Skip to main content

​
How it works

Neo connects to your client Microsoft 365 tenants through the Neo Automations app registration. You install this app once per tenant with the necessary permissions, and Neo can then perform automated actions on behalf of your MSP. The integration uses:
  • Microsoft Graph API for user management, licensing, and group operations
  • Exchange Online PowerShell for mailbox and email operations
The steps below must be completed for every Microsoft tenant you want to connect to Neo.

​
1. Find the tenant ID

Use the tenant ID when authenticating the Neo Automations app.
Find tenant ID in Microsoft Entra ID

​
2. Add the company in Neo Dashboard

  1. Go to https://dashboard.neoagent.io/end-companies and select New Company
Create a new company
  1. Fill details
    • Pax8 is optional (only if you manage Microsoft licenses via Pax8)
    • Custom instructions are optional for onboarding/offboarding policies
  2. Click Create
Company details and access buttons
  1. Click the key icon to grant Application access to Neo.
    • Sign in as a tenant admin with one of: Global administrator, Privileged authentication administrator, Authentication administrator
    • Complete the standard Microsoft consent flow
Grant application permissions
Application access is the only grant Neo needs. It covers everything the automation does in the tenant — creating users, assigning licenses, resetting passwords, and disabling accounts.
Neo automatically assigns the Exchange Administrator role to the Neo Automations app after consent, so mailbox actions (shared mailboxes, forwarding, delegation) work out of the box. No manual role assignment is needed.

​
Re-granting access after permission updates

Neo occasionally adds new Microsoft Graph permissions to the Neo Automations app as capabilities expand. A tenant’s consent only covers the permissions that existed when access was granted — to pick up additions, re-run the Grant access flow (the same key icons) for that company. Existing automation keeps working in the meantime; only the newest capabilities stay unavailable until you re-consent. For example, tenants consented before June 2026 are missing User-PasswordProfile.ReadWrite.All, which is what lets the agent reset a password and set the require password change at next sign-in flag. If Neo reports that a password reset was refused for a company, re-run Grant access for it — that picks the permission up.
You’ve completed permissions. Neo can now perform actions across Microsoft Graph and Exchange Online.