User Management
Dashboard Overview
Find RBAC under Roles & Access. It lists users in your organization with their roles, status, and recent activity. Only users with ADMIN role can view/manage other users.
User Roles and Permissions
Neo Agent supports different user roles with varying levels of access:- Owner: Everything an Admin can do, plus the workspace-wide chat History and the right to make or remove owners. The first user of a workspace starts as its owner; a workspace always keeps at least one.
- Admin: Full access to all features and user management capabilities
- User: Regular Users can create any workflow as well as can edit any workflow shared with them. To give one User every agent in the workspace without making them an Admin, see Every agent and workflow
- Viewer: Can view any workflow shared with them and its execution history, and run it with Run now, for example to rerun a ticket against an agent. Cannot create or edit any workflow
- Chat only: No dashboard access. They keep using Neo in Microsoft Teams, and you can pick them for a chat agent’s Specific people list. See Adding technicians in bulk.
Users with OWNER or ADMIN role have access to all dashboard sections. Users with USER/VIEWER role need to be granted access to restricted dashboard sections.
Workflow access applies everywhere — including Neo Support
A user’s workflow access (their role, the workflows they created, and the workflows shared with them) is enforced consistently across every surface:- Dashboard: the workflow list, editor, run-now, version history, and stats only cover workflows the user can access.
- Runs: the Executions page, a run’s page, and everything on it — the step trace, the files a run produced, the subagents it dispatched — cover the same workflows. Someone sent a link to a run of a workflow nobody shared with them sees the same “not found” page they would get for the workflow itself. Approving is the exception: a request sent to a technician stays on their Approvals page and they decide it, whether or not they can open the agent that raised it.
- Audit Log and the public API: the Audit Log lists the actions of the workflows the user can access, on the dashboard page and on
GET /public-api/audit-log/tool-callsalike. The/public-api/executionsendpoints answer the same way. An owner or admin sees every agent; a user or viewer only the agents they created or that were shared with them. - Neo Support chat: when a user asks the Neo Support Agent to list, inspect, run, edit, or train workflows, the agent operates under that user’s permissions. It only sees the workflows they can see. A Viewer can have it run one of them. Edits (including training suggestions) require edit access — a Viewer, or a User the workflow isn’t shared with, will be told to ask an administrator instead.
- Training suggestions: reviewing or applying a suggested change to a workflow requires access to that workflow.
- People with no dashboard account: a technician who can chat with the Neo Support Agent (for example in Teams) but has no account in Roles & Access cannot list, view, or edit any workflow through it. Their company data comes from one workspace-wide default, which is empty until an admin sets it — see People without a dashboard account. The agent tells them to ask an administrator for an account. To let someone read workflows without changing them, invite them as a Viewer.
- Skills: creating, editing, or deleting a Skill applies to every agent in your workspace, so the Neo Support Agent only does it for people whose role can write — a Viewer (or someone with no dashboard account) is told to ask an administrator instead.
- Intents: a Viewer can open the Intents page and read every intent, but cannot create, edit, enable, disable, duplicate, or delete one, on the dashboard or through the Neo Support Agent. Owners, Admins and Users can.
- Company data in AI chat: admins hold every data source implicitly. For everyone else, the Neo Support Agent uses only the sources granted on their page — open Roles & Access and click their row — the PSA (synced tickets, contacts and configurations, plus live reads), each documentation source separately, and devices (all connected RMMs together). Anything not granted is explained by the agent, with the fix, instead of failing. See AI chat data access.
Access Denied Scenarios
When users don’t have the necessary permissions to access the dashboard, they’ll encounter an access denied screen that explains the restriction and provides contact information for administrators:
Inviting New Users
To add new team members to your Neo Agent organization:- Access User Management: Navigate to the Roles & Access section
- Click Invite User: Select “Invite New User” to open the invitation form
- Enter User Details: Provide the user’s name, email address, and assign their role
- Send Invitation: The system automatically sends an email invitation to the new user
Example of Email:
Adding technicians in bulk
Add technicians, beside Invite User, gives many of your PSA technicians a membership at once. Specific people can only name people who hold one, so use this for the technicians who work in Microsoft Teams and never open the dashboard.- Open Roles & Access → Users and click Add technicians.
- Pick a role. Chat only is the default.
- Tick the technicians, or use Select all, then click Add.
Every membership is active at once, so Neo recognizes a technician in Teams from their next message. A non-admin starts on the no-account AI chat data access default, so nobody loses data they could already read. Owners are appointed one at a time.
The list shows technicians linked to a Microsoft account who have no membership yet. That link comes from the Microsoft Teams — Technician Mapping integration. For someone who is not a technician, use Invite User.
If a technician is missing from the list:
- Look for them in Roles & Access. Someone with a membership, pending or inactive included, is not in the list; open their row there instead.
- Check that they are on the Technicians page. A PSA sync does not add technicians there, so add them with Add Technician.
