New DEX certifications launch at Experience '26. Get certified and learn from experts in your field.
Register now
Ctrlk
Support
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Setting up and managing AI Tools

Configure AI Tools and its content to ensure AI Tools users can fully benefit from it without interruptions.

To start configuring AI Tools:

After configuration is complete in your Nexthink instance, manage AI tools content.

Before you begin

Complete the following prerequisites to ensure the correct configuration and monitoring of AI tools, and facilitate a smooth onboarding:

1

Deploy the Nexthink browser extension for data collection

Install and deploy Nexthink browser extension—25.8.1 or newer—across all employee devices to allow Nexthink to collect data for AI tool web usage.

Nexthink browser extension cannot track the web usage of AI tools on Mozilla Firefox

2

Validate Collector version for the deployment of built-in campaigns

Ensure all employee devices have Collector version 25.5.1 or newer. This guarantees the correct deployment of built-in Nexthink campaigns, which you should enable from the specific AI tool configuration, to collect employee feedback on AI usage, necessary for monitoring employees' perceptions of AI tools.

Run the following query in the Investigations module to list devices with an unsupported Collector version:

devices
| where collector.version < v25.5.1
3

Enable the focus_time field for monitoring desktop AI tools

Make sure to opt in and activate the focus_time field for execution.events , by using the Set Collector Configuration remote action from the library pack from Nexthink Library.

The system estimates AI usage on Desktop-type applications using the focus_time field. Without focus_time, Nexthink cannot monitor AI-tool interactions on desktop applications.

4

Set up connector credentials and Entra ID connector for Microsoft Copilot

The system uses API-based configuration for Microsoft Copilot, which requires the configuration of connector credentials and Entra ID connector in Nexthink.

Configure connector credentials

This section references external sources. Nexthink does not control the accuracy of third-party documentation or any external updates or changes that might create inconsistencies with the information presented on this page. Please report any errors or inconsistencies to Nexthink Support.

Step 1 - Configure the Azure application

Configure the application from the Azure page to retrieve AI-employee interaction data:

  1. Sign in using your Azure credentials.

  2. Register a new application.

    • During the registration process, select the Single tenant option.

  3. For the Redirect URL, select Web.

    • If the application already exists in the Azure portal, you can reuse the application to assign the permissions to retrieve AI-employee interaction data.

  4. Register the application.

  5. Access the API Permissions option from the left-side menu.

  6. Add permission for Microsoft Graph.

    • Select AiEnterpriseInteraction.Read.All and add the API permission. See the images below.

    The Status column on the permissions list indicates if the Azure account you are using lacks proper privileges. Refer to the Register an application with the Microsoft identity platform documentation from Microsoft for more information on the steps listed above.

  7. Access the Overview section of the configured application to copy and save Azure AD credentials for the Nexthink connector configuration.

    • Application (client) ID

    • Directory (tenant) ID

    • Generate and copy the client secret Value in the Azure portal using the Certificates and secret option for the Nexthink tool configuration.

      • Select New client secret.

      • Fill in the Description and Expiration values.

      • Select Add and copy the Value.

After the expiration date, you need to update the client secret in the Azure portal and for the Nexthink connector credentials.

Step 2 - Configure the Microsoft Copilot connector credentials in Nexthink

From the connector credential configuration page, fill out the fields using the information from the connection you created in Azure.

  1. Choose the HTTPS option from the Protocol drop-down.

  2. Paste the Microsoft API https://graph.microsoft.com into the URL address field.

  3. Choose the OAuth 2.0 - Client Credentials option from the Authorization drop-down.

  4. Copy the Directory (tenant) ID from the Copilot connection and paste it into the Access token URL field—include the whole URL string:

    • https://login.microsoftonline.com/<<Tenant ID>>/oauth2/v2.0/token

    • Example: https://login.microsoftonline.com/2efa03d5-62e6-XXXX-XXXX-XXXXXXXXXXXX/oauth2/v2.0/token

  5. Enter the Client ID and Client secret you obtained from configuring the Azure application.

  6. Add https://graph.microsoft.com/.default in the Scope field.

  7. Select Header under Authorization information. Nexthink advises against selecting Body based on Request for Comments (RFC) standards.

