CrowdStrike Marketplace and Integrations: RMM, PSA, ITSM and Identity Apps Compared

The CrowdStrike Marketplace is where Falcon customers find the integrations that connect the sensor to the rest of the stack, and where a growing share of them buy those tools on the CrowdStrike invoice. This guide explains how the Marketplace works as a procurement channel, then goes vendor by vendor through the integrations IT teams and MSPs ask about: NinjaOne, ConnectWise, ServiceNow, Intune, Jamf, Zscaler, Automox, Action1, JumpCloud and Okta. Every claim below comes from a listing or vendor document read in November 2026, so you can check it against the page before you sign anything.

TL;DR

What the CrowdStrike Marketplace Is

CrowdStrike unveiled the Marketplace at Fal.Con on 18 September 2023 with ten inaugural partners: Armis, Claroty, Elevate Security, ExtraHop, Google VirusTotal, Lookout, JumpCloud, Okta, Tines and X-Analytics. A year later the company said it had grown to more than 260 listings from 140 partners, and that CDW, GuidePoint Security, Optiv and World Wide Technology had joined the Private Offer program so a reseller can sit inside a Marketplace deal. The figures come from CrowdStrike's October 2024 expansion release; the company has not published a newer count.

It is three things at once. First, a catalog of integrations that CrowdStrike says are "screened, trusted, and validated to work with" the Falcon platform. Second, a procurement route: a Falcon customer can buy a listed third-party product through their CrowdStrike account and receive one consolidated invoice. Third, an incentive: CrowdCredits, a discount currency CrowdStrike grants to selected customers for third-party purchases made through the Marketplace.

Each listing follows the same shape. A "Built by" field tells you whether the partner or CrowdStrike wrote the integration, a Categories field places it in one of 14 buckets (Endpoint Security, Identity Security, IT and Security Operations, Next-Gen SIEM & SOAR and so on), and a Requirements field names the Falcon modules you must already own for it to work. Support contacts and a data sheet sit underneath. Prices do not appear on any listing we read; a "Buy on CrowdStrike Marketplace" label marks the ones that can be purchased through CrowdStrike, and filters separate "Available for Purchase", "Available for Trial" and "Free".

How Buying Through the Marketplace Works

The purchase path is a Private Offer, not a checkout. You browse, run a partner-guided proof of value, discuss pricing and CrowdCredits with your CrowdStrike representative, sign the offer and receive the licence. CrowdStrike's own FAQ says trials of 15, 30 or 90 days depend on the partner, that apps can provision a free trial inside the Falcon console while integrations do not, and that a representative replies within 48 hours to a trial request.

CrowdCredits are worth reading the terms on before you count them in a budget. Under the published CrowdCredit terms, one credit equals one US dollar, credits apply only to eligible third-party products bought through the Marketplace and never to CrowdStrike's own modules, the discount is capped at 5% of fees for an initial term and 3% for a renewal, unused credits expire one year after issue, public sector buyers are excluded, and CrowdStrike awards them at its own discretion. A renewal of a product you originally bought outside the Marketplace counts as a renewal, so the 3% cap applies.

Two things the Marketplace pages do not say, and your rep should. Nothing on the listings explains how a Marketplace purchase interacts with a Falcon Flex commitment, the drawdown contract CrowdStrike uses for larger accounts, so ask whether third-party spend draws from the same pool. And because prices are not listed, the comparison you need, the Marketplace price against the vendor's direct price, only exists once you have both quotes in hand.

The Integrations IT Teams and MSPs Ask About

The table below records what we found for each vendor on the Marketplace in November 2026. "Built by" is the Marketplace field; "no listing" means the vendor did not appear in the Marketplace's own Built By filter and no listing page resolved.

A detail that settles a common search: "Zscaler vs CrowdStrike" is mostly an integration question, not a bake-off. The two sell different layers, Zscaler's Internet Access and Private Access on the network edge and Falcon on the endpoint, and the six Zscaler listings exist because customers run both. If you were weighing them as substitutes, stop; the useful question is which Falcon module the response actions require (Insight XDR) and whether you own it.

