This article covers the prerequisites for Conversational AI, powered by Matrix42 Neo, across Matrix42 Enterprise, as well as instructions for configuring each component.

Prerequisites

This article describes everything you need to set up Matrix42 Neo properly.

1. Verify that you have the following product version and extensions:
   1. Matrix42 Enterprise.
   2. AI Intelligence Foundation (extension)
   3. Agentic Enterprise Assistant (extension)
   4. MCP for Enterprise Platform (extension)
   5. AI Assist for Service Desk (extension)
   6. AI-Native Workflow Designer (extension)
       
2. Configure the Matrix42 Intelligence connection using your organization's credentials:
   1. Subscription ID
   2. Client ID
   3. Client Secret
   4. User Client ID
   5. User Client Secret
   6. Update Private Key
   7. Save, then click Setup Authentication.
   8. Confirm a success message is returned — this indicates authentication was set up correctly.
      
      

      Administrator account with an email address

      The authentication check in step 2 runs as you, so your user needs an email address defined.

       

1. Configure the M42 Next connection using your organization's credentials:
   1. Subscription ID
   2. Client ID
   3. Client Secret
   4. Save, then click Setup Authentication.
   5. Confirm a success message is returned — this indicates authentication was set up correctly.
2. Activate and validate the new experience:
   1. Verify the Matrix42 Intelligence and M42 Next service connections.
   2. Enable the Matrix42 Intelligence and M42 Next AI Service Providers.
   3. Send an API token to Matrix42 Support
   4. Configure System and Application Prompt (optional)
   5. Configure access for UI Actions for the relevant roles and user groups.
   6. Review where the functions are displayed.
   7. Review any customized ticket previews or layouts.
   8. Activate capabiilites for AI Service Providers
   9. Configure Pilot Group for Agentic Assistant
   10. Activate Agentic Assistant per Agent applications (optional)
   11. Integrate Agentic Assistant into Unified Search (optional)
   12. Test the functionality with a designated Service Desk user.
   13. Activate Neo Agents
   14. Activate MS Teams Agentic Assistant
   15. Release the functionality to the intended users. 
3. Network access
   If your Enterprise Platform runs in your own data center, allow the connections below, all on HTTPS port 443.
    

Neo Agentic Assistant Configuration

Create Service Connection

You create one service connection and, inside it, one tenant that holds the values from Matrix42 Support.
 

1. Open Service Connections
   Go to Administration › Integration › Service Connections. Click Add.
   
2. Choose “Add Service Connection”
   Choose Add Service Connection, not Add Matrix42 Service Connection. The second option is for Matrix42 Account Services such as MyWorkspace.
   
3. Pick the service
   In Service, click the search icon and pick Matrix42 Intelligence with scope Default.
   It fills in the name Matrix42 Intelligence (Default). Keep it.
   
4. Create a new tenant
   In Tenant, click the search icon, then Create new item (the plus icon at the top left).
   
5. Enter the values from Matrix42 Support
   Set Service to Matrix42 Intelligence first. The Subscription ID field appears after that. Then fill in the fields
   
   Top of the form. The values shown are examples; enter yours from Matrix42 Support.
   
   Scroll down for User Client Secret and Private Key. Then click Save & Close. The new tenant is filled into the service connection.
6. Set up authentication
   Back in the service connection, click Setup Authentication.
   
   Wait for the success message, then click Save & Close.
   

Configure M42 Intelligence AI Service Provider

Before any component can be enabled, you need to connect Matrix42 Enterprise Platform to Matrix42 Neo through a Matrix42 Intelligence service connection and select it in Matrix42 Intelligence AI Service Provider as a Service Connection.

1. Install the Matrix42 Intelligence Agentic Enterprise Assistant from the Extension Gallery.
2. Enable the Matrix42 Intelligence AI Service Provider.
3. Create and configure the Service Connection, including the endpoint and required connection parameters, through the supported administrative mechanisms.
4. Check the checkbox “Enabled”
5. Activate required capabilites
6. Save and close
   

Neo Agentic Assistant only becomes visible where the AI Service Provider is enabled, the Service Connection is correctly configured, and the relevant capability is assigned. If any of these is missing, the Agentic Assistant simply does not appear, rather than showing a broken or partially loaded state.