- Under Integrations → Microsoft Teams — Technician Mapping, click Run auto-map. It matches each technician’s PSA email to a member of one of your Teams.
- If they stay unmatched, map them by hand with their sign-in email, or use Invite User.
Changing someone’s name or role
Click their row in Roles & Access. The person’s page opens with Name & role at the top. A new name saves when you click away from the field; a role saves as soon as you pick it. Only an owner can make someone else an owner, and a workspace keeps at least one owner, so the last one cannot be demoted.Permission Management
Dashboard Tab Access
Control access to dashboard sections through granular permission settings:
- Integrations: Configure PSA, RMM, and other system integrations
- Analytics: View workflow performance and system analytics
- Phone Agent: Manage AI Phone Agents settings and call history
- Companies: Manage client companies and organizations
- Profile: View and edit user profile information
- Billing: Manage billing and subscription information
- Settings: Configure system settings and preferences
- Feedback: Provide feedback about workflows
- Chat: Access chat agents for conversational AI assistance
- Backfills: Create and manage workflow backfill runs over historical data
- Scheduled Work: View and manage scheduled workflow runs
Restricted Access Experience
When users attempt to access a dashboard section they don’t have permission for, they’ll see an access restriction message:
Workflow Sharing
Give one person access to agents and workflows they did not create.Every agent and workflow
To let someone reach all of them at once, open Roles & Access, click the person’s row, and turn on Every agent and workflow in Agents & workflows shared with them. It covers agents created later, so you never share one again for that person. Their role still decides whether they can edit: a User edits everything, a Viewer reads everything and can start any workflow, triggered agent or scheduled agent with Run now. It grants nothing else an admin can do — no member management, no dashboard sections, no company data in AI chat. For Chat Agent Access it counts as sharing every agent, so it admits them to an agent set to Specific people; Admins only still admits your admins alone. Turn it off and they are back to the agents they created plus the ones named below. Both the switch and each individual grant appear in that person’s activity history.One agent at a time
- Open Roles & Access, then click the person’s row.
- In Agents & workflows shared with them, click Add agent. Search by name or by id, then click every agent you want. Each pick gets a check, and the panel stays open.
- Click Add to grant them all at once. Closing the panel first cancels your picks.
- Use the bin icon on a row to take an agent back, then confirm. When the agent is part of a chain, the confirmation says how many go with it.
A workflow that runs as part of a chain is shared with the rest of its chain, and taken back with
it. Half a chain shows someone a run that starts or ends in a workflow they cannot open.
Chat Agent Access
The Chat Agent Access tab controls who on your team may message each internal chat agent. This is separate from workflow sharing and dashboard tab access. It governs messaging only, not who can see or edit the agent’s configuration.Controlling a chat agent is two independent questions. Who may message it is this tab. What company data it uses for each person is AI chat data access on that person’s page. Opening the agent to everyone grants nobody your ticket or documentation data, and granting someone that data does not let them message an agent this tab excludes.
The picker lists people who hold a membership. A technician who only uses Teams has none until you add one with Add technicians, where Chat only is enough. Under Admins only or Specific people, a technician with no membership cannot message the agent at all.
Only admins can change these settings. The mode applies to every internal chat agent, including the Neo Support Agent. Agents that serve end users through a channel are governed by that channel instead, not by this tab.
This setting drives what each person sees: the Chat page’s agent list, the Train/Skillify buttons, and the Need help? widget all appear exactly for the people the agent’s mode admits. Restricting the Neo Support Agent therefore also removes those affordances for everyone excluded.
You no longer need to restrict the Neo Support Agent to protect your company data: what it may read for each person is a separate, per-person setting — see AI chat data access below. A non-admin who chats with it always gets product help and can train the agents they have access to; company data follows their grants.
AI chat data access
Every person’s page (Users → click their row) has an AI chat data access section. It lists the integrations you have connected that carry company data, and an admin ticks the ones the Neo Support Agent may use when that person is chatting — on the dashboard and in Microsoft Teams alike:
The Tickets grant carries two further reads that are assembled from PSA data: raw analytics queries over synced tickets, and resolving a company name to its ids in the systems that person is granted.
Admins hold every grant implicitly. Nothing is granted to a new user by default — an invitation on its own grants no company data, whatever role it carries, so a new Viewer starts with every box unticked. When someone asks the agent for data outside their grants, it names the system it cannot read and points them to an administrator, with a link to Roles & Access so the admin lands on the right page. It also names which setting applies to that speaker: their own grants when they hold an active account, and the no-account default below when the workspace never registered them. A pending or disabled account reaches neither until it is active.
A change you make here reaches an open conversation on that person’s next message, so they do not have to start a new chat to pick it up. If the agent still repeats a refusal it gave before the change, a new chat clears it.
Documentation stays separate from Tickets — a person with Tickets and no documentation source cannot reach your documents through an analytics query either.
Saved memories follow the dashboard account rather than a grant. Anyone with an active Neo account can recall them in chat, exactly as they can read them on the Memory page; someone who only chats from Microsoft Teams with no account cannot, whatever their grants say.
