PingOne Privilege

Configure applications for workload agents

To enable AI discovery for workload agents, you first need to add an application connected to a cloud account. Discovery then connects to each configured cloud platform and reviews its agent inventory. Learn more in AI discovery.

Add applications for workload agents in PingOne Privilege

  1. In the PingOne Privilege admin console, go to AI Security > Workload Agents.

  2. Click the Add Application tab.

  3. In the list of available applications, find the one you want and click Integrate.

  4. Depending on the application you are integrating, follow the configuration steps for the available application:

Configuring AgentCore

You can now validate that the connection is active in the Active Applications tab.

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. To add your credentials, either:

    • Use the Template URL and External ID.

    • Click Open CF Template to launch directly into AWS.

  5. Click Next.

  6. Once the stack status is CREATE_COMPLETE, open the Outputs tab in CloudFormation and paste the Cross Account Role ARN into the setup wizard.

  7. (Optional): Add comma-separated Regions. Leave this field empty to scan all regions.

  8. Review the summary, then click Add Connection

Configuring Agentforce

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. Create a Connected App:

    1. In Salesforce, go to Salesforce Setup > App Manager.

    2. Ensure Client Credentials Flow is enabled.

    3. Assign a Run-As user to the app.

    4. Ensure the app has following OAuth scopes:

      • api

      • wave_api

    5. Ensure the app has the required IAM roles:

      • BotDefinition: Read

      • BotVersion: Read

      • BotInvocableAction: Read

      • NamedCredential: Read (Tooling API)

      • Organization: Read

      • BotVersion: Edit

      • NamedCredential: Edit (Tooling API)

      • BotDefinition: Delete

  5. Click Next.

  6. For credentials, either:

    • Enter the Instance URL, Client ID, and Client Secret.

    • Click JWT Bearer Flow as an alternative to Client Secret for certificate-based authentication.

      1. Enter your Salesforce Username.

      2. Paste your JWT Private Key (PEM).

  7. Click Next.

  8. Review the summary, then click Add Connection

Configuring AI Foundry

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. Create an Entra ID App Registration and assign to it the following Azure RBAC roles:

    • Reader (Subscription)

    • Foundry User (Subscription)

    • Foundry Project Manager (Subscription)

    • Cognitive Services Contributor (AI Services account)

    • User Access Administrator (Subscription) or Custom role (roleAssignments/read + roleAssignments/delete)

  5. Click Next.

  6. Enter your Tenant ID, Client ID, Client Secret, and Subscription ID. Click Next.

  7. Review the summary, then click Add Connection

Configuring Bedrock

  1. Enter a Name for the connection, such as my-bedrock-prod.

  2. (Optional) Enter a description.

  3. Click Next.

  4. To add your credentials, either:

    • Enter the Template URL and External ID directly in the setup wizard.

    • Click Open CF Template to launch into AWS to enter credentials there.

  5. Click Next.

  6. Once the stack status is CREATE_COMPLETE, open the Outputs tab in CloudFormation and paste the Cross Account Role ARN into the setup wizard.

  7. (Optional): Add comma-separated Regions. Leave this field empty to scan all regions.

  8. Review the summary, then click Add Connection

Configuring Copilot Studio

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. Register an Entra ID App, then complete three steps:

    1. Assign the SP a directory role in Entra ID. This step is required for tenant-level discovery.

      1. Go to entra.microsoft.com.

      2. Navigate to Identity > Roles & admin > Roles & Admin.

      3. Open Power Platform Administrator, then click Add Assignments.

      4. Add the service principal.

    2. Register the app as a PP Admin Management App. This step is required for tenant-level admin API access.

      1. For this step, you can either:

      2. Verify that Get-PowerAppManagementApp lists your app.

    3. Add the application user in each Dataverse environment. This step grants access to bots and flows inside the environment.

      1. Go to admin.powerplatform.microsoft.com.

      2. Navigate to Environments > Select Environment.

      3. Click Settings > Users + permissions > Application users.

      4. Click New app user.

      5. Select the app you created and assign the System Administrator role to it.

  5. Once you complete the above steps, click Next.

  6. Enter your Tenant ID, Client ID, and Client Secret. Click Next.

  7. Review the summary, then click Add Connection

Configuring Databricks AI

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. To configure Permissions, you can either:

    • Create a Databricks service principal with the following permissions:

