Skip to main content
The tool reaches a client’s own Parallels RAS farm through its REST API, signed in as the RAS administrator you save in Neo for that client, so each call is limited twice: by that administrator’s permissions in RAS and by the agent’s permission groups below.
Automatically enabled when you configure Parallels RAS permissions in your agent workflow. No manual toggle needed.

​
What It Does

  • Read the state of each site, Connection Broker, Secure Gateway and session host, with load, sessions and agent state
  • Read licence use: licensed users, users connected now, the peak and the expiry date
  • Drain an RD Session Host, drain it until reboot, disable or enable logons
  • Find a user’s session, message the user, disconnect the session or log it off
  • Publish an application or desktop, choose who sees it, disable it or unpublish it
  • Manage host pools, templates, client policies, gateways and farm settings, with the access and approvals you choose
The agent calls the RAS REST API through the Vendor API tool, with parallels_ras as the vendor id and the client’s PSA company id. Sandbox scripts can call Parallels RAS too, under the same permissions. After each change, Neo applies the farm settings, so the change is live when the call returns.

​
Permission Groups

Every group can be Disabled, Read Only or Read/Write. Neo never sends these calls: logging on or off (Neo signs in with the connection’s administrator), exporting or importing the farm configuration, downloading the system report, uploading a private key or a PFX file, and the MFA connection check. Neo removes the fields RAS keeps credentials in from every answer.

​
Access Profiles

Every group Read Only. The agent reads, and never changes anything.
Session Hosts & Pools, User Sessions and Published Resources are Read/Write with technician approval. Everything else is Read Only.
Every group Read/Write. Farm, Sites & Servers and Administrators & Authentication require technician approval, and so do the changes below.
Every group Read/Write without approval, except the changes below, which still require technician approval.

​
Safety Controls

These require technician approval under every access profile, whatever the group’s own approval setting:
  • Deleting a site, a server, a provider, a session host, a host pool, a template, an AVD workspace, a VDI host, a tenant, a certificate or a RAS agent.
  • A reboot, shutdown, stop, reset or restart, and recreating hosts or desktops.
  • Creating a reboot, shutdown or disable schedule, changing any schedule, adding a host to one, and changing the auto-upgrade settings.
  • Activating or deactivating the RAS licence, and promoting a site or a Connection Broker.
  • Sending a support request or a system report to Parallels.
  • Joining or leaving a tenant broker, and making a new tenant join hash or invitation.
  • Changing the Web Administration Service settings.
  • Any change to administrators, administrator sessions, multi-factor authentication or authentication.
  • Any change that stores a credential.