel IT Support. Selecting the wrong region returns an error, and the integration is not made.
Enter your CrowdStrike Client ID and Client Secret.
Click Connect to complete the integration.

It might take some minutes for the integration to be confirmed. Once it is, your CrowdStrike dashboard appears within moments.

Important

Endpoint Protection powered by CrowdStrike Falcon is available only if your license was bought through Deel, or you transferred it to us. For more details about the feature, capabilities, and pricing, see the Endpoint Management On-Platform article.

How to Disconnect Your CrowdStrike

If you need to disconnect your CrowdStrike instance from Deel or reconnect with new credentials:

Log in to your Deel account.
Go to Apps.
Find CrowdStrike in your connected apps section (the widget above the Apps list).
Click the three-dot menu next to CrowdStrike.
Select Disconnect or Reconnect.

Note

If you reconnect, you'll need to generate and provide new Client ID and Client Secret credentials.

To update credentials that have expired or been revoked during your contract:

Generate new API credentials in the CrowdStrike console.
In Deel, turn the CrowdStrike integration off.
Turn it back on with the new credentials.
Sync resumes automatically.

Frequently Asked Questions

Do I need a specific CrowdStrike plan to use this integration?

You need an active CrowdStrike Falcon account with API access on the Pro or Enterprise plan. You'll also need a paid Deel IT plan with Endpoint Protection enabled. Falcon Go is not supported. Reach out to your Deel account team for pricing and plan options.

What happens to my data after I disconnect?

Your CrowdStrike insights will no longer appear in Deel. The integration is removed, but your Deel account and CrowdStrike instance remain intact. You keep all data in your CrowdStrike account, and Deel does not store your CrowdStrike data.

What if I get an error during connection?

Common issues include incorrect credentials, permissions, or missing API scopes in CrowdStrike.

Double-check that:

Your Client ID and Client Secret are correct and have not expired.
The region you selected matches your CrowdStrike instance.
The user connecting has Edit permissions in Deel.
Your API client includes all required scopes: Detections:read, alerts:read, hosts:read, host groups:read, Sensor Download, Alerts:write, and Hosts:write. These scopes are selected when you generate the API credentials in CrowdStrike.

If the issue persists, contact Deel support.

I've connected, but Endpoint Protection isn't showing. What should I check?

Make sure your Endpoint Protection contract is active and your CrowdStrike license was purchased through Deel or transferred to us. Only Falcon Pro and Enterprise are supported.

All of my widgets are blank or showing errors. What should I do?

Check CrowdStrike's status page for an outage. If CrowdStrike is operating normally, check that the integration is enabled and that your credentials have not expired.

My action buttons return a permissions error. What should I do?

Your API client needs Alerts:write and Hosts:write. Regenerate your credentials with those scopes, then reconnect (see Step 1).

How often is my data synced?

Data syncs in typically within a few minutes. The initial sync happens immediately upon connection, and updates typically appear in Deel every few minutes.

What region should I select?

Most instances are in EU1. If you are not sure, check the region in your CrowdStrike console or ask Deel IT Support. If you select the wrong region, an error is displayed, and the integration is not made.

Is my data secure when using this integration?

Yes. Deel uses OAuth authentication with API scopes to ensure secure, limited access to your CrowdStrike instance. Your credentials are encrypted and stored securely. The integration follows SOC 2 Type II and ISO 27001 compliance standards. More information is available in our Trust Center.

In This Article