Skip to main content
You connect ThreatLocker once at the MSP level, then turn it on per agent. Setup takes a few minutes.
ThreatLocker uses a single API URL and key per MSP. Save them once and every agent that has ThreatLocker permissions can use them.

​
1. Find your API URL and key in ThreatLocker

1

Find your Portal API URL

In the ThreatLocker Portal, open the Help menu and look for ThreatLocker Access. Copy the API URL shown there exactly — it’s specific to your ThreatLocker instance, so don’t guess or reuse another MSP’s URL.
2

Create an API Auth Key

Go to the Administrators page and create an API User, then generate its Auth Key.
Copy the key somewhere safe once it’s generated — you won’t be able to view it again in ThreatLocker.

​
2. Add the credentials in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations and find the ThreatLocker card, under Security.
2

Save the API URL and key

Paste both values and click Save.

​
3. Turn ThreatLocker on per agent

Each agent decides whether it uses ThreatLocker and which areas it can touch. Open the agent, go to the Integrations section, and configure the ThreatLocker block.

​
Pick an access profile

Read Only

Every area set to read only. The agent can look up computers, applications, policies, and approval requests, but never makes changes.

Helpdesk

Approval Requests set to read and write — still requires technician approval on every one. Everything else read only. Fits a helpdesk agent resolving the “app is blocked” workflow.

IT Admin

Computers, Applications, Policies, and Approval Requests all read and write, but every write waits on a technician. A cautious rollout tier.

Full Automation

Computers and Applications writes go through on their own. Policies and Approval Requests still always require technician approval — that never turns off.

​
Or set each area by hand

​
Safety controls

  • Approving/denying software and editing policies always wait on a technician. This holds regardless of the agent’s automation level or the access profile you picked — it’s not a setting you can turn off.
  • Organizations is always read only. Neo uses it only to see and scope to your organization hierarchy — it never changes it.
  • Path safety. Suspicious URL paths (anything containing .., for example) are rejected before they reach ThreatLocker.

​
Security

  • The API key lives in Azure Key Vault. It is never stored in plaintext.
  • All traffic to ThreatLocker goes over HTTPS, to the Portal API URL you saved for your instance.
  • Write access to ThreatLocker is opt in per area, per agent.
Once your credentials are saved and an agent has permissions, the ThreatLocker tool is added to that agent automatically.