Skip to main content
You connect ImmyBot once at the MSP level, then turn it on per agent. Neo signs in to your ImmyBot instance as a Microsoft Entra app in your own Microsoft tenant, the way ImmyBot’s own API guide sets up an outside integration.

​
1. Create an app registration in Microsoft Entra ID

1

Register the app

In the Microsoft Entra admin center of the tenant you sign in to ImmyBot with, open App registrations → New registration. Name it “Neo”, keep the default settings, and click Register.
2

Copy the ids

On the app’s Overview page, copy the Application (client) ID and the Directory (tenant) ID.
3

Create a client secret

Open Certificates & secrets → New client secret, add it, and copy its Value. Microsoft shows the value once; the Secret ID next to it is not the secret.
4

Copy the Enterprise application's Object ID

Back on the app’s Overview page, click the Managed application in local directory link. It opens the app’s Enterprise application. Copy the Object ID shown there.
ImmyBot needs the Object ID of the Enterprise application. The Object ID on the app registration’s own Overview page is a different id, and ImmyBot will not know Neo’s app if you paste that one.

​
2. Add the app in ImmyBot as a user

1

Create a person

In ImmyBot, go to Show More → People → New. Paste the Enterprise application’s Object ID into AD External ID and save.
2

Make the person a user

Go back to the People list and click Create User on the person you just created.
3

Give the user a role

Open Show More → Users, edit the new user and give it a role. The role decides what Neo can do in ImmyBot, on top of the permission groups you set per agent. An admin role works for every group.

​
3. Add the app in Neo

1

Open Integrations

Open Integrations → ImmyBot in the Neo Dashboard. The card is under Other.
2

Save the credentials

Fill in the four fields and click Save:Neo gets a token from Microsoft with these values and calls ImmyBot with it before it saves. A wrong or expired secret, a wrong id, or an app ImmyBot does not know as a user is rejected straight away, with the step to fix.
3

Check the Organization Mapping

The Organization Mapping tab fills after the save, and again on each nightly PSA sync. Neo matches each ImmyBot tenant to a PSA company by the Azure tenant it is linked to, then by name. A name that two PSA companies share is left for you to map. See ImmyBot for how the matching works.

​
4. Turn ImmyBot on per agent

Open the agent from Agents, go to the Integrations section, and configure the ImmyBot block, under Other. Pick a profile, then change any group. Each group can be Disabled, Read Only or Read / Write.

​
Safety Controls

These always ask a technician, whatever the profile:
  • Creating, changing or deleting ImmyBot users, roles, user groups and role assignments, granting a person access, turning on ImmyBot support access, and changing the Azure app credentials or pre-consenting client tenants in Azure, because each one grants access to the instance or to a client’s tenant
  • Impersonating an ImmyBot user
  • Deleting or merging tenants, deleting computers in bulk, and deleting an integration
  • Cancelling every maintenance session at once
  • Restarting the instance, updating it, or changing its release channel
  • Billing changes
  • A write that sends a field named like a password, secret, key or token, such as a deployment parameter or an SMTP password, or that sends back a value Neo hid, which Neo fills from the stored record
In ImmyBot’s JSON answers, Neo hides every field named like a credential: a password, a licence key, an integration’s stored key or a deployment parameter named like one shows to the agent as [hidden by Neo]. Free text, such as a script’s console output, is not inspected, so a script that prints a secret shows it to the agent. Neo does not call these ImmyBot operations: See ImmyBot API for what the agent does with each group.