--- title: Configure applications for workload agents description: Add applications for workload agents to enable their discovery in Agent Privilege. component: privilege page_id: privilege:agent-privilege:use-cases/add-application-workload-agents canonical_url: https://docs.pingidentity.com/privilege/agent-privilege/use-cases/add-application-workload-agents.html llms_txt: https://docs.pingidentity.com/privilege/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: September 10, 2026 page_aliases: ["agent-privilege:use-cases/ai-discovery-workload-agents.adoc"] section_ids: add-applications-for-workload-agents-in-pingone-privilege: Add applications for workload agents in PingOne Privilege configuring-agentcore: Configuring AgentCore configuring-agentforce: Configuring Agentforce configuring-ai-foundry: Configuring AI Foundry configuring-bedrock: Configuring Bedrock configuring-copilot-studio: Configuring Copilot Studio configuring-databricks-ai: Configuring Databricks AI configuring-lex-v2: Configuring Lex V2 configuring-snowflake-cortex: Configuring Snowflake Cortex configuring-vertex-ai: Configuring Vertex AI next-steps: Next steps --- # Configure applications for workload agents To enable AI discovery for workload agents, you first need to add an application connected to a cloud account. Discovery then connects to each configured cloud platform and reviews its agent inventory. Learn more in [AI discovery](personal-agents.html). ## Add applications for workload agents in PingOne Privilege 1. In the PingOne Privilege admin console, go to **AI Security > Workload Agents**. 2. Click the **Add Application** tab. 3. In the list of available applications, find the one you want and click **[icon: plus, set=fa]Integrate**. 4. Depending on the application you are integrating, follow the configuration steps for the available application: * [AgentCore](#agentcore) * [Agentforce](#agentforce) * [AI Foundry](#ai-foundry) * [Bedrock](#bedrock) * [Copilot Studio](#copilot-studio) * [Databricks AI](#databricks-ai) * [Lex V2](#lex-v2) * [Snowflake Cortex](#snowflake-cortex) * [Vertex AI](#vertex-ai) ### Configuring AgentCore[]() You can now validate that the connection is active in the **Active Applications** tab. 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. To add your credentials, either: * Use the **Template URL** and **External ID**. * Click **Open CF Template** to launch directly into AWS. 5. Click **Next**. 6. Once the stack status is `CREATE_COMPLETE`, open the **Outputs** tab in CloudFormation and paste the **Cross Account Role ARN** into the setup wizard. 7. (Optional): Add comma-separated **Regions**. Leave this field empty to scan all regions. 8. Review the summary, then click **Add Connection** ### Configuring Agentforce[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. Create a **Connected App**: 1. In Salesforce, go to **Salesforce Setup > App Manager**. 2. Ensure **Client Credentials Flow** is enabled. 3. Assign a `Run-As` user to the app. 4. Ensure the app has following OAuth scopes: * `api` * `wave_api` 5. Ensure the app has the required IAM roles: * `BotDefinition: Read` * `BotVersion: Read` * `BotInvocableAction: Read` * `NamedCredential: Read (Tooling API)` * `Organization: Read` * `BotVersion: Edit` * `NamedCredential: Edit (Tooling API)` * `BotDefinition: Delete` 5. Click **Next**. 6. For credentials, either: * Enter the **Instance URL**, **Client ID**, and **Client Secret**. * Click **JWT Bearer Flow** as an alternative to **Client Secret** for certificate-based authentication. 1. Enter your **Salesforce Username**. 2. Paste your **JWT Private Key (PEM)**. 7. Click **Next**. 8. Review the summary, then click **Add Connection** ### Configuring AI Foundry[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. Create an Entra ID App Registration and assign to it the following Azure RBAC roles: * `Reader (Subscription)` * `Foundry User (Subscription)` * `Foundry Project Manager (Subscription)` * `Cognitive Services Contributor (AI Services account)` * `User Access Administrator (Subscription)` or `Custom role (roleAssignments/read + roleAssignments/delete)` 5. Click **Next**. 6. Enter your **Tenant ID**, **Client ID**, **Client Secret**, and **Subscription ID**. Click **Next**. 7. Review the summary, then click **Add Connection** ### Configuring Bedrock[]() 1. Enter a **Name** for the connection, such as `my-bedrock-prod`. 2. (Optional) Enter a description. 3. Click **Next**. 4. To add your credentials, either: * Enter the **Template URL** and **External ID** directly in the setup wizard. * Click **Open CF Template** to launch into AWS to enter credentials there. 5. Click **Next**. 6. Once the stack status is `CREATE_COMPLETE`, open the **Outputs** tab in CloudFormation and paste the **Cross Account Role ARN** into the setup wizard. 7. (Optional): Add comma-separated **Regions**. Leave this field empty to scan all regions. 8. Review the summary, then click **Add Connection** ### Configuring Copilot Studio[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. Register an Entra ID App, then complete three steps: 1. Assign the SP a directory role in Entra ID. This step is required for tenant-level discovery. 1. Go to [entra.microsoft.com](entra.microsoft.com). 2. Navigate to **Identity > Roles & admin > Roles & Admin**. 3. Open **Power Platform Administrator**, then click **[icon: plus, set=fa]Add Assignments**. 4. Add the service principal. 