People without a dashboard account. Anyone in your Microsoft Teams can chat with the Neo Support Agent, including people you never invited to the dashboard. The Users tab has a collapsible card, AI chat data for people without a dashboard account, that sets what the agent may use for such a speaker — empty by default. To give one specific person more or less than that default, add them as Chat only with Add technicians (or invite them as a Viewer) and set it on their page.
The same page carries that person’s name and role, the Dashboard sections they may open (navigation only — it does not protect data), and the agents shared with them, so one page answers “what can this person reach” and is where every part of the answer is changed.
See Who can chat with the agent for how this appears when building an agent.
API Keys
The API Keys tab is where admins create and manage keys for the Neo public API: the credentials your own scripts and integrations use to call Neo programmatically. From Roles & Access → API Keys an admin can:- Create a key, with an optional expiry. The full key is shown once, right after creation — copy it then, as it can’t be retrieved later.
- Rotate a key — issues a replacement immediately while the old key keeps working for 24 hours, so you can roll it over without downtime.
- Revoke a key — disables it immediately and permanently.
Activity Tracking
Comprehensive Audit Trail
Neo Agent maintains detailed activity logs for all user actions and administrative changes:
Tracked Activities
The system automatically logs:- Workflow Sharing: When workflows are shared or access is revoked
- Role Changes: Updates to user roles and permissions
- User Management: User creation, activation, enabling, and disabling
- Permission Updates: Changes to dashboard tab access
- All Agents And Workflows: When the workspace-wide workflow grant is given or taken back
Activity Details
Each audit entry includes:- Timestamp: When the activity occurred
- User: Who performed the action
- Activity Type: What type of change was made
- Details: Specific information about the change
Access reviews
The Users page shows a Last Active column: when that person’s dashboard session last reached Neo. Neo refreshes it at most once every ten minutes, so it can sit up to ten minutes behind the real visit. It reads No activity yet when Neo holds no activity for that person. That covers someone who has not opened the dashboard since you gave them access, and it also covers an account that was last used before Neo started recording this, so treat an old account that reads No activity yet as unknown until its next visit. Use it to find dormant accounts during an access review. A Chat only member cannot sign in, so Last Active never moves for them: it reads No activity yet, unless you changed that person to Chat only from a dashboard role, when it keeps the older activity from that role. Either way it says nothing about whether they use Neo in Microsoft Teams. Last Active measures use. It moves whenever that person’s dashboard session reaches Neo, and Neo keeps no sign-in record of its own. For sign-in events, use the Microsoft Entra sign-in logs for your directory. To collect the same list on a schedule, callGET /public-api/memberships with a tenant API key. It returns every person who holds a membership, with their name, email, role, status, all_workflows_access and last_active_at. all_workflows_access is the switch above; an Admin reaches everything through their role and reads false. The endpoint is read-only and open to a workspace admin or an API key; inviting and revoking still need an admin signed in to the dashboard.
Managing User Status
User Status Types
Users can have different statuses within your organization:- Active: Full access according to their role and permissions
- Inactive: Temporarily disabled access while preserving user data
- Pending: Invited but not yet activated their account
Announcement Notifications
Every active user who can sign in receives Neo’s announcement emails; chat-only members do not. See Announcements.Access across workspaces
An admin can give a person access to another MSP’s workspace. Add the person from the destination workspace’s Users page. Their role, shared workflows, and chat data access apply only there. Enter their name, email, and role, whether they work at your company or another MSP. Neo emails an Accept invitation link. The person opens it, signs in with the Microsoft work or school account for the invited email address, and selects Accept invitation. They do not need to provide Microsoft directory or object IDs. Personal Microsoft accounts cannot accept invitations. The email link expires after seven days and works once. For a pending user, select Resend invitation to send a replacement and invalidate the old link. Cancel invitation immediately invalidates the invitation. If email delivery fails, the pending user remains listed so you can resend it. If the recipient signs in with a different email address, they can select Use a different Microsoft account on the acceptance page. A person with one active workspace opens it directly. If their Microsoft directory has no Neo account yet, the chooser also offers Set up my company. With several workspaces or company setup available, they can use Switch workspace in the account menu. Each browser tab keeps its own selected workspace. A switch opens the new workspace’s home page and clears the previous page’s state. For example, an admin in Contoso MSP can add Alice from Acme Corp MSP. Alice can then access both workspaces with her assigned role in each. Bob’s existing Contoso MSP membership gives him access only to Contoso MSP. Disable a person’s membership to revoke access to that workspace. A later sign-in does not restore it. Their memberships elsewhere remain active. Acquisitions and shared billing accounts do not automatically grant access or change subscriptions. Public API admins can cancel a pending invitation without a Microsoft object ID usingDELETE /public-api/memberships/invitations with an email field in the JSON body. This cancels only a pending invitation in the selected workspace. Active memberships use the user-ID revocation endpoint.