Admin Setup Wizard

The Admin Setup Wizard guides you through provisioning a Personal Assistant for an employee. This is the first phase of PA setup, once you complete the wizard, the employee receives an email inviting them to personalize and activate their assistant.

Prerequisites

Before starting the setup wizard, ensure you have:

• Administrator access to Control Bridge (requires users:write permission)
• At least one LLM provider configured (navigate to Workforce > Intelligence > AI Models)
• A shared mailbox in Microsoft 365 for the PA to use as its email identity (or be ready to create one)
• The employee's user account synced from Microsoft Entra ID

Creating the PA

1. Sign in to Control Bridge
2. Navigate to Administration > Users
3. Click on the employee you want to create a PA for (or click Add User to create a new user)
4. On their user page, click Create PA

info

Having a Personal Assistant is not a role - it's a fact about the person. Clicking Create PA works regardless of the employee's role (or if they have none at all), and does not change it.

After clicking Create PA, you are automatically redirected to the PA Admin Setup Wizard for that employee.

Returning to an Incomplete Setup

The wizard is mandatory but deferrable. If you need to leave before completing it, you can save your progress and return later:

• Each wizard step has a Save & Exit button that preserves your progress
• On the user's page, the Personal Assistant card says the setup isn't finished yet
• Click Create PA on that card again: it resumes the wizard where you left off rather than starting a second assistant
• Until you complete the wizard, the PA remains in the pending_admin_setup state

Wizard Step 1: Assign a Shared Mailbox

Select or create a shared mailbox that the PA will use as its email identity. This is the email address employees and external contacts will use to reach the PA.

Configuration

Field	Description
Shared Mailbox	Select from shared mailboxes in your Microsoft 365 organization that are not assigned to any other agent or PA

How to Create a Shared Mailbox

Option A: Microsoft 365 Exchange Admin Center

1. Go to admin.microsoft.com > Exchange > Mailboxes
2. Click "Add a shared mailbox"
3. Enter a display name (e.g., "John Doe's Assistant")
4. Enter an email address (e.g., john.doe.pa@company.com)
5. Click "Save"

Option B: PowerShell

New-Mailbox -Shared -Name "John Doe PA" -PrimarySmtpAddress john.doe.pa@company.com

Recommended email formats: john.doe.pa@company.com or john.doe.assistant@company.com, but any address works.

Only shared mailboxes not currently assigned to any agent appear in the dropdown. The system checks both existing agents and PAs in pending states to avoid conflicts. If you just created a mailbox, click the Refresh button to update the list.

warning

Each shared mailbox can only be assigned to one agent or PA. If the mailbox you need is already in use, you must either choose a different mailbox or remove the mailbox from the other agent first.

Wizard Step 2: Select Available Tools

Choose which tools the employee will be allowed to assign to their PA. The employee selects from this approved pool during their own setup.

Configuration

Field	Description
Available Tools	Checkboxes for each tool in your tenant (global and tenant-specific), grouped by category (Communication, Research, Data, etc.)

Tools are grouped by category with search and filter options. You can toggle all tools or select individually. Each tool displays its name and a brief description on hover.

info

If you later remove a tool from the available pool, it is automatically removed from the employee's PA if they had assigned it. The employee receives a notification specifying which tool was revoked.

Wizard Step 3: Select Allowed LLM Models

Choose which AI models the employee can use with their PA. Different models have different capabilities and costs.

Configuration

Field	Description
Allowed Models	Checkboxes for each model configured in your tenant's AI Providers settings

Only models that are configured and active in your tenant's LLM provider settings are shown. At least one model must be selected to proceed.

tip

If cost management is a priority, consider limiting the available models to efficient options like GPT-4o-mini or Claude Haiku. Employees can always request access to additional models through their administrator.

Wizard Step 4: Additional Settings

Configure working hours. These settings establish boundaries for the PA. The employee can adjust their preferences within these boundaries during their own setup (for example, wake-up frequency within the working hours you define).

Configuration

Setting	Description	Default
Working Hours (optional)	The PA only performs scheduled work during these hours (e.g., 9:00 AM - 5:00 PM). Leave blank to allow the PA to work at any time. Scheduled wake-ups are evenly distributed within this window.	Unrestricted
Timezone	Timezone for interpreting working hours	Tenant timezone

info

There is no cap on how many times a PA can run per day. Spend is bounded by the PA's Usage Limits (daily and monthly cost caps) and by your organization's cost limits.

