> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Connecting Nerdio Manager to Neo

> Turn on Nerdio Manager for MSP's REST API and save its credentials in Neo

## Before you start

* You need Nerdio Manager for MSP and an MSP-level administrator in it. Nerdio Manager for Enterprise is a different product, which this integration does not connect.
* Neo reaches Nerdio Manager over the internet at the address you sign in at, such as `https://nmm-app-abc123.azurewebsites.net` or your own domain. If you limit who can reach the app, allow [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md).

## 1. Turn on the REST API in Nerdio Manager

**1. Open the REST API settings**

In Nerdio Manager, at the MSP level, open **Settings** > **Integrations**. In the **REST API** area, select **Disabled** to start turning it on.

**2. Create the API app and grant consent**

Select **Run** to create the API application, then **Grant**, and in the Azure portal select **Grant admin consent**. Back in Nerdio Manager, select the refresh icon to check the permissions.

**3. Generate the secret**

Select **Generate**. Copy the **Tenant ID**, **Client ID**, **Scope** and the client secret. The secret is shown once.

## 2. Add the credentials in Neo

**1. Open Integrations**

In the Neo Dashboard, open [**Integrations** → **Nerdio Manager**](https://dashboard.neoagent.io/integrations?open=nerdio), under Servers & Virtualization.

**2. Save the values**

Enter the address you sign in to Nerdio Manager at, and the Tenant ID, Client ID, Scope and Client Secret from step 1, then click **Save settings**. Neo gets a token and reads your accounts before saving, so a wrong value is rejected straight away.

After the save, Neo matches your Nerdio accounts to your PSA companies. Check them on the **Organization Mapping** tab: an agent working a ticket acts only in the account its company maps to.

> [!WARNING]
>
> When the client secret expires, Neo loses access until you generate a new one in Nerdio Manager and save it here.

## 3. Add the log-off script (recommended)

Neo logs off a user's stuck session with an Azure runbook scripted action, which you add once:

1. In Nerdio Manager, at the MSP level, open **Scripted Actions** > **Azure runbooks** and select **Add scripted action**.
2. Name it **Neo - Log off an AVD user session**, paste the script below, and save it.
3. The script needs the `Az.DesktopVirtualization` module in Nerdio's scripted actions automation account, as Nerdio's own AVD runbooks do. It acts only in the subscription Nerdio Manager runs the account's scripted actions in (`$AzureSubscriptionID`), and Neo runs it only for a host pool that Nerdio Manager lists under that client's account.

```powershell theme={null}
#description: Neo Agent: logs off one user's Azure Virtual Desktop sessions in a host pool of this account.
#tags: Neo Agent

<# Variables:
{
  "HostPoolName": {"Description": "Name of the host pool.", "IsRequired": true},
  "UserPrincipalName": {"Description": "The user to log off, for example jane@contoso.com.", "IsRequired": true},
  "SessionHostName": {"Description": "Only the session on this session host. Leave empty for every session of the user.", "IsRequired": false, "DefaultValue": ""}
}
#>

$ErrorActionPreference = 'Stop'
# The subscription is the one Nerdio Manager runs this account's scripted actions in, never one the caller names.
Set-AzContext -SubscriptionId $AzureSubscriptionID | Out-Null

$pools = @(Get-AzWvdHostPool | Where-Object { $_.Name -eq $HostPoolName })
if ($pools.Count -ne 1) {
    throw "Found $($pools.Count) host pools named $HostPoolName in this account's subscription."
}
$resourceGroupName = ($pools[0].Id -split '/')[4]

$sessions = Get-AzWvdUserSession -HostPoolName $HostPoolName -ResourceGroupName $resourceGroupName |
    Where-Object { $_.UserPrincipalName -eq $UserPrincipalName }
if ($SessionHostName) {
    # Compare the short host name, so "avd-1" never matches "avd-10" and a full name matches too.
    $shortName = ($SessionHostName -split '\.')[0]
    $sessions = $sessions | Where-Object { ((($_.Name -split '/')[1]) -split '\.')[0] -eq $shortName }
}
if (-not $sessions) {
    Write-Output "No session of $UserPrincipalName in $HostPoolName."
    return
}
foreach ($session in $sessions) {
    $parts = $session.Name -split '/'
    Remove-AzWvdUserSession -HostPoolName $HostPoolName -ResourceGroupName $resourceGroupName `
        -SessionHostName $parts[1] -Id $parts[2] -Force
    Write-Output "Logged off session $($parts[2]) of $UserPrincipalName on $($parts[1])."
}
```

Without it, Neo asks a technician to approve a restart of the session host, which signs out every user on it, or gives the technician the steps to log the user off in Nerdio Manager.

