Skip to main content
The Generate Password tool allows Neo Agent to create secure, random passwords that meet complexity requirements.

​
What It Does

When enabled, the agent can:
  • Generate cryptographically secure passwords
  • Meet standard complexity requirements
  • Provide passwords for use in other operations

​
How to Use

This tool is typically used in conjunction with:
  • Reset Password — to set new passwords in M365
  • Create User in Entra ID — to set initial passwords
  • Generate Secure Link — to securely share the password

​
Password Redaction in the Run History

A password generated by this tool is redacted from the run history — the steps Neo Agent records for that run, and the run’s own closing message on Event History. The agent still works with the real value — a password reset cannot happen without it — but the stored copy shows ***MASKED*** in its place. This covers the places a password used to become readable after the fact:
  • The password field in the tool’s own result.
  • A password written into a script the agent runs, such as the Set-ADAccountPassword command in an on-premises Active Directory reset.
  • A password a script prints in its own output.
  • A password the agent mentions in its own reasoning step, both while the step streams and in the final saved version of it.
  • A password the agent quotes in the message it reports back at the end of the run.
The same redaction applies to a password created by the Reset Password tool. This redaction matches the exact value Neo Agent generated, so it is complete for a password these two tools produced. A password the agent writes itself, which Neo Agent never held as a value, is covered instead by the script-literal redaction in the audit log, and that one reads the script rather than a known value. So keep passwords out of script output — the Writing PowerShell skill instructs the agent to return a status instead of printing one. Redaction covers the run history, not the ticket. Deliver the password to the person with Generate Secure Link and put only the link in a ticket note — a password typed into a note is stored by your PSA, where Neo Agent cannot redact it.

​
Do Not Ask the Agent To Make the Password Inside a Script

Agent instructions sometimes tell the agent to skip this tool and let the reset script invent the temporary password itself. That cannot work alongside delivering the password: the value then exists only on the machine that ran the script, so either nobody can tell the user their new password, or the script has to print it and the secret lands unredacted in the run history. Value masking covers only a password Neo Agent generated, and the script-literal redaction reads the script’s text rather than what the script printed. From there anyone can copy it into a ticket note. Let the agent call Generate Password first and pass that value into the script. The value is then masked by value in the run history, and Generate Secure Link has something to deliver. Your instructions still decide how the password reaches the person — which channel, which note, whether a secure link is allowed at all.