Skip to main content
The tool reaches your ControlUp organization through ControlUp’s platform API, with the API key you save in Neo, so each call is limited twice: by the permissions of the key’s user in ControlUp and by the agent’s permission groups below.
Automatically enabled when you configure ControlUp permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Read the trigger and the event behind a ControlUp alert ticket, and the machine it fired on
  • Read real-time metrics and history: machine load, logon times, session timelines, host metrics, Windows events
  • Add, update, move or remove the machines ControlUp for VDI monitors
  • Mute a machine’s alerts by moving it into your maintenance folder, and unmute it by moving it back
  • Switch a trigger or automation off and on, with a reason in ControlUp’s audit log, or create one
  • Work with ControlUp for Desktops, Compliance, Synthetic Monitoring, Workflows, DaaS IQ, users and tenants, with the access and approvals you choose
The agent calls the ControlUp API through the Vendor API tool, with controlup as the vendor id. Sandbox scripts can call ControlUp too, under the same permissions.

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write, except VDI Metrics & History, which is Read Only at most. Neo never downloads a master image’s RDP file or reads a streaming credential check, and removes secrets (a Scout’s MFA seed, webhook passwords and tokens, Azure credentials) from every answer.

​
Access Profiles

Every group Read Only. The agent reads, and never changes anything.
Every group Read/Write with technician approval, except VDI Metrics & History, Users, Roles & Access, Tenants, Blueprints & Tags, and DaaS Cloud Tenants & Credentials, which are Read Only.
Every group Read/Write without approval (VDI Metrics & History Read Only), except Users, Roles & Access, DaaS Cloud Tenants & Credentials and Compliance, which require technician approval.
Every group Read/Write without approval (VDI Metrics & History Read Only), except the change below.

​
Safety Controls

  • Deleting a DaaS IQ host pool from Azure requires technician approval under every access profile.
  • A write that acts on a list of devices, machines or issues must name at least one.
  • Neo never sends back a masked Azure secret, and fills the fields a DaaS IQ replacement leaves out from the stored record.