> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# ImmyBot

> Connect ImmyBot to Triggr with a Microsoft Entra app that signs in to ImmyBot as an API user.

Triggr works with ImmyBot computers, maintenance sessions (including Run Immy Service), tenants, scripts, maintenance tasks, licences and change requests.

## Set up ImmyBot

You need an ImmyBot account that can add users and assign roles, and the Application Developer role or higher in the Microsoft tenant you sign in to ImmyBot with.

<Steps>
  <Step title="Register an app in Microsoft Entra">
    In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID > App registrations > New registration**, name it `Triggr ImmyBot`, leave the defaults, click Register and copy the Application (client) ID and Directory (tenant) ID. It needs no API permissions or redirect URI.
  </Step>

  <Step title="Create a client secret">
    In **Certificates & secrets > Client secrets**, click New client secret and copy its Value (not the Secret ID). Note when it expires: Triggr can't sign in after that.
  </Step>

  <Step title="Copy the enterprise app's object ID">
    On the app's Overview page, click the link next to Managed application in local directory and copy that enterprise application's Object ID, not the app registration's own Object ID.
  </Step>

  <Step title="Add the app to ImmyBot as a user">
    In ImmyBot, go to **Show More > Users & Roles**, click Add New User and open the Manually tab. Select your MSP tenant, enter a name and an unused email on your domain, paste the object ID into Azure Object ID and click Create.
  </Step>

  <Step title="Give the user a role">
    Edit the user, click **Direct Role Assignment**, select System Administrator (Legacy), set Scope Category to Owner, choose Allow and click Assign. A custom role also works if it has the View permissions each feature depends on; see ImmyBot's [Role-Based Access Control](https://www.immy.bot/documentation/administration/rbac/).
  </Step>
</Steps>

If your instance has no Users & Roles, follow the older route in ImmyBot's [API guide](https://www.immy.bot/documentation/integrations/build-your-own-integration/).

## Connect it in Triggr

<Steps>
  <Step title="Open the integration">
    Go to **Integrations > ImmyBot** and click Configure on the Base Configuration card.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/integrations-common/base-configuration.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=bb81acb082055015f91beda7b4876f35" alt="The Base Configuration card with Status Not Configured, Admin Consent Not Required and a Configure button." width="2272" height="330" data-path="images/integrations-common/base-configuration.png" />
    </Frame>
  </Step>

  <Step title="Enter the app and instance">
    Enter the ClientID and ClientSecret, your own tenant's Directory (tenant) ID as TenantID (or click Lookup By Domain), and only the part of your ImmyBot address before `.immy.bot`, such as `contoso`, as InstanceSubdomain. Click Save Configuration.

    <Frame>
      <img src="https://mintcdn.com/triggr/nyuVXZ1rouDTTEvu/images/immybot/configure.png?fit=max&auto=format&n=nyuVXZ1rouDTTEvu&q=85&s=f56bd119c2f8a7e265f6de6491c85dc4" alt="The ImmyBot configuration window with ClientID, ClientSecret, InstanceSubdomain and TenantID fields, a Lookup By Domain link, an Allow insecure TLS switch under Advanced, and a Save Configuration button." width="1344" height="1582" data-path="images/immybot/configure.png" />
    </Frame>
  </Step>
</Steps>

One connection covers every tenant in your instance. Actions on one tenant take its ImmyBot ID. Actions with a request body, such as Run Immy Service, take the JSON documented at `https://<subdomain>.immy.bot/swagger`.

## Troubleshooting

<AccordionGroup>
  <Accordion title="Triggr can't get an access token">
    Check ClientID and TenantID match the app, ClientSecret is the secret's Value and hasn't expired, and InstanceSubdomain is only the subdomain, such as `contoso`.
  </Accordion>

  <Accordion title="ImmyBot returns 401 Unauthorized">
    The user's Azure Object ID must be the enterprise application's Object ID. If it's wrong, create a new user with the right ID and the same role.
  </Accordion>

  <Accordion title="ImmyBot returns 403 Forbidden">
    Check the user's role assignment has Allow and covers the tenant. For a custom role, add the missing permission and the View permissions it depends on. The user's Check Access tab shows what grants or denies it.
  </Accordion>
</AccordionGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.