Capability Activation
 

Neo functionality is activated per capability:

1. Open the capability configuration for Agentic Assistant in the Matrix42 Intelligence AI Service Provider.
2. Assign the relevant capability depending on which experience should be enabled.
3. Save and verify visibility in the target application.

Configure M42 Next AI Service Provider

Select AI Service Provider M42 Next, select M42 Service Connection, define capability AI Document Recognition, set Enable to true and Save & Close

Audience-Based Access (Pilot Group)

Using the existing Matrix42 Enterprise audience configuration, administrators can define which users, roles, or groups are authorized to use conversational AI. This is particularly useful for phased rollouts and controlled access to Neo.

Administrators can manage where Neo Agentic Assistant is available and which users can access its conversational AI capabilities. Neo can be enabled for selected audiences, including specific users, roles, or groups, allowing organizations to introduce conversational AI gradually, starting with selected departments or pilot groups before expanding availability.

By default, Agentic Assistant is available to all users. To restrict access to Agentic Assistant to specific users, roles, organizational units, or locations, configure the audience using the GetServiceProviderByCapability service operation.

1. Open Administration > Integration > Web Services.
2. Find and select the AI Service.
3. Select GetServiceProviderByCapability from the list of service operations in the service preview.
4. Click the Set Audience toolbar action.
5. Configure the required audience:
   • Unrestricted: Conversational AI is available to all users.
   • Restricted: specify the User Roles, Users, Organizational Units, and/or Locations that should have access.
6. Click SET AUDIENCE button to save the configuration.

For more information about configuring audiences, including audience inheritance and administrator access, see How to Set Audience in SolutionBuilder.

Application-Level Visibility

Neo's visibility can also be configured individually for each Matrix42 Enterprise application. For example, administrators can enable Neo in the Service Desk or Self-Service Portal while keeping it disabled in other applications, such as Software Asset Management or Unified Endpoint Management.

Configuration path: Administration > User Interface > Applications > [Select Application] > Advanced > View Options.

A configuration option named Show AI Assistant is available:

• Enabled: Neo is available within the selected application for authorized users.
• Disabled: Neo is not displayed within the selected application.

By default, Neo Agentic Assistant is enabled for the following out-of-the-box applications when conversational AI is activated: Self-Service Portal, Service Desk, Workflow Designer, Master Data, and Administration. Other applications can be configured individually.

Send an API token to Matrix42 Support

Matrix42 Intelligence uses an API token to run MSP Tools in your ESM Platform on behalf of your users. Matrix42 Support adds it to your tenant. Neo can't answer until Support has finished it.

1. Create the API token
   Go to Administration › Integration › Web Services Tokens and click Generate API Token. Fill in the dialog:
   Name: Any name, for example Matrix42 Intelligence 
   Expires on: Never expires. A token that expires stops Neo from working on that day. 
   User: A user with the Administrator role. Generate the token while signed in as an administrator; otherwise ESM Platform issues it for your own user, whatever you pick here.
   
   Set Expires on to Never expires, check the User, then click Generate API Token.
   ESM Platform shows the token once. Copy it right away; you can't display it again later. If you lose it, generate a new one and send that instead.
2. Send it to Matrix42 Support
   Send Matrix42 Support: 
   1. the API token from 6a, your ESM host name, the address in your browser without https:// and without any path. For example, for https://esm.example.com/wm/ send esm.example.com. 
   2. your Subscription ID, so Support can match the request, 
   3. any special network setup, such as a proxy, ESB, WAF or TLS inspection (see What you need). Write “none” if there is none. Use the secure channel Support gives you for this, not an open support ticket comment. The token gives administrator access to your ESM. Support confirms when your tenant is turned on.

Confirm Neo works

Do this after Matrix42 Support has confirmed that your tenant is turned on.

The Ask Neo button appears in the top bar of every application.

Troubleshooting

Setup Authentication times out, or fails with “connection reset” or “Resource Owner Flow failed”

The ESM server can't reach esam42next.m42cloud.com. Setup Authentication calls this host directly from the ESM server, several times: to get a token and to create your users there. Allowing only the Matrix42 Intelligence address isn't enough. Allow outbound HTTPS from the ESM server to esam42next.m42cloud.com (see What you need). Proxy: set it for the whole Windows server, not only in the ESM web configuration. ESM uses the server's system proxy for these calls. Check it in an administrator command prompt with netsh winhttp show proxy, and set it with netsh winhttp set proxy <proxy:port>. ESB or gateway: make sure the ESM server itself is registered or linked for outbound traffic. If access is granted by AD group, the account the ESM application pool runs as must be in it. To test from the ESM server, in PowerShell: Test-NetConnection esam42next.m42cloud.com -Port 443. TcpTestSucceeded : True means the network path is open.