## 4. Turn Nerdio Manager on per agent

Open the agent, go to the Integrations section, and configure the Nerdio Manager block. Agents can do only what Nerdio Manager's REST API app may do.

### Pick an access profile

> [card] Read Only
>
> Read sessions, hosts, host pools and every other area. Nothing is changed, and device passwords stay off.

> [card] Helpdesk
>
> Starting a host and running a scripted action wait on a technician. Everything else is read only, and device passwords stay off.

> [card] IT Admin
>
> Starting hosts, scripted actions, host pools and images change without approval. Accounts, backup, networks and variables, and billing wait on a technician.

> [card] Full Automation
>
> Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician).

### Or set each area by hand

| Area | Notes |
| - | - |
| **Accounts & Provisioning** | Your client accounts, account provisioning and Nerdio's role assignments. |
| **Host Pools & Workspaces** | Host pools with their AVD, RDP, FSLogix, Active Directory, session time-out, auto-scale and VM settings, assigned users, workspaces and auto-scale profiles. |
| **Session Hosts & User Sessions** | Session hosts with their status and schedules, and the user sessions on each host pool and workspace: start, stop or restart a host. A restart or a stop signs out everyone on that host, so it always asks a technician. |
| **Desktop Images** | Desktop images, their change logs and schedules: power an image's VM on or off. |
| **Scripted Actions & Tasks** | Scripted actions, schedules, and the tasks Nerdio Manager runs with their logs. A scripted action runs whatever its script does in the client's Azure, so consider technician approval here. |
| **Backup & Recovery** | Protected items, recovery points, recovery vaults and backup policies: back up on demand, restore, link vaults. |
| **Users, Groups & Devices** | Users with their MFA status, groups, Intune devices with apps and compliance, app assignments and vulnerabilities. |
| **Device Passwords & BitLocker Keys** | A device's local administrator (LAPS) password and its BitLocker recovery keys, for a technician who asks in a chat. Never read on a ticket, and kept out of the run log and out of sandbox scripts. |
| **Networks, Storage & Variables** | Networks, resource groups, Active Directory and FSLogix profiles, environment, inherited and secure variables, and reservations. |
| **Billing & Usage** | Invoices, usage per account and saved cost estimates. Read only in practice. |

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

### Changes that always ask a technician

These wait on a technician under every profile, whatever the area's own approval setting:

* Linking a new client tenant to Nerdio Manager, which gives it admin rights in that tenant, and granting a Nerdio role.
* Restarting or stopping a session host, which signs out every user on it.
* Deleting a host pool, which deletes its session hosts.
* Turning a resource's backup off, unlinking a recovery vault, and deleting a backup policy.
* Creating, changing or deleting a secure variable.
* Replacing an app's assignments.
* Any change that sends a password, a secret, a token or a storage key, or hands a scripted action a secure variable.

## Troubleshooting

| Error when you save | What to check |
| - | - |
| Microsoft refused the client secret | Generate a new secret in Nerdio Manager's REST API settings and paste it. |
| Microsoft does not know that Scope | Copy the Scope exactly as Nerdio Manager shows it. |
| Microsoft has no admin consent | Select **Grant** in the REST API settings and grant admin consent. |
| Nerdio Manager did not accept the token | That the REST API is enabled. After you generate a secret, wait a few minutes before you save. |
| No MSP REST API at this address | The address: it must be your Nerdio Manager for MSP, not Nerdio Manager for Enterprise. |
| Nerdio Manager answered with a redirect | Enter the address Nerdio Manager finally opens at. |
| Could not reach Nerdio Manager | The address, and that Neo's addresses can reach it. |


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.