      • GET /api/2.0/serving-endpoints

      • GET /api/2.0/permissions/serving-endpoints/{id}

      • GET /api/2.0/genie/spaces

      • CAN_VIEW (or higher) on each serving endpoint

      • CAN_MANAGE on the serving endpoint

      • PATCH /api/2.0/serving-endpoints/{name}/tags

      • PUT /api/2.0/serving-endpoints/{name}/ai-gateway

      • PATCH /api/2.0/permissions/serving-endpoints/{id}

      • PATCH /api/2.0/permissions/serving-endpoints/{id}

      • PATCH /api/2.0/permissions/serving-endpoints/{id}

        Foundation Model API endpoints (no endpoint ID) do not support permission management

        Genie spaces do not support permission write operations

    • Generate a personal access token:

      1. In your Databricks workspace, click User Settings.

      2. Navigate to Developer > Access Tokens.

      3. Click Generate new token.

      4. For service principals, use the Databricks CLI or the SCIM API to create the principal and generate an OAuth M2M token.

  5. When you are finished setting up Permissions, click Next.

  6. Enter your Workspace URL and generated Access Token. Click Next.

  7. Review the summary, then click Add Connection

Configuring Lex V2

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. To add your credentials, either:

    • Enter the Template URL and External ID directly in the setup wizard.

    • Click Open CF Template to launch into AWS to enter credentials there.

  5. Click Next.

  6. Once the stack status is CREATE_COMPLETE, open the Outputs tab in CloudFormation and paste the Cross Account Role ARN into the setup wizard.

  7. (Optional): Add comma-separated Regions. Leave this field empty to scan all regions.

  8. Review the summary, then click Add Connection

You can now validate that the connection is active in the Active Applications tab.

Configuring Snowflake Cortex

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. Create a dedicated Snowflake service user and role with the following required privileges:

    • SHOW AGENTS IN ACCOUNT

    • SHOW MCP SERVERS IN ACCOUNT

    • SHOW GRANTS ON AGENT <db>.<schema>.<name>

    • SHOW GRANTS ON MCP SERVER <db>.<schema>.<name>

    • SHOW GRANTS TO ROLE <role>

    • DESCRIBE AGENT <db>.<schema>.<name>

    • DESCRIBE MCP SERVER <db>.<schema>.<name>

    • USAGE on WAREHOUSE

    • ALTER AGENT <fqn> SET COMMENT = <text>

    • ALTER MCP SERVER <fqn> SET COMMENT = <text>

    • DROP AGENT <fqn>

    • DROP MCP SERVER <fqn>

    • REVOKE USAGE ON AGENT <fqn> FROM ROLE PUBLIC

    • REVOKE USAGE ON AGENT <fqn> FROM ROLE <role>

    • REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE PUBLIC

    • REVOKE USAGE ON MCP SERVER <fqn> FROM ROLE <role>

    • GRANT USAGE ON AGENT <fqn> TO ROLE <role>

    • GRANT USAGE ON MCP SERVER <fqn> TO ROLE <role>

    • GRANT OWNERSHIP ON AGENT <fqn> TO ROLE <role> REVOKE CURRENT GRANTS

    • GRANT OWNERSHIP ON MCP SERVER <fqn> TO ROLE <role> REVOKE CURRENT GRANTS

  5. When you’re done creating the Snowflake service user, click Next.

  6. Use the org-account format to enter an Account Identifier.

  7. Enter a PingOne Privilege User.

  8. Generate your RSA Private Key (PEM) with the following command:

    openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa_key.pem

  9. Paste the key into the required field in the wizard.

  10. (Optional) Enter a Warehouse. Leave empty for user default.

  11. (Optional) Enter a Default Database. Leave empty to scan all databases.

  12. Click Next.

  13. Review the summary, then click Add Connection

Configuring Vertex AI

  1. Enter a Name for the connection.

  2. (Optional) Enter a description.

  3. Click Next.

  4. Create a GCP service account, and assign it the required roles:

    • roles/browser

    • roles/aiplatform.user

    • roles/dialogflow.reader

    • roles/discoveryengine.viewer`

    • roles/iam.securityReviewer

    • roles/agentregistry.editor

    • roles/dialogflow.admin

    • roles/discoveryengine.editor

    • roles/CloudAgentVertexActions

    • resourcemanager.projects.setIamPolicy

  5. Click Next.

  6. Paste the full contents of your GCP Service Account JSON, then click Next.

  7. Review the summary, then click Add Connection

Next steps

Once you add one or more application, validate that the connection is active in the Active Applications tab. All workload agents associated with the app are now discovered. Learn more in Workload agents.