> ## Documentation Index > Fetch the complete documentation index at: https://docs.neoagent.io/llms.txt > Use this file to discover all available pages before exploring further. # Connecting Omnissa Horizon to Neo > Save your Connection Server address and a Horizon administrator for Neo ## Before you start * Neo uses the Horizon Server REST API, which every Connection Server of Horizon 7.10 and later serves at `/rest/`. Horizon 8 (2006) and later serves the machine, session and entitlement calls Neo's agents use; audit events need 2106 and later, and creating a desktop pool 2111 and later. * Neo reaches the Connection Server over the internet. Its REST API must answer on **HTTPS** with a certificate from a public certificate authority, at a public address. If a firewall or reverse proxy limits who can reach it, allow [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md) to reach `/rest/`. ### If the Connection Server is only on your internal network Most are. This guide publishes only the REST API, never the Horizon Console, through a reverse proxy at your network edge that: * answers on a public name over HTTPS, with a certificate from a public certificate authority; * forwards only paths under `/rest/` to a Connection Server, and refuses every other path; * accepts connections only from [Neo's addresses](https://docs.neoagent.io/integrations/ip-whitelisting.md); * passes the `Authorization` header through. Save the proxy's public address in Neo. ## 1. Make a Horizon administrator for Neo **1. Create the Active Directory user** Create a user for Neo in Active Directory, such as `neo-svc`, with a strong password that does not expire without notice. **2. Give it a Horizon role** In the Horizon Console, open the **Administrators** page under **Settings** and add Neo's user with a role and access group: **Administrators (Read only)** for an agent that only reads; **Inventory Administrators** to manage desktops, pools, sessions and entitlements, together with **Global Configuration and Policy Administrators (Read only)** on the root access group, which pool and entitlement changes need, and the **Manage vCenter Configuration (Read only)** privilege, which pushing a new image needs; **Administrators** only when Neo should also change servers and settings. A role on one access group limits Neo to that group's pools. Neo can do only what this administrator may do, whatever the agent's access profile says. > [!WARNING] > > If the password expires or you lock the user, Neo loses access until you save the new password here. ## 2. Add the user in Neo **1. Open Integrations** In the Neo Dashboard, open [**Integrations** → **Omnissa Horizon**](https://dashboard.neoagent.io/integrations?open=omnissa_horizon), under Servers & Virtualization. **2. Save the address, domain, user name and password** Enter the address of your Connection Server (for example `https://horizon.example.com`), the NetBIOS name of Neo's domain (such as `ACME`), Neo's user name without the domain, and its password, then click **Save settings**. Neo signs in before saving, so a wrong address or a refused password is rejected straight away. Horizon does not accept the `user@domain` form. ## 3. Turn Horizon on per agent Open the agent, go to the Integrations section, and configure the Omnissa Horizon block. Agents see only what Neo's Horizon administrator can see. ### Pick an access profile > **Read Only** > > Read desktops, pools, sessions, entitlements, health and events. Nothing is changed. > **Helpdesk** > > Machine, session and entitlement changes (restart a desktop, log off a session, assign a user) wait on a technician. Everything else is read only. > **IT Admin** > > Machines, pools, sessions and entitlements change without approval, except the changes that always ask. Server, gateway, settings and administrator changes wait on a technician. > **Full Automation** > > Every change runs without approval, except the [changes that always ask a technician](#changes-that-always-ask-a-technician). ### Or set each area by hand | Area | Notes | | - | - | | **Machines & RDS Hosts** | Virtual desktops, physical machines, RDS hosts and persistent disks: restart, reset, shut down, rebuild, recover, maintenance mode and delete. | | **Desktop & Application Pools** | Desktop pools, farms, application pools and images, and the vCenter objects a pool is built from: create, resize, enable, disable, push an image. | | **Sessions & Help Desk** | User sessions and Help Desk data: log off, disconnect, reset or restart a session's machine, send a message. | | **Entitlements & Users** | Pool and global entitlements, users assigned to dedicated machines, and Active Directory user and group lookups. Enable it to onboard and offboard users. | | **Monitoring & Events** | Health of Connection Servers, gateways, vCenter servers and the event database, machine and session counts, and audit events. Read only. | | **Servers, Federation & Settings** | Connection Servers, gateways, vCenter servers, App Volumes, Cloud Pod federation, licences, settings and policies, log collection. | | **Administrators & Authentication** | Horizon administrators, roles and permissions, access groups, authenticators, and domain and service accounts. Every change here waits on a technician. | Each area can be Disabled, Read Only or Read/Write (Monitoring & Events is Read Only at most), and has its own technician approval setting. ### Changes that always ask a technician These wait on a technician under every profile, whatever the area's own approval setting: * Deleting a desktop pool or a farm, which deletes every machine or RDS host in it, and deleting a persistent disk, which holds a user's data. * Any change to administrators, roles, permissions, access groups, authenticators (SAML, RADIUS, JWT, True SSO), instant clone domain accounts and other domain accounts, and changing a user's password. * Creating, joining, leaving or dissolving a Cloud Pod federation, rotating its keys, and deleting a site. * Removing a vCenter server, clearing the event database, deleting the Connection Server certificates, and installing or upgrading a Connection Server. * Starting a Workspace ONE Assist remote-control session on a user's desktop. * Any change to Horizon's security settings, and any update to a record that holds a stored password or key: a capacity provider, a vCenter server, the App Volumes Manager, a customization specification, the event database, an external deployment, a UEM server and the syslog file share. * Any change that stores a credential: a password, a shared secret, a licence key, a private key, or the user name and password in a URL. ## Troubleshooting | Error when you save | What to check | | - | - | | No Horizon REST API answered | The address: it must be a Connection Server, or your proxy in front of one, that serves `/rest/`. | | Horizon rejected the user name, password or domain | The user name without the domain, the domain's NetBIOS name, and the password. | | Horizon, or a web server in front of it, refused the sign-in | That the user is a Horizon administrator, and that Neo's addresses reach `/rest/`. | | Horizon does not accept a user\@domain sign-in | Enter the user name alone and the domain in its own field. | | Could not reach Horizon | The address, that it is public, and that its certificate comes from a public certificate authority. | This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.