TLS or certificate errors (“could not establish trust relationship”, “SSL connection could not be established”)

Something on the path is inspecting or replacing TLS certificates, usually a proxy or firewall doing TLS inspection. Exempt esam42next.m42cloud.com and api.aurora.mx42.cloud from TLS inspection, or install your inspection certificate in the ESM server's Trusted Root Certification Authorities store (Local Computer).

“No Identity Provider for provided issuer”

Matrix42 hasn't finished the setup for your subscription yet. Send this message and your Subscription ID to Matrix42 Support.

An error about the key: “Length of the data to decrypt is invalid” or “Invalid signature” 

“Length of the data to decrypt is invalid”: a secret or the private key was pasted incorrectly. Open the tenant from step 3 and paste the Client Secret, User Client Secret and Private Key again, exactly as received, with nothing before or after them. Then run Setup Authentication again. “Invalid signature”, shown as {"error":"invalid_grant","error_description":"Invalid signature"}: Matrix42 can't verify the private key in the tenant against the key registered for your subscription. Usually: the Private Key was pasted incompletely or with extra characters, the Private Key contains extra whitespace: a space, tab or empty line at the start or end, or line breaks added by an email or chat client, or it's an older key, and Matrix42 has since issued a new one for your subscription. Open the tenant from step 3 and check the Private Key field: it must start and end directly with the key text, with no spaces or empty lines before or after it. If you copied the key from an email or chat, copy it again from the original file or a plain text editor. Paste the key you received most recently and run Setup Authentication again. If the error stays, ask Matrix42 Support to check the key for your Subscription ID. They can issue a new one.

The Ask Neo button doesn't appear 

Check these two things, then reload the page: The Function Engine Dispatcher service is running. On the ESM server, open Services (services.msc) and find Matrix42 Function Engine Dispatcher (service name Matrix42.FunctionEngine.Dispatcher). Its status must be Running; if it isn't, start it. Set its startup type to Automatic so it starts again after a restart. Without this service, the button doesn't appear. The AI service provider is set up. Open M42 Intelligence again (step 4) and check that Enabled is selected, the service connection from step 3 is set, and Conversational AI for Agents is listed under Capabilities. To check the service from PowerShell on the ESM server: Get-Service Matrix42.FunctionEngine.Dispatcher, and to start it: Start-Service Matrix42.FunctionEngine.Dispatcher 

The Ask Neo button appears, but Neo doesn't answer 

Matrix42 Support hasn't turned on your tenant yet. Check that you've sent the API token and ESM host name (step 6) and that Support has confirmed. If the token has expired or was deleted under Web Services Tokens, generate a new one with Never expires and send it to Support again. 

Neo answers, but can't find your tickets or data 

Matrix42 Intelligence can't reach your ESM from the internet. Allow inbound HTTPS to /m42Services/api/ from 172.211.161.187 (see What you need). If that's already allowed, the cause is usually a web application firewall or a gateway in front of ESM. See the next two entries. 

A web application firewall (WAF) blocks Matrix42 Intelligence, even with the IP address allowed 

Typical signs: Support reports 404 Not Found or a generic error page for /m42Services/api/, but the same address and API token work from a browser or Postman. The usual cause is the WAF's bot protection (also called anti-automation or bot mitigation). It is a separate policy from IP allow lists. It recognizes Matrix42 Intelligence as an automated client from how the connection is made, not from the IP address or headers. So adding 172.211.161.187 to the IP allow list doesn't help, and the WAF can return 404 instead of a clear block message. Ask your WAF administrator to: exempt the path /m42Services/api/* from bot protection for source 172.211.161.187. This path is a machine-to-machine API, not a browser page, so it doesn't need bot checks; check the WAF log at the time of a failed call to see which rule fired. A quick check: if /m42Services/api/ answers from a browser on a network that isn't on your allow list, the WAF isn't filtering by IP address at all, and bot protection is the likely cause. 

