Skip to main content
An agent with this tool works IP allow requests in the client’s own Azure subscriptions: it finds each resource by name, adds the IP addresses the ticket asks for, keeps every rule already there, and checks each address is allowed.
Automatically enabled when you configure Microsoft Azure permissions in your agent workflow. No manual toggle needed.

What It Does

  • Find the client’s subscriptions from the Organization Mapping, and its resources by name
  • Read, add and remove IP allow rules on Azure SQL servers, PostgreSQL and MySQL flexible servers, Key Vaults, storage accounts and Analysis Services servers
  • Read each resource again and report, per resource and address, whether it was already allowed, added or not changed
The agent calls Azure through the Vendor API tool, with azure_resource_manager as the vendor id. Sandbox scripts can call Azure too, under the same permissions. Neo does nothing else in Azure, and the agent sees only the fields this job needs: names, types, rules and their state. To have Neo do more in Azure, request an integration.

Permission Groups

Access Profiles

Find resources and read their IP allow rules.
Read / Write; each change after a technician approves.
Read / Write; each change after a technician approves, because an allow rule opens a resource.
Read / Write with no approval, except a wide rule.

Always asks

A change whose rules allow more than 256 addresses together (more than a /24), or a rule that holds 0.0.0.0 (SQL’s “allow Azure services”), always waits for a technician’s approval, whatever the profile.

Rules already there are kept

Key Vault, storage and Analysis Services keep every IP rule in one list that a change replaces whole. Before such a change Neo reads the resource, keeps every other network setting (such as the default action and subnet rules), and refuses a change that would drop a rule the agent did not name for removal.

On a ticket

On a ticket, every call is in one of the subscriptions mapped to the ticket’s company, and the subscription list is not sent. With no ticket company (a chat, or a scheduled agent with no ticket), the agent reaches every subscription the app can see.