From 6f16b831058c8992e57b7f261b1618f734c698f3 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Fri, 14 Aug 2026 15:41:39 -0500 Subject: [PATCH 1/3] added new OAuth code flow for Copilot scanner --- modules/ROOT/pages/exp-providers-manage.adoc | 2 ++ .../exp-scanners-add-from-providers.adoc | 21 +++++++++++++++++++ .../exp-scanners-prerequisites-reference.adoc | 8 +++++-- 3 files changed, 29 insertions(+), 2 deletions(-) diff --git a/modules/ROOT/pages/exp-providers-manage.adoc b/modules/ROOT/pages/exp-providers-manage.adoc index a685cc892..9c096949e 100644 --- a/modules/ROOT/pages/exp-providers-manage.adoc +++ b/modules/ROOT/pages/exp-providers-manage.adoc @@ -67,6 +67,8 @@ To add a provider connection: . From *Platform* > *Providers*, select a provider from the *Not Connected* section. . Follow the connection workflow to authenticate and configure scanner settings. The wizard walks through three steps: *Choose Provider*, *Connect to Provider*, and *Connection Setup*. +For Microsoft Copilot Studio scanners, select *OAuth (Authorization Code)* and complete authorization in the Microsoft sign-in popup before you continue. For details, see xref:exp-scanners-add-from-providers.adoc#microsoft-copilot-studio-scanner-oauth-authorization[]. + For detailed scanner setup instructions, see xref:exp-scanners-add-from-providers.adoc[]. == Akamai API Security Data in Portfolio diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index 1fedbdaef..a6e4308b6 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -78,6 +78,27 @@ When the policy is applied, the section shows a table with one row per environme If some environments show no policy binding, select *Check again* to retry the policy application for those environments only. The operation is safe to repeat. +== Microsoft Copilot Studio Scanner OAuth Authorization + +Use OAuth 2.0 Authorization Code for Microsoft Copilot Studio scanners to create, authorize, and test the provider connection before you continue scanner setup. + +. From *Platform* > *Providers*, select *Microsoft*. +. In *Connect to Provider*, under *Platform*, select *Microsoft Copilot Studio*. +. Under *Authentication Method*, select *OAuth (Authorization Code)*. +. Enter connection values: +* *Base URL*: Dataverse environment URL, for example `https://.api.crm.dynamics.com/` +* *Client ID*: OAuth 2.0 client ID from your Azure app registration +* *Client Secret*: OAuth 2.0 client secret from your Azure app registration +. Click *Create & Authorize Connection*. +. In the Microsoft popup window, sign in and grant consent. +. Return to the setup page and wait for status to progress through *Connection created*, *Authorized*, and *Tested*. +. Confirm the message *Connected to Microsoft* appears, then click *Continue*. + +[NOTE] +==== +The OAuth flow opens a Microsoft sign-in popup. If your browser blocks popups, authorization can't complete and scanner setup stays in the authorizing state. +==== + == Scanner Configuration Overview Regardless of entry point, adding a scanner establishes trust and scope. You specify which provider platform to reach, how the system authenticates, and how you validate connectivity. You also name and schedule the scanner—or configure another trigger—so discovery runs on the cadence your team expects. Saving the configuration activates the scanner for the catalogs and features your administrator enabled. diff --git a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc index f09f75f74..fdcc1fdff 100644 --- a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc +++ b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc @@ -101,11 +101,15 @@ a| | Microsoft Azure Copilot | Agent a| -*Credentials:* Azure app registration; tenant ID, client ID, client secret +*Credentials:* Azure app registration; Dataverse base URL, client ID, client secret *Role:* Copilot Studio Scanner -*Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL, `\https://.crm.dynamics.com` +*Authorization:* OAuth 2.0 Authorization Code flow (interactive sign-in and consent in Microsoft popup) + +*Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL, `https://.crm.dynamics.com` + +For setup steps, see xref:exp-scanners-add-from-providers.adoc#microsoft-copilot-studio-scanner-oauth-authorization[]. | Microsoft Foundry | Agent From 6fd31a3f2e84f978152cfd77608e4192499a5a97 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Fri, 