What the Integrations Do in Practice

Read the table by mechanism rather than by vendor and four patterns appear. The first is sensor lifecycle, which only the RMM integrations do: NinjaOne's agent checks for an existing Falcon sensor, reads its ID, installs it if missing, and surfaces quarantined detections next to the device. NinjaOne's own FAQ, updated 13 October 2026, carries the limits: no Linux support in the integration (a CID token install is the workaround), the unified installer from sensor 7.19 only in the NA, US2 and EU regions with GovCloud on a different binary, on-access scanning only with no full disk scan. Read the NinjaOne CrowdStrike FAQ before promising a client Linux coverage through the RMM.

The second is detection to action, and almost all of it runs on Falcon Fusion, CrowdStrike's workflow engine. The ServiceNow ticket actions, the Zendesk actions, the Zscaler user-isolation actions and the Jamf repair pack are all "built by CrowdStrike" and all require either Next-Gen SIEM or Insight XDR. That requirement is the cost line to watch: a Falcon Pro customer who wants detections to open ServiceNow tickets through the listed integration is looking at a module upgrade, not a free connector. A ServiceNow community thread from 2026 also reports the CrowdStrike security-incident integration disabling itself on API rate-limit errors, which is the kind of operational detail a data sheet never carries. CrowdStrike's own demo of the Fusion SOAR content library, published in April 2025, shows the mechanism end to end: a third-party integration is picked from the library and its actions run from the Workbench, which is what every listing marked Next-Gen SIEM or Insight XDR in the table above is doing.

The third is findings to patch, and most of it lives outside the Marketplace. Automox and Action1 both read Falcon Spotlight through the API rather than through a listing. The Automox Worklet is explicit about what it does: it fetches the latest scheduled vulnerability report, splits the CVEs into "patchable" and "unmatched", waits for an operator to click Run unless you set automated remediation on, and never forces a reboot. Action1 announced its Spotlight correlation at RSAC 2026 and publishes the PowerShell on GitHub. Our IT automation software roundup covers where each of those tools fits.

Falcon for IT's own risk-based patching now competes with both inside the console, which is why the patch vendors position on asset discovery and third-party catalog depth. The Falcon for IT review covers that module on its own.

The fourth is posture to access. Okta, JumpCloud and the Intune path all consume the same signal, Falcon's Zero Trust Assessment score and agent status, and enforce it in their own access layer. JumpCloud's listing gives the clearest wording: block users on outdated OS versions, gate access by ZTA score, or deny entry the moment a Falcon agent goes inactive. Per Microsoft's Intune documentation, the CrowdStrike path there is mobile only: Falcon for Mobile risk feeds an Intune compliance rule, and Conditional Access blocks a noncompliant phone from Exchange Online and SharePoint Online.

Gaps a Buyer Should Check

Start with the Requirements field on every listing you care about, because that is where the real price hides. Count how many of your shortlisted integrations say Next-Gen SIEM or Insight XDR, then price the bundle that includes them. The CrowdStrike Falcon review for MSPs lays out which modules sit in Go, Pro, Enterprise and Complete, which is the map you need to read that column.

Then check who owns the tenant when you buy Falcon bundled through an RMM vendor. NinjaOne's listing advertises Falcon products, including the Falcon Defend bundle, through NinjaOne's single-source billing, which is convenient on the invoice and worth understanding on the contract. In December 2025 an MSP on r/msp reported signing for RMM plus CrowdStrike and waiting 21 days with no CrowdStrike delivered and no onboarding contact, then in a February 2026 follow-up said the refund for the CrowdStrike line was tied to re-signing a new one-year agreement. Whatever the outcome of that one account, the lesson generalises: get the delivery date, the refund terms and the Falcon tenant ownership in writing before the bundle goes on one bill.

Three smaller checks close the list. Trials: integrations do not provision an immediate trial, apps do, so a "try before you buy" plan for a SOAR-actions listing means a partner-led proof of value, not a toggle. Direction: most listings move data one way, Falcon out to the tool, so if you need the tool to push back into Falcon (a ticket closure that resolves a detection, say) confirm it in the data sheet. And ownership of the workflow: a ticket opened by a Fusion workflow lands in whichever PSA you run, and the PSA software comparison is where to check which of them exposes an API the workflow can reach. Teams running an open RMM and PSA such as OpenFrame wire Falcon detections into tickets through the Falcon API, the same path the listed vendors use.

The short answer: treat the Marketplace as a validated catalog with a procurement wrapper, read the Requirements field before the feature bullets, and buy the bundle through whichever channel gives you the tenant in your own name. The integrations are good; the module they require is the number on the invoice.