Completing the Wizard

Click Complete on the final step to finish the admin setup. This triggers the following actions:

1. The PA status transitions from pending_admin_setup to pending_employee_setup
2. The employee receives a setup email sent from the PA's shared mailbox (the mailbox you selected in Step 1)
3. The employee's account shows "PA Ready for Setup" in the user management list

Setup Email

The employee receives an email containing:

• Confirmation that they have been assigned a PA, including who assigned it
• The PA's email address (shared mailbox)
• A direct link to the PA Hub where they can complete their setup
• A brief overview of what the setup process involves (about 5 minutes)
• Instructions to contact their administrator with questions

Privacy Policy Configuration

The PA privacy policy is a tenant-level setting that applies uniformly to all PAs in your organization. It controls what administrators can see about PA activity but does not restrict what the PA itself can do.

Navigate to the PA configuration area in Control Bridge to select the privacy level:

Level	What Admins See	Best For
Private	Only PA existence, status, name, and activation date	High-trust organizations prioritizing employee autonomy
Metadata Only (default)	Plus execution count, token usage, cost, tool usage stats, goal titles (not descriptions), last active	Organizations needing cost visibility and usage monitoring
Full Visibility	Plus full goal/project/task details, activity log, chat history, custom instructions, employee profile data	Regulated industries, high-security environments, or required administrative oversight

warning

Changing the privacy policy takes effect immediately for all PAs in your organization. All PA users receive a notification about the change. Consider communicating the reasons to your team proactively.

Post-Setup Configuration

After the employee activates their PA, you can modify settings at any time on the assistant's settings page. Go to Workforce > Personal Assistants and select the assistant, or open the user from Administration > Users and select Manage PA Configuration. A PA that is still being set up opens the setup wizard instead.

The Assistant's Settings Page

An active PA opens in the same settings page every agent uses (/workforce/agents/{agentId}), organized into sections:

• Pause and Resume in the command bar at the top of the page
• Usage: execution count, token usage, and estimated cost (visible at Metadata Only and Full Visibility privacy levels)
• Tools: the tools the employee may use, Copy tools from another employee, and the employee's LinkedIn controls
• Mailbox: the shared mailbox the PA monitors
• Autonomy: the autonomy ceiling
• Spending limits: usage limits
• Danger zone: Reset Onboarding, Reset, and Delete

Older links to the PA Admin Configuration page (/administration/users/{userId}/pa-config) still work: they open this page.

What Admins Can Change

Setting	Effect	Employee Notified?
Available tools	Add or remove tools from the employee's approved pool	Yes (with specific tool names if removed)
Allowed models	Add or remove LLM models	Yes
Working hours	PA respects new hours on the next cycle	Yes
Pause (admin-initiated)	Immediately stops PA execution; employee cannot resume without admin resuming first	Yes
Resume	Restarts PA execution and calculates next wake-up; employee can resume their own pauses	Yes
Deactivate	Stops all PA activity; requires full re-setup to reactivate	Yes
Privacy policy	Applies immediately to all PAs in the organization	Yes (all PA users notified)

info

When you make changes, the employee receives an in-app notification (and optionally an email) describing what changed. If you remove a tool that the employee had actively assigned to their PA, the notification specifically names the revoked tool.

Setting Usage and Inbox Triage Budgets

1. Open the employee's assistant from Workforce > Personal Assistants.
2. Select the Spending limits section and find Usage Limits.
3. Review Max Daily Usage Cost ($) and Max Monthly Usage Cost ($).
4. Set Max Daily Inbox Triage Cost ($) beside the daily usage field. It appears below that field on narrow screens.
5. Enter a numeric amount of at least $1, no higher than Max Daily Usage Cost ($). The default triage budget is $5.
6. Select Save Usage Limits and check for Usage limits saved.

The triage budget covers Inbox Triage screening and runs. It resets at midnight in the tenant's timezone and must fit within the PA's daily usage budget. Tenant-wide spending limits still apply. If you lower the daily usage budget, lower the triage budget in the same save when needed.

Usage limits cannot be edited until the PA has an agent assigned. The Inbox Triage budget field is available for Personal Assistants and AICOS, and does not appear for standard agents, SMEs, or AIPSO.

What Admins Cannot Change

Even with full administrative access, you cannot modify employee-owned settings:

• PA name, avatar, communication style, or custom instructions
• Employee's goals, projects, or tasks
• Employee's data access permissions (primary mailbox, calendar, contacts, files)
• Employee's wake-up frequency or summary preferences
• Employee's tool assignments (you control the approved pool; employee selects from it)
• Employee's preferred LLM model (you control approved models; employee selects their preference)

These settings are controlled by the employee within the boundaries you define. This boundary-based model ensures the PA remains personalized while maintaining organizational oversight. See Privacy & Governance for the full governance model.

