> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Microsoft 365

> Connect Microsoft 365 for user management and automation

Neo integrates with Microsoft 365, Active Directory, and Exchange to automate the full spectrum of identity, mailbox, and security operations — across cloud, on-prem, and hybrid environments. Connect once, and your AI agents can handle everything from password resets to full user onboarding and offboarding.

## What Neo Can Do

<AccordionGroup>
  <Accordion title="User Lifecycle" icon="user-plus">
    Create, update, disable, enable, and delete users in Entra ID or on-prem Active Directory. Assign managers, update job titles and departments, and manage user properties — all from a single agent.
  </Accordion>

  <Accordion title="Passwords & Security" icon="lock">
    Reset passwords (including *require password change at next sign-in* — see [re-granting access](/integrations/m365/cloud#re-granting-access-after-permission-updates) for tenants connected before June 2026), unlock accounts, revoke sign-in sessions, reset MFA, and manage authentication methods. Block and unblock user sign-in. In hybrid environments, Neo makes changes on-prem and triggers Azure AD Connect sync automatically — or, for hybrid tenants without AD Connect sync, applies the same change to both directories directly.
  </Accordion>

  <Accordion title="Licensing" icon="id-card">
    Assign and remove Microsoft 365 licenses. Look up friendly license names from SKU IDs. Works with direct Microsoft licensing, Pax8, and Partner Center.
  </Accordion>

  <Accordion title="Groups" icon="users">
    Add and remove users from security groups, Microsoft 365 groups, distribution lists, and mail-enabled security groups. Search and list groups across Entra ID and on-prem AD. In hybrid environments, Neo automatically routes group operations to the correct directory.
  </Accordion>

  <Accordion title="Directory Roles" icon="shield-halved">
    Assign and remove Entra ID directory roles (Global Admin, Exchange Admin, User Admin, etc.). View a user's current role assignments.
  </Accordion>

  <Accordion title="Mailboxes" icon="envelope">
    Convert mailboxes to shared, create new shared mailboxes, and delete shared mailboxes. Set up and remove email forwarding. Configure mailbox delegation (full access, send-as, send-on-behalf). Works with Exchange Online and on-prem Exchange Server.
  </Accordion>

  <Accordion title="Mailbox Permissions" icon="key">
    Grant and revoke full access, send-as, and send-on-behalf permissions. Add and remove recipient permissions. View current mailbox permission assignments.
  </Accordion>

  <Accordion title="Conditional Access" icon="filter">
    List, view, create, update, and delete Conditional Access policies. Destructive operations always require technician approval regardless of workflow settings.
  </Accordion>

  <Accordion title="Devices" icon="mobile">
    View user devices in Intune. Remote wipe and retire mobile devices. Device deletion is always blocked for safety.
  </Accordion>

  <Accordion title="On-Prem Active Directory" icon="server">
    Full AD management via RMM: user and computer management, organizational units, group operations, infrastructure queries, and Entra Connect sync triggers.
  </Accordion>

  <Accordion title="Exchange Server (On-Prem)" icon="server">
    All Exchange operations work on-prem too: mailbox management, permissions, recipients and contacts, distribution groups, mail flow and transport rules, address lists and policies, compliance and auditing.
  </Accordion>
</AccordionGroup>

<Tip>
  Need an operation that's not listed? Let us know — we add new capabilities regularly.
</Tip>

***

## Granular Permission Controls

Every agent workflow has its own permission configuration. You control exactly what the agent can and cannot do — per integration, per operation category.

<CardGroup cols={3}>
  <Card title="Microsoft Graph" icon="cloud">
    14 permission groups covering users, groups, licensing, security, roles, devices, conditional access, domains, mail, audit logs, security operations, SharePoint & OneDrive, Teams & chats, and app registrations
  </Card>

  <Card title="Active Directory" icon="server">
    6 permission groups covering users, groups, computers, OUs, infrastructure, and Entra Connect sync
  </Card>

  <Card title="Exchange" icon="envelope">
    7 permission groups covering mailboxes, permissions, recipients, distribution groups, mail flow, address lists, and compliance
  </Card>
</CardGroup>

Each permission group has three access levels:

| Level            | What the agent can do                            |
| ---------------- | ------------------------------------------------ |
| **Disabled**     | No access to this category                       |
| **Read Only**    | Query and list operations only                   |
| **Read / Write** | Full access including create, update, and delete |

You can also require **technician approval** for any permission group — the agent will pause and wait for a technician to approve before executing write operations.

