> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Inforcer to Neo

> Create an Inforcer API key and save it in Neo

You connect Inforcer once at the MSP level. One API key from your Inforcer account covers every client tenant in it.

## 1. Create the API key

**1. Create the key**

Sign in to [Inforcer](https://portal.inforcer.com) and create a REST API key, as Inforcer's help article [REST API (Beta)](https://docs.inforcer.com/en/articles/12096007-rest-api-beta) describes.

**2. Give it scopes**

Give the key **Tenants.Read**, which Neo needs to match your tenants to your clients, and the scopes for what your agents should use:

| Scope | Lets Neo |
| - | - |
| Tenants.SecureScores.Read | Read each tenant's Secure Score |
| AlignmentScores.Read, Baselines.Read, tenants.policies.Read | Read alignment scores, baselines, policy comparisons and policies |
| Tenants.Users.Read, Tenants.Groups.Read, Tenants.Roles.Read | Read users, groups and directory roles |
| Reports.Read, Reports.Run | Read report types and outputs, and queue report runs |
| Assessments.Read, Assessments.Run | Read assessments and run them |
| Audit.Read | Read the activity log |

**3. Note your region**

Note the region your Inforcer portal runs in: United Kingdom, Europe, United States, or Australia and New Zealand. Neo sends the key to that region.

> [!WARNING]
>
> When the key is deleted in Inforcer, Neo loses access until you save a new key here.

## 2. Add the key in Neo

**1. Open Integrations**

In the Neo Dashboard, open **Integrations** and find the Inforcer card, under Identity & Workspace.

**2. Save the key**

Pick the region, paste the API key and click **Save settings**. Neo checks it against Inforcer before saving, so a wrong key, a key from another region, or a key without Tenants.Read is rejected straight away.

## 3. Turn Inforcer on per agent

Open the agent, go to its **Tools & Settings** tab, click **Identity & Workspace**, and expand the **Inforcer** block. Pick the **Read Only** or **Full Automation** preset, or set each area yourself:

| Area | Access levels you can pick | Notes |
| - | - | - |
| **Tenants** | Disabled, Read Only | Your tenants with their secure score and alignment summaries. |
| **Secure Scores** | Disabled, Read Only | Turn on for a security review or QBR agent. |
| **Baselines & Alignment** | Disabled, Read Only | Turn on for an agent that reports drift from your baseline. |
| **Policies** | Disabled, Read Only | A tenant's backed-up policies with their settings. |
| **Users, Groups & Roles** | Disabled, Read Only | Users with MFA and admin roles, groups and directory roles. |
| **Activity Log** | Disabled, Read Only | Inforcer's own activity log. |
| **Assessments** | Disabled, Read Only, Read / Write | Read / Write lets the agent run an assessment. |
| **Reports** | Disabled, Read Only, Read / Write | Read / Write lets the agent queue report runs. |

See [Inforcer API](https://docs.neoagent.io/agents/tools/m365/inforcer-api.md) for what the agent can do.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.