Skip to main content
Developers and partners often ask for their new IP address to be allowed on a client’s Azure resources, and each request means opening every database, vault and storage account in the portal. Connect Azure to Neo and an agent does it from the ticket: it finds each resource the ticket or your instructions name, adds the IP addresses, keeps every rule already there, and checks each address is allowed.
Neo calls Azure as an app registration you create in your own Microsoft Entra tenant. It can do only what the Azure roles you give that app allow, on the subscriptions and resources you choose.

What Neo can do with Azure

Add and remove IP rules

Read, add and remove IP allow rules on Azure SQL servers, PostgreSQL and MySQL flexible servers, Key Vaults, storage accounts and Analysis Services servers.

Keep existing rules

Key Vault, storage and Analysis Services keep every rule in one list. Neo keeps the rules already there and refuses a change that would drop one nobody asked to remove.

Find resources by name

Find each resource by its name in the client’s subscriptions, so your instructions can name resources the way your team does.

Check access

Read each resource again after the change and report, per resource and address, whether it was already allowed, added or not changed.
Neo does nothing else in Azure: no virtual machines, networks, roles or other settings. Need more? Request an integration and say what you want Neo to do in Azure.

Your clients’ subscriptions are mapped automatically

Neo suggests a company in your PSA for each Azure subscription your app can see, and lists the suggestions on the Microsoft Azure card’s Organization Mapping tab. It refreshes them when you save the credential, and again on each nightly PSA sync. A client often has several subscriptions (production, test), and each maps to the same company. The suggestion starts with the subscription’s Microsoft Entra tenant: when Neo already knows that tenant for a company (from your Microsoft 365 connection), that company comes first. Next comes the tenant’s default domain against the company’s website, then the tenant’s name, then an AI match. Confirm each suggestion on the tab before an agent uses the subscription. One Entra tenant often serves several of your PSA companies, and Azure does not say which company a subscription serves. Until you confirm it, an agent on a ticket asks a technician first: the approval card names the subscription and the ticket’s company, and approving it saves the match. A mapping you set by hand survives every later sync. On a ticket, an agent reaches only the subscriptions mapped to the ticket’s company.

Next steps

Connect Microsoft Azure

Create an app registration, give it a role limited to firewall rules, save it in Neo and turn it on per agent.