Skip to main content

​
Overview

Use this recipe when new users are created in on-prem Active Directory and then synced to Microsoft 365 through Azure AD Connect. In a hybrid identity environment, Neo creates or updates the user in Active Directory, then triggers an Azure AD Connect sync so the change appears in Entra ID and Microsoft 365.
If users are created directly in Entra ID, use the cloud Microsoft 365 setup. If users only exist in local Active Directory and never sync to Microsoft 365, use on-prem Active Directory setup without Hybrid.

​
When to use Hybrid

“Hybrid” assumes a working Azure AD Connect sync. If your AD Connect was decommissioned (or never existed) but you still maintain both directories, pick “Hybrid (no AD Connect sync)” instead — Neo will then create and manage users in both on-prem AD and Entra ID directly. With plain “Hybrid” and no working sync, the on-prem user is created but never reaches Microsoft 365, so licensing and mailbox steps can’t proceed.

​
Setup checklist

​
Configure the company

Go to Companies in Neo and open the end-client company. Set:
  • Identity Provider Type: Hybrid
  • AD Runner Hostname: the RMM device Neo should use to run Active Directory commands
  • AD Connect Server Hostname: the server running Azure AD Connect
  • AD Service Account Username / Password: only if the runner needs a dedicated domain service account
Hostnames must match the device names discovered from your RMM. See the on-prem setup guide for field details.

​
Configure the RMM path

Neo runs on-prem Active Directory commands through your RMM. Before using a hybrid onboarding agent:
1

Upload the wrapper script

Follow the Neo wrapper script setup for your RMM.
2

Sync RMM devices and scripts

After uploading the script, run an RMM sync in Neo so the script and devices are discoverable.
3

Confirm the runner machine

If Neo should run AD commands from a runner instead of directly on the domain controller, follow the runner machine setup.
4

Verify connectivity

Run the checks in Verify Connectivity before running the agent live.

​
Configure the onboarding agent

Create or edit an Onboard/Offboard M365 User agent or workflow. On the agent’s Integrations tab, use a Microsoft 365 access profile that allows the onboarding work you want Neo to perform. For hybrid onboarding, the key requirement is that Neo can make the on-prem AD change and trigger Azure AD Connect sync. If the agent also needs to create or manage mailboxes through on-prem Exchange, see Exchange Hybrid setup.
Start with Technician-in-the-Loop enabled for write actions. Once the workflow is proven, reduce approval steps where appropriate.

​
Common errors

​
Before running live

1

Confirm company identity mode

The company should be set to Hybrid if Neo needs to trigger Azure AD Connect sync.
2

Confirm RMM script execution

The Neo wrapper script should be uploaded and visible after RMM sync.
3

Confirm AD Connect access

The service account should be able to trigger sync on the AD Connect server.
4

Run with approval first

Use Technician-in-the-Loop approval for the first few onboarding runs.