<Info>
  **Built-in safety guardrails:** Some destructive operations (like deleting a user or wiping a device) always require technician approval, even if the permission group doesn't have it enabled. Every write in the **Applications** group (app registrations, client secrets, consent grants) requires approval the same way. Other operations (like deleting a domain) are blocked entirely.
</Info>

**Quick-start profiles** let you configure all permission groups at once:

| Profile             | Best for                                                           |
| ------------------- | ------------------------------------------------------------------ |
| **Read Only**       | Monitoring and reporting agents                                    |
| **Helpdesk**        | Tier 1 agents — password resets, group changes, basic user updates |
| **IT Admin**        | Tier 2/3 agents — user lifecycle, licensing, mailbox management    |
| **Full Automation** | Fully autonomous agents — all operations, no approval required     |

***

## Works Everywhere

Neo supports cloud, on-prem, and hybrid Microsoft environments — configured independently per client company.

| Environment                     | Identity                                                                               | Mailbox                                                    |
| ------------------------------- | -------------------------------------------------------------------------------------- | ---------------------------------------------------------- |
| **Cloud**                       | Entra ID via Microsoft Graph API                                                       | Exchange Online via Graph + PowerShell                     |
| **On-prem**                     | Active Directory via RMM + PowerShell                                                  | Exchange Server via RMM + PowerShell                       |
| **Hybrid**                      | On-prem AD with Azure AD Connect sync                                                  | Exchange Hybrid (on-prem cmdlets + cloud routing)          |
| **Hybrid (no AD Connect sync)** | On-prem AD + Entra ID — Neo applies every identity change to both directories directly | Exchange Online or Exchange Server (configured separately) |

Identity provider and mailbox provider are configured separately — you can mix and match. For example, on-prem AD with Exchange Online, or Entra ID with on-prem Exchange Server.

***

## Connect Cloud Tenants

Two ways to connect Neo to customer Microsoft 365 tenants:

|                             | [GDAP](/integrations/m365/gdap)                                                | [Direct Consent](/integrations/m365/cloud) |
| --------------------------- | ------------------------------------------------------------------------------ | ------------------------------------------ |
| **Who consents**            | MSP admin, using GDAP access — no customer involvement                         | A tenant admin in each customer tenant     |
| **How Neo authenticates**   | Standard client\_credentials (same for both)                                   | Standard client\_credentials               |
| **CSP enrollment required** | Yes                                                                            | No                                         |
| **Best for**                | MSPs managing many tenants — onboard without waiting for each customer's admin | Individual tenants, or non-CSP scenarios   |

<CardGroup cols={2}>
  <Card title="GDAP" icon="shield-halved" href="/integrations/m365/gdap">
    CSP partners can consent to Neo on behalf of customers using existing GDAP access.
  </Card>

  <Card title="Direct Consent" icon="cloud" href="/integrations/m365/cloud">
    A tenant admin in each customer tenant consents to the Neo app directly.
  </Card>
</CardGroup>

***

## Connect On-Prem Environments

<Card title="On-prem" icon="server" href="/integrations/m365/on-prem">
  Connect on-premises Active Directory and Exchange environments via RMM.
</Card>

<Note>
  **Hybrid environments:** Configure as on-prem — Neo executes operations on your domain controller and Azure AD Connect syncs changes to the cloud. If both directories exist but nothing syncs between them, set the company's identity provider to **"Hybrid (no AD Connect sync)"** instead — Neo then applies each identity change to both on-prem AD and Entra ID directly. See [which hybrid type to pick](/integrations/m365/on-prem#1-configure-company-settings).
</Note>