2. Register the app as a PP Admin Management App. This step is required for tenant-level admin API access. 1. For this step, you can either: * Enter the following command in PowerShell: `New-PowerAppManagementApp -ApplicationId "` * Use the following API call: `API: PUT https://api.bap.microsoft.com/providers/Microsoft.BusinessAppPlatform/adminApplications/{Your_App_Client_ID}?api-version=2020-10-01` 2. Verify that **Get-PowerAppManagementApp** lists your app. 3. Add the application user in each Dataverse environment. This step grants access to bots and flows inside the environment. 1. Go to [admin.powerplatform.microsoft.com](admin.powerplatform.microsoft.com). 2. Navigate to **Environments > Select Environment**. 3. Click **Settings > Users + permissions > Application users**. 4. Click **New app user**. 5. Select the app you created and assign the `System Administrator` role to it. 5. Once you complete the above steps, click **Next**. 6. Enter your **Tenant ID**, **Client ID**, and **Client Secret**. Click **Next**. 7. Review the summary, then click **Add Connection** ### Configuring Databricks AI[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. To configure **Permissions**, you can either: * Create a Databricks service principal with the following permissions: * `GET /api/2.0/serving-endpoints` * `GET /api/2.0/permissions/serving-endpoints/{id}` * `GET /api/2.0/genie/spaces` * `CAN_VIEW (or higher) on each serving endpoint` * `CAN_MANAGE on the serving endpoint` * `PATCH /api/2.0/serving-endpoints/{name}/tags` * `PUT /api/2.0/serving-endpoints/{name}/ai-gateway` * `PATCH /api/2.0/permissions/serving-endpoints/{id}` * `PATCH /api/2.0/permissions/serving-endpoints/{id}` * `PATCH /api/2.0/permissions/serving-endpoints/{id}` | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------- | | | Foundation Model API endpoints (no endpoint ID) do not support permission managementGenie spaces do not support permission write operations | * Generate a personal access token: 1. In your Databricks workspace, click **User Settings**. 2. Navigate to **Developer > Access Tokens**. 3. Click **Generate new token**. 4. For service principals, use the Databricks CLI or the SCIM API to create the principal and generate an OAuth M2M token. 5. When you are finished setting up **Permissions**, click **Next**. 6. Enter your **Workspace URL** and generated **Access Token**. Click **Next**. 7. Review the summary, then click **Add Connection** ### Configuring Lex V2[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. To add your credentials, either: * Enter the **Template URL** and **External ID** directly in the setup wizard. * Click **Open CF Template** to launch into AWS to enter credentials there. 5. Click **Next**. 6. Once the stack status is `CREATE_COMPLETE`, open the **Outputs** tab in CloudFormation and paste the **Cross Account Role ARN** into the setup wizard. 7. (Optional): Add comma-separated **Regions**. Leave this field empty to scan all regions. 8. Review the summary, then click **Add Connection** You can now validate that the connection is active in the **Active Applications** tab. ### Configuring Snowflake Cortex[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. Create a dedicated Snowflake service user and role with the following required privileges: * `SHOW AGENTS IN ACCOUNT` * `SHOW MCP SERVERS IN ACCOUNT` * `SHOW GRANTS ON AGENT ..` * `SHOW GRANTS ON MCP SERVER ..` * `SHOW GRANTS TO ROLE ` * `DESCRIBE AGENT ..` * `DESCRIBE MCP SERVER ..` * `USAGE on WAREHOUSE` * `ALTER AGENT SET COMMENT = ` * `ALTER MCP SERVER SET COMMENT = ` * `DROP AGENT ` * `DROP MCP SERVER ` * `REVOKE USAGE ON AGENT FROM ROLE PUBLIC` * `REVOKE USAGE ON AGENT FROM ROLE ` * `REVOKE USAGE ON MCP SERVER FROM ROLE PUBLIC` * `REVOKE USAGE ON MCP SERVER FROM ROLE ` * `GRANT USAGE ON AGENT TO ROLE ` * `GRANT USAGE ON MCP SERVER TO ROLE ` * `GRANT OWNERSHIP ON AGENT TO ROLE REVOKE CURRENT GRANTS` * `GRANT OWNERSHIP ON MCP SERVER TO ROLE REVOKE CURRENT GRANTS` 5. When you're done creating the Snowflake service user, click **Next**. 6. Use the `org-account` format to enter an **Account Identifier**. 7. Enter a PingOne Privilege **User**. 8. Generate your **RSA Private Key (PEM)** with the following command: `openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out rsa_key.pem` 9. Paste the key into the required field in the wizard. 10. (Optional) Enter a **Warehouse**. Leave empty for user default. 11. (Optional) Enter a **Default Database**. Leave empty to scan all databases. 12. Click **Next**. 13. Review the summary, then click **Add Connection** ### Configuring Vertex AI[]() 1. Enter a **Name** for the connection. 2. (Optional) Enter a description. 3. Click **Next**. 4. Create a GCP service account, and assign it the required roles: * `roles/browser` * `roles/aiplatform.user` * `roles/dialogflow.reader` * `` roles/discoveryengine.viewer` `` * `roles/iam.securityReviewer` * `roles/agentregistry.editor` * `roles/dialogflow.admin` * `roles/discoveryengine.editor` * `roles/CloudAgentVertexActions` * `resourcemanager.projects.setIamPolicy` 5. Click **Next**. 6. Paste the full contents of your GCP **Service Account JSON**, then click **Next**. 7. Review the summary, then click **Add Connection** ## Next steps Once you add one or more application, validate that the connection is active in the **Active Applications** tab. All workload agents associated with the app are now discovered. Learn more in [Workload agents](workload-agents.html).