14 Aug 2026 17:07:21 -0500 Subject: [PATCH 2/3] added Salesforce Agentforce scanner and updated scanner permissions to just Exchange admin --- modules/ROOT/pages/exp-providers-manage.adoc | 12 +++--------- .../ROOT/pages/exp-scanners-add-from-providers.adoc | 11 +++-------- .../pages/exp-scanners-prerequisites-reference.adoc | 9 +++++++++ 3 files changed, 15 insertions(+), 17 deletions(-) diff --git a/modules/ROOT/pages/exp-providers-manage.adoc b/modules/ROOT/pages/exp-providers-manage.adoc index 9c096949e..1a01cc4a2 100644 --- a/modules/ROOT/pages/exp-providers-manage.adoc +++ b/modules/ROOT/pages/exp-providers-manage.adoc @@ -8,15 +8,8 @@ The *Providers* page shows which cloud platforms and API management systems are Before getting started, make sure you have: * An Anypoint Platform account. -* Any of these permissions: -+ --- -** Exchange: Exchange Administrator -** Exchange: Exchange Contributor -** API Manager: API Creator -** API Manager: Manage Policies --- -+ +* Exchange Administrator permission. + For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. == Access the Providers Page @@ -93,6 +86,7 @@ The enhanced experience supports connections to these providers: * Kong * LangChain * Microsoft +* Salesforce * Snowflake [NOTE] diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index a6e4308b6..c0a88f9ad 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -10,14 +10,9 @@ For how provider connection and catalogs fit together, see xref:exp-services-con Before getting started, make sure you have: * An Anypoint Platform account. -* Any of these permissions: -+ --- -** Exchange: Exchange Administrator -** Exchange: Exchange Contributor -** API Manager: API Creator -** API Manager: Manage Policies --- +* Exchange Administrator + + + For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions]. For provider-specific roles, credentials, and permission scopes, see xref:exp-scanners-prerequisites-reference.adoc[]. diff --git a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc index fdcc1fdff..62c6ffee7 100644 --- a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc +++ b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc @@ -122,6 +122,15 @@ a| *Setup:* Project endpoint URLs (discovery is project-specific) +| Salesforce Agentforce +| Agent +a| +*Connection:* xref:access-management::managing-connected-salesforce-orgs.adoc#enable-disable-connection[Enable the connection to a Salesforce organization] that has an established tenant relationship with your Anypoint Platform organization. + +*Setup:* xref:access-management::enabling-agentforce.adoc#enable-einstein-anypoint[Enable Agentforce in Anypoint Platform], accept the terms and conditions and set a default organization for Agentforce + +*Permissions:* Exchange Administrator permission + | Snowflake Cortex AI | Agent a| From 6735450c66ad8cf06998f01c1db54e80c431f964 Mon Sep 17 00:00:00 2001 From: jenny hajee Date: Tue, 25 Aug 2026 16:39:05 -0500 Subject: [PATCH 3/3] Address review: use optional Tenant ID for Copilot OAuth, distinguish auth schemes Co-Authored-By: Claude Opus 4.8 (1M context) --- modules/ROOT/pages/exp-scanners-add-from-providers.adoc | 2 +- .../ROOT/pages/exp-scanners-prerequisites-reference.adoc | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc index c0a88f9ad..6637537e2 100644 --- a/modules/ROOT/pages/exp-scanners-add-from-providers.adoc +++ b/modules/ROOT/pages/exp-scanners-add-from-providers.adoc @@ -81,7 +81,7 @@ Use OAuth 2.0 Authorization Code for Microsoft Copilot Studio scanners to create . In *Connect to Provider*, under *Platform*, select *Microsoft Copilot Studio*. . Under *Authentication Method*, select *OAuth (Authorization Code)*. . Enter connection values: -* *Base URL*: Dataverse environment URL, for example `https://.api.crm.dynamics.com/` +* *Tenant ID* (optional): Microsoft Entra tenant ID. If you don't provide one, the connection defaults to the home tenant ID after authorization. * *Client ID*: OAuth 2.0 client ID from your Azure app registration * *Client Secret*: OAuth 2.0 client secret from your Azure app registration . Click *Create & Authorize Connection*. diff --git a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc index 62c6ffee7..6c210d801 100644 --- a/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc +++ b/modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc @@ -101,11 +101,12 