  8. Save the credential.

Set up the Entra ID connector

The system uses the Entra ID connector—that you must configure—to collect user-license data and tag interaction events based on whether the employee uses a free or licensed version of Microsoft Copilot.

Refer to Microsoft Entra ID (Azure AD) connector for configuration steps.

Nexthink AI Tools collects user-license data for Microsoft Copilot by default, even if you do not configure Microsoft Copilot in AI Tools. Refer to F.A.Q about Microsoft Copilot data retrieval for more details.

5

Configure user organization fields for usage breakdowns tailored to your organization

Nexthink User organization fields enable custom dashboard filters that align with your organization structure and employee groups.

Depending on the data field enrichment method, you may use the Entra ID connector configured in step 4.

Refer to Configuring User organization to create and enrich user organization fields.

6

Enable domain names for tool detection for AI governance

Enable domain names at Collector level to ensure the system can detect all AI tools in use within your environment—this is essential for the correct functioning of AI tool governance features.

To enable domain names, download and run the Set application connectivity configuration remote action from Nexthink Library.

Running a remote action from Nexthink Library to enable domain names

From Nexthink Infinity web interface:

  1. Download the Set application connectivity configuration remote action from Nexthink Library.

  2. From the main navigation panel, go to Remote Actions > Manage remote actions to open the Remote Actions Administration page.

  3. From the Remote Actions Administration page, use the table search bar to find the Set application connectivity configuration remote action. Open the action menu to Configure the remote action settings.

  1. From the remote action configuration, under the General tab:

    • Select your preferred Trigger. Execute the remote action manually or schedule it to run periodically.

    • Ensure you target all Devices and VDI sessions if applicable.

  2. From the remote action configuration, under the Script tab:

    • Set the Value of allow_domain_names_reporting to True.

    • Set the Value of set_data_privacy_filter to ALLOW\* all domains. Refer to Domain name with wildcard for more information.

    Nexthink Collector reports network connections by default. However, if you have disabled network connection reporting in the past, make sure you set the Value of allow_connection_data_reporting to True.

  3. After saving the Set application connectivity configuration remote action configuration, you should execute it manually. Refer to Executing remote actions from the Manage remote actions page

Nexthink detects all AI tools in use based on connection.events data. The system maps the observed AI tool domains to be displayed under the AI tools governance tab.

domain reporting is not scoped to specific users or tools—it's an instance-wide Collector setting.

7

Grant permissions for AI Tools

Enable permissions for the AI Tools module as an administrator.

  1. Select Administration > Roles from the main navigation panel.

  2. Create a New Role or edit an existing role by hovering over it.

  3. Under the Permissions section, scroll down to the AI Tools section to:

Enable permissions for AI adoption monitoring and management

Enable permissions for AI adoption monitoring and management:

  • Manage all AI tools to create and manage AI tools configured by your organization for AI adoption monitoring.

  • View all AI tool dashboards to monitor AI adoption dashboards and insights.

Enable permissions for AI tools governance

If needed, you may grant permissions specifically for AI tools governance, separate from the adoption monitoring permissions listed above.

  • Manage AI tools governance to manage governance policies for all AI tools, and add new AI tools to assign them governance policies, if required.

  • View AI tools governance to see AI tools governance dashboard data.

User roles with only AI tools governance permissions cannot access any AI adoption-related data, configurations, or dashboards from anywhere in the product.

  1. Ensure you grant Data Model Visibility into AI Tools to the specific user role. Refer to Data Model Visibility for more information.

Key AI Tools configuration concepts

AI-tool application types: Desktop and Web

Nexthink supports the following types of application configurations for AI tools:

  • Desktop AI applications require their respective Binaries running the AI tool interaction.

  • Web AI applications relies on the URL for the Conversation endpoint path used to detect interactions with the AI tool.

Refer to Configuring AI tools for Nexthink monitoring.

The API-based setup is only available for Microsoft Copilot. Refer to Configuring Microsoft Copilot using API credentials.

User-target exclusions for built-in campaigns

Built-in campaigns for AI Tools have uneditable content, deployed under specific conditions. However, if needed, you can modify AI-tool campaign settings to exclude specific users from campaigns and change campaing sender information details.

Refer to Modifying campaign setups for AI tools.

To learn about the AI Tools campaign content, deployment conditions and interpretation, refer to Built-in campaign content for sentiment tracking.

Last updated

Was this helpful?