SharePoint and Teams sites

SharePoint and Teams sites come with Workforce. On Outermind Assistant an assistant reads the person's own OneDrive.

Key Features & Limits

Usage Limits

A PA has no daily execution cap. Scheduled wake-ups, email triggers, chat messages, and manual "Wake Up Now" requests all run as they arrive. Spend is bounded by the PA's Usage Limits in the Spending limits section of its settings page (a daily and a monthly cost cap) and by your organization's cost limits. When a cost cap is reached, the next scheduled wake-up moves to the next day's first slot, where the caps are checked again. A monthly cap stays reached until the month rolls over or the cap is raised.

Outermind Assistant: Add Company Connectors

Location: Outermind Assistant admin home > Connections

In Outermind Assistant, use the admin home's Connections panel to add services for your company. The panel lists the connectors your company has added. If none have been added, it shows No connectors added yet.

Outermind Assistant includes one connector, LinkedIn. Google Drive and Slack connect at company level, so they come with Workforce, as do the other connectors (HubSpot, QuickBooks, Affinity, GitHub, ElevenLabs, Azure Communication Services SMS, Twilio SMS, and Azure Cost). A line under the connector rows notes this: "Company systems such as your CRM, accounting, Google Drive or Slack come with Workforce."

Add a Connector

1. Open the Outermind Assistant admin home and find Connections.
2. Select Add a connector to open the service picker.
3. Beside LinkedIn, select Connect.
4. Enter a Connection name using lowercase letters, numbers, or hyphens, enter a Display name, choose Personal or Company page, and select Continue to LinkedIn to authorize access.
5. Check the connection in Connections.

Request a Connector

If a service you need is not offered, use the request form to tell Outermind:

1. In the picker, select Request a connector.
2. Tick any of the launch candidates you would use: Box, Zoom, Notion, Asana.
3. If what you need is not on the list, fill in Something else with its name.
4. Describe what you would use the connector for, then submit.

You must tick at least one box or fill in the name field to submit. Outermind receives the request as a feature request for review.

Manage an Existing Connection

• Check the account shown under the connector. If it shows Needs reconnecting, select Reconnect and complete the connection flow again.
• To remove an account, select Disconnect, read the confirmation, and confirm. Assistants lose access through that connection; connection history and pending operations may be removed. Follow any additional instructions displayed after disconnecting.

Connector FAQ

Why is a service absent from the Connections panel?

The panel lists connectors your company has added. Select Add a connector to see the available service (LinkedIn), or use Request a connector to ask for something else.

What happened to Google Drive, Slack, HubSpot, QuickBooks, Affinity, GitHub, ElevenLabs, Azure Communication Services SMS, Twilio SMS, and Azure Cost?

These connectors come with Workforce rather than Outermind Assistant. Existing connections and their data are not removed; see your Workforce admin console to manage them.

What if connectors or account details do not load?

Select Retry beside the load error. If starting a connection fails, try connecting again.

Can I add a connector without opening the full Capabilities area?

Yes. The picker opens the required setup page directly, even though the full Capabilities area is hidden in Outermind Assistant.

Troubleshooting

Shared Mailbox Not Listed

If your mailbox does not appear in the selection:

1. Verify the mailbox is synced in your Microsoft 365 organization
2. Ensure the mailbox is a shared mailbox (not a user mailbox)
3. Check that the mailbox is not already assigned to another agent or another PA
4. Click Refresh to reload the mailbox list

If you just created the mailbox, wait a few minutes for it to sync before refreshing.

Employee Did Not Receive Setup Email

If the employee reports they did not receive the setup email:

1. Check the employee's spam or junk folder
2. Verify the employee's email address is correct in their user profile
3. Confirm that the PA's shared mailbox has proper send permissions (it should be able to send as itself)
4. The employee can also access the PA Hub directly by navigating to the PA section in Control Bridge (they will be redirected to the setup wizard automatically)

Create PA Fails

If clicking Create PA does not succeed:

1. Verify you have administrator permissions (users:write)
2. Ensure the employee's user account is active and synced from Microsoft Entra
3. Check that the employee does not already have a PA (each user can only have one)
4. Verify the employee's mailbox is active and reachable

PA Paused by Admin - Employee Cannot Resume

This is intentional. If the admin pauses a PA (e.g., for policy enforcement), the employee cannot resume it. The employee sees: "Paused by your administrator. Contact them to resume." The admin must resume the PA with Resume on the assistant's settings page.

Next Steps

After completing the admin setup:

1. Inform the employee to check their email for the setup invitation
2. Review Employee Setup Wizard to understand what the employee will configure
3. Learn about Privacy & Governance to understand your ongoing management options