Calls from Matrix42 reach your gateway or ESB but never arrive at ESM 

Still stuck? Contact Matrix42 Support with your Subscription ID, the exact error message with the time it happened, and a short description of your network setup (proxy, ESB, WAF, TLS inspection).

Configure System and Application Prompt (optional)

System Prompt

The system prompt defines the general instructions and behavioral rules applied when AI Functions are executed through the configured AI Service Provider. 

It can be used to establish common requirements such as: 

• Expected response style and tone
• Language behavior
• Formatting conventions
• Security and compliance instructions
• Restrictions on unsupported or unsafe responses
• General rules that should apply across multiple AI Functions 

The system prompt is combined with the function-specific prompt at runtime. The system prompt provides the general execution context, while the AI Function prompt defines the concrete task, such as detecting a ticket category, translating text, or suggesting a resolution. 

To configure the system prompt: 

1. Go to Administration.
2. Open System Settings → Intelligence.
3. Enter or update the AI Function System Prompt. 
4. Save the settings.
5. Test the affected AI Functions. 

Administrators should keep the system prompt generic and reusable. Instructions that are specific to one business use case should be defined in the corresponding AI Function implementation instead. 

Changes to the system prompt may affect all AI Functions. The updated prompt should therefore be tested before being introduced into productive use.

Application Specific Prompt

In addition to the account-wide system prompt described above, an administrator can define a dedicated AI Application Prompt for each Matrix42 Enterprise application. This prompt adds further context, business rules, terminology, and response guidance that applies only when an AI Function is executed from that specific application.

For example, AI Functions executed in the Self Service Portal can be configured to use simple, employee-friendly language and prioritize self-service solutions, while the same AI Functions executed in the Service Desk can use ITSM terminology and provide more detailed recommendations for agents.

Workflow Designer's Execute Native AI Functions action can also select an application context, so an automated workflow benefits from the same application-specific instructions as a manually triggered AI Function.

Activate & Configure Matrix42 Neo Agents

Step 1: Activate Neo Agent for Ticket Triage & Resolution

1. Open the Workflow Designer application. 

2. Navigate to Workflows. 

3. Search for AI Agent for Ticket Preparation. 

4. Select the workflow. 

5. Click Activate if the workflow is currently inactive. 

The workflow is now available for execution according to its configured trigger. 

Note: The default workflow is triggered through a Compliance Rule when a ticket is created. 

Step 2: Configure Neo Agent for Ticket Triage & Resolution

Configure Neo Agents in Service Desk Navigate to Service Desk → Settings → Global System Settings → AI Agents. 

This page provides centralized settings for AI-powered ticket processing. 

Confidence Threshold 

Defines the minimum confidence score required for AI Agents to apply changes automatically. 

• Default value shown: 75 
• If the confidence score meets or exceeds the threshold, the AI Agent can automatically apply the detected changes.
• If the confidence score is below the threshold, the AI Agent only proposes changes for manual review. 

Image Analysis 

Perform Image Analysis During Ticket Processing 

When enabled, AI Agents can analyze images attached to tickets to better understand reported issues and improve their analysis. 

Ticket Auto-Resolution 

When enabled, the AI Agent searches for a suitable resolution. If a high-confidence solution is found, it can automatically update the ticket resolution, notify the requester by email, and set the ticket to Resolved. 

Available settings:

Enabled: Activates automatic ticket resolution. 

Advisory Mode: Adds resolution suggestions to the Ticket Journal without automatically applying changes. 

Show Auto Resolution Journal Entry To End User: Controls whether auto-resolution journal entries are visible to end users or remain internal to agents. 

Continue Ticket Preparation After Successful Auto-Resolution: Allows ticket preparation to continue after automatic resolution, including classification and assignment-related processing. 

Maximum Follow-ups: Defines how many times the AI Agent can request additional information from the user when attempting to resolve a ticket. 

Ticket Service Auto-Detection 

Allows the AI Agent to identify a suitable service based on ticket information.

Enabled: Activates automatic service detection. 

Advisory Mode: Adds service suggestions to the Ticket Journal without applying changes automatically. 

Ticket Auto-Routing 

Allows the AI Agent to suggest or apply ticket routing based on the available ticket information. 

Enabled: Activates AI-powered ticket routing. 

Advisory Mode: Adds routing suggestions to the Ticket Journal without applying changes automatically. 

