Skip to content
ConduitConduit

Connect ImmyBot to Conduit

This walkthrough connects ImmyBot (RMM) to Conduit. ImmyBot authenticates through Microsoft Entra ID: you register an app in your Entra tenant, authorize it in ImmyBot, and give Conduit four values — your instance subdomain, Entra tenant ID, and the app registration’s client ID and secret. Conduit exchanges these for a token against login.microsoftonline.com and calls your *.immy.bot instance with it.

Before you start

Section titled “Before you start”

You need:

  • A Conduit role that can manage connections — owner or admin on your organization.
  • Admin access to the Microsoft Entra tenant that backs your ImmyBot instance (to create an app registration and a client secret).
  • Admin access to ImmyBot (to authorize the app registration — an app that isn’t authorized in ImmyBot will mint tokens successfully but be rejected by the instance).
  • Your ImmyBot instance subdomain — the first part of your instance address: yourcompany for yourcompany.immy.bot.

Step 1 — Register an app and authorize it in ImmyBot

Section titled “Step 1 — Register an app and authorize it in ImmyBot”
  1. In Microsoft Entra ID, create an app registration and a client secret for it, following ImmyBot’s API guide. Expected: a Tenant ID, Client ID (both GUIDs), and a client secret value, shown once at creation.
  2. In ImmyBot, authorize the app registration in your instance, per the same guide.
  3. Copy the tenant ID, client ID, and client secret.

Step 2 — Connect ImmyBot in Conduit

Section titled “Step 2 — Connect ImmyBot in Conduit”
  1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
  2. Find ImmyBot in the catalog (under RMM) and click Connect. Expected: a credential form with four fields.
  3. Fill the fields:
    • Instance Subdomain (required) — just the subdomain: yourcompany (it becomes yourcompany.immy.bot). Letters, digits, and hyphens only — not a full URL.
    • Entra Tenant ID (required) — the GUID of your Entra tenant (format 00000000-0000-0000-0000-000000000000).
    • App Registration Client ID (required) — the GUID of the app you registered in Step 1.
    • App Registration Client Secret (required) — the secret from Step 1.
  4. Click Connect. Expected: Conduit performs the full chain immediately — mints an Entra token for the app, then calls your ImmyBot instance with it — and shows a green Connected status. A bad value anywhere in the chain is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this ImmyBot connection. (For per-technician credentials, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Section titled “Verify it worked”

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only ImmyBot tool, such as listing tenants. You should get real data back, and the call appears in your audit log with the correct user, vendor (immybot), and a successful status.

Troubleshooting

Section titled “Troubleshooting”
Symptom Likely cause
Connect fails with “Missing required ImmyBot field(s): <fields>.” One or more of the four fields was left empty. All four are required.
Connect fails with “Instance subdomain must contain only alphanumerics and hyphens (DNS-label characters).” The subdomain field contains a full URL or invalid characters. Enter just yourcompany, nothing else.
Connect fails with “ImmyBot OAuth token exchange failed (HTTP <status>). Check tenant ID, client ID, and client secret.” Entra ID rejected the token request — a wrong tenant ID, client ID, or an expired/incorrect secret. Verify all three GUID/secret values against the app registration.
Connect fails with “ImmyBot rejected the OAuth-issued token. Confirm the app registration is authorised in your ImmyBot instance.” The Entra side is fine, but ImmyBot doesn’t trust the app yet. Authorize the app registration inside ImmyBot (Step 1.2) and reconnect.
Connect fails with “ImmyBot returned HTTP <status>. Verify your instance subdomain.” The token worked but the instance URL didn’t — usually a typo in the subdomain. Confirm https://<subdomain>.immy.bot is your instance.
Connect fails with “ImmyBot validation failed: <details>” Conduit couldn’t complete the validation chain — commonly a network error reaching Entra or the instance. Retry, then check the values.
Tool calls return 403 “no credentials for vendor” ImmyBot isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has credentials.
Need to rotate the secret Create a new client secret on the app registration, then update the credential at /org/catalog. Delete the old secret in Entra once the new one is connected.
Section titled “Related”