Skip to main content
The tool reaches your own Nerdio Manager for MSP through its REST API, with the REST API app you save in Neo, so each call is limited twice: by that app’s rights in Nerdio Manager and by the agent’s permission groups below.
Automatically enabled when you configure Nerdio Manager permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Find the client’s account, host pools and session hosts, and who is signed in where, with each session’s state and start time
  • Read each session host’s status, heartbeat, session count and drain mode, and start, stop or restart it
  • Log off a user’s stuck session with the log-off scripted action, or restart the host with a technician’s approval
  • Run Nerdio’s Detect Stale FSLogix File Handles scripted action and report the locked profiles, and read each host pool’s FSLogix settings
  • Run a scripted action in a client’s account, and read the task’s status and log
  • Read and change a host pool’s auto-scale, read its AVD, RDP and session time-out settings, and power desktop images on or off
  • Find a user and their MFA status, read an Intune device’s compliance and failed apps, and read backup and billing
The agent calls the Nerdio Manager API through the Vendor API tool, with nerdio as the vendor id. Sandbox scripts can call Nerdio Manager too, under the same permissions.

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write. Neo never reads the values of secure variables, never reads a device password or BitLocker key on a ticket, and never gives one to a sandbox script. Neo removes the fields Nerdio keeps credentials in from every answer.

​
Access Profiles

Every group Read Only, except Device Passwords & BitLocker Keys, which is Disabled. The agent reads, and never changes anything.
Session Hosts & User Sessions and Scripted Actions & Tasks are Read/Write with technician approval. Device Passwords & BitLocker Keys is Disabled. Everything else is Read Only.
Every group Read/Write. Accounts & Provisioning, Backup & Recovery, Networks, Storage & Variables, and Billing & Usage require technician approval, and so do the changes below.
Every group Read/Write without approval, except the changes below, which still require technician approval.

​
Safety Controls

These require technician approval under every access profile, whatever the group’s own approval setting:
  • Linking a new client tenant to Nerdio Manager, and granting a Nerdio role.
  • Restarting or stopping a session host, which signs out every user on it.
  • Deleting a host pool, which deletes its session hosts.
  • Turning a resource’s backup off, unlinking a recovery vault, and deleting a backup policy.
  • Creating, changing or deleting a secure variable, and replacing an app’s assignments.
  • Any change that sends a password, a secret, a token or a storage key, or hands a scripted action a secure variable.
On a ticket, the agent sends only calls in the account the ticket’s company maps to on the Organization Mapping tab. MSP-level calls, the account list and task reads are refused there; a chat with no ticket can make them.