---
title: Configuring Agentforce
description: Connect PingOne Privilege to Salesforce Agentforce so AI discovery can review its agent inventory.
component: privilege
page_id: privilege:agent-privilege:configuration/workload-agent-apps/agentforce
canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/configuration/workload-agent-apps/agentforce.html
llms_txt: https://docs.pingidentity.com/privilege/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: October 21, 2026
---

# Configuring Agentforce

Connect Salesforce Agentforce as a workload agent application so AI discovery for workload agents can review the agents running in the platform. Learn more in [Discover and manage workload agents](../../use-cases/workload-agents.html).

1. In the PingOne Privilege admin console, go to **AI Security > Workload Agents**.

2. Click the **Add Application** tab.

3. In the list of available applications, find **Agentforce** and click **[icon: plus, set=fa]Integrate**.

4. Enter a **Name** for the connection.

5. (Optional) Enter a **Description**.

6. Click **Next**.

7. Create a **Connected App**:

   1. In Salesforce, go to **Salesforce Setup > App Manager**.

   2. Ensure **Client Credentials Flow** is enabled.

   3. Assign a `Run-As` user to the app.

   4. Ensure the app has the following OAuth *(tooltip: \<div class="paragraph">
      \<p>A standard framework that enables an application (OAuth client) to obtain access tokens from an OAuth authorization server for the purpose of retrieving protected resources on a resource server.\</p>
      \</div>)* scopes:

      * `api`

      * `wave_api`

   5. Ensure the app has the required IAM roles:

      * `BotDefinition: Read`

      * `BotVersion: Read`

      * `BotInvocableAction: Read`

      * `NamedCredential: Read (Tooling API)`

      * `Organization: Read`

      * `BotVersion: Edit`

      * `NamedCredential: Edit (Tooling API)`

      * `BotDefinition: Delete`

8. Click **Next**.

9. Provide credentials using one of these methods:

   * Enter the **Instance URL**, **Client ID**, and **Client Secret**.

   * Click **JWT Bearer Flow** as an alternative to **Client Secret** for certificate-based authentication.

     1. Enter your **Salesforce Username**.

     2. Paste your **JWT Private Key (PEM)**.

10. Click **Next**.

11. Review the summary, then click **Add Connection**.

You can now validate that the connection is active in the **Active Applications** tab.