> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting ControlUp to Neo > Save a ControlUp API key and your organization ID in Neo ## Before you start * Neo uses ControlUp's platform API at `api.controlup.com`, the one ControlUp's VDI & DaaS, Desktops, Compliance and Synthetic Monitoring products share. Your Monitor and console stay where they are. * A ControlUp API key carries the permissions of the user who makes it, and only the permissions given to that user directly: a permission that comes through an SSO group does not reach the API. Make the key as a user with the permissions your agents need, or create a ControlUp user for Neo. ## 1. Create an API key **1. Open API Key Management** In ControlUp, click your profile icon in the top-right corner and select **API Key Management**. **2. Create the key** Click **+ Create new**, choose how long the key lasts, and copy the key. Copy the **Organization ID** shown on the same page too. > [!WARNING] > > When the key reaches the end of its duration, or its user is disabled or deleted, Neo loses access until you save a new key here. ## 2. Add the key in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **ControlUp**](https://dashboard.neoagent.io/integrations?open=controlup), under Servers & Virtualization. **2. Save the key and the organization ID** Paste the API key and the Organization ID, then click **Save settings**. Neo reads your organization's tags with the key before saving, so a wrong key or organization ID is rejected straight away. ## 3. Make a maintenance folder (for muting) To let Neo mute a machine's alerts, create a folder such as `Maintenance` in the ControlUp console, in the place your folders allow, and exclude it from your triggers' scope. Neo can add it to each trigger's excluded folders for you; it cannot create a folder, because ControlUp's API does not. ## 4. Turn ControlUp on per agent Open the agent, go to the Integrations section, and configure the ControlUp block. Agents can do only what the key's user may do in ControlUp. ### Pick an access profile > [card] Read Only > > Read alerts, statistics, machines, triggers, devices and settings. Nothing is changed. > [card] Helpdesk > > Changes to machines, triggers, devices, sessions and DaaS wait on a technician. Users, roles, tenants and Azure credentials stay read only. > [card] IT Admin > > Machines, triggers, devices, sessions and DaaS change without approval. Users and access, Azure credentials and Compliance exceptions wait on a technician. > [card] Full Automation > > Every change runs without approval, except deleting a host pool from Azure. ### Or set each area by hand | Area | Notes | | - | - | | **VDI Machines** | The machines ControlUp for VDI monitors: add, update, move to another folder (how Neo mutes a machine) or remove. | | **VDI Triggers & Automations** | Triggers and the scripts and schedules they use: create, edit, switch on or off, delete. | | **VDI Metrics & History** | Real-time metrics and history: machines, hosts, sessions, logons, processes, applications, NetScaler, Windows events. Read only. | | **Desktops Devices** | ControlUp for Desktops devices, their groups and tags; delete devices. | | **Desktops Device Actions** | Reboot, run a script or command, end a process, log off or disconnect a user, send a message. | | **Desktops Alerts & Events** | Desktops alert rules and the system events log. | | **Desktops Data & Reports** | Data indices and custom reports. | | **Desktops User Surveys** | End-user surveys and their answers; publishing sends a survey to users. | | **Platform Alerts & Events** | Alerts that fired across products, and the platform's Devices and Synthetic alert rules. | | **Synthetic Monitoring** | Scouts, tests, alerts and alert policies; pause and resume a Scout. | | **Compliance** | Devices, apps, CVEs, patches, issues and templates; custom issues and overwrite rules. | | **Compliance Remediation** | Remediation jobs that patch or fix issues on devices, and their progress. | | **Workflows** | ControlUp Workflows flows, forms and integrations; switch a flow on or off. | | **Users, Roles & Access** | Users, invitations, roles, SSO groups, SAML, IP allowlist, settings, audit log, license usage. | | **Tenants, Blueprints & Tags** | Tenant organizations under a Tenant Manager, Blueprints and their runs, tags. | | **DaaS Host Pools & Images** | DaaS IQ host pools, session hosts, master images, scaling, subscriptions, costs and jobs. | | **DaaS Sessions** | User sessions and session host actions such as drain mode and sign out. | | **DaaS Cloud Tenants & Credentials** | Cloud tenants and their Azure credentials (masked). | Each area can be Disabled, Read Only or Read/Write (VDI Metrics & History is Read Only at most), and has its own technician approval setting. ### Changes that always ask a technician Deleting a DaaS IQ host pool from Azure, which tears down its session host VMs and Azure resources, waits on a technician under every profile. ## Troubleshooting | Error when you save | What to check | | - | - | | ControlUp did not accept this API key | That you copied the whole key, and that it has not expired or been revoked. | | ControlUp accepted the key but refused the organization | That the Organization ID is the one on the API Key Management page where you made the key. | | The Organization ID is a UUID | Copy the ID from API Key Management; it looks like `0b1c2d3e-4f50-6172-8394-a5b6c7d8e9f0`. | | A call returns 403 later | The key's user lacks that permission directly (not through an SSO group), or your organization does not license that product. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.