Ticket Preparation 

Enabled Activates AI-powered ticket preparation. 

When enabled, the AI Agent: 

1. Analyzes the ticket description and available context. 

2. Detects ticket type, category, impact, and urgency. 

3. Applies detected values automatically when the confidence threshold is met. 

4. Calculates ticket priority. 

5. Assigns the responsible team based on the detected category. 

6. Records the changes in the Ticket Journal. 

Step 3: Save the Configuration Click Save & Close to apply the settings.

The activated Neo Agent will process tickets according to its configured trigger and the enabled AI Agent settings. 

Important: Ticket Auto-Resolution, Service Auto-Detection, and Auto-Routing are separate capabilities that can be enabled independently. They do not all need to be enabled to use the AI Agent for Ticket Preparation.

Integrate Agentic Assistant to Unified Search

Enabling the Conversation AI for End Users capability adds a natural-language conversational entry point to the Self Service Portal. Exactly how it appears depends on the portal's Unified Search configuration.

1. Assign the Conversation AI for End Users capability.
2. Selecting Integrate Conversational AI in Unified Search will activate Ask Neo button to appear near the Search

If Matrix42 Neo is installed and configured, default activation for the Self Service Portal follows the agreed product configuration. If the Matrix42 Neo service is temporarily unavailable, the portal falls back to Global Search and logs an error; it will not show a broken or permanently loading component, even if the configuration is incomplete or invalid.

Workflow Designer (Builders)

Conversational capabilities in Workflow Designer are enabled the same way as other components, through capability activation, and cover two scenarios: workflow generation and workflow explanation.

1. Enable the Workflow Agent capability for Workflow Designer.
2. Confirm that workflow administrators can access both the workflow proposal generator and the workflow explanation feature.

Workflow Generation

• A user describes the required workflow in natural language; the request is passed to the planner and generator services.
• The generator only produces components exposed through supported Workflow Designer tools. It does not invent unsupported triggers, actions, conditions, or property values, and ambiguous or unresolved references are not silently mapped to arbitrary values.
• The completed proposal transfers into Workflow Designer, remains fully editable, and is not automatically activated or executed.
• If generation fails, no partially configured active workflow is created.
• Results are returned after processing completes; streaming is not supported in this Technical Preview.

Workflow Explanation

• A user can request a plain-language explanation of an existing workflow from a supported Workflow Designer view.
• The explanation is based on read-only analysis. It does not execute, modify, save, publish, activate, deactivate, or create a new version of the workflow.
• The explanation covers what starts the workflow, which records or users it applies to, and what outcome it produces, using available display names and localized labels instead of technical identifiers where supported.
• Unsupported or unrecognized elements are clearly indicated where they materially affect interpretation, and the explanation does not invent behavior not present in the workflow definition.
• Access to the explanation respects the user's existing permission to view the workflow.

Microsoft Teams Configuration

Microsoft Teams integration requires additional setup beyond capability activation, since it involves connecting a Teams environment and mapping identities between Teams and Matrix42 Enterprise.

1. Enable the Conversational AI capability for Microsoft Teams.
2. As a customer administrator, connect your Microsoft Teams environment to Matrix42 Enterprise, following the prerequisites, permissions, and application registration steps in the Teams setup documentation.
3. Configure user mapping so each Microsoft Teams identity resolves to the corresponding Matrix42 Enterprise user. Requests are then executed in the context of that authenticated user through impersonation, respecting the user's existing Matrix42 permissions and data access.
4. Install MS Teams app for Neo Agentic Assistant
5. Verify authenticated end users can open the conversational experience from Teams, ask a question, get guidance for a supported simple issue, report an unresolved issue, or request a supported simple service.

A successfully reported issue or submitted request creates the corresponding Matrix42 record, and the assistant confirms this with an available identifier or reference. 

MCP Tools configuration

Administrators can view the available MCP tools under Administration → Integrations. 

Configuring Access to MCP Tools

 Customer administrators can control access to individual MCP tools using the Set Audience action. 

Currently, two access options are supported: 

Unrestricted (default): The MCP tool is available to all users with access to the relevant functionality. 

Restricted to selected users: Administrators can limit access to specific users. 

Planned Enhancement: Role-based audience configuration, allowing administrators to grant access to MCP tools based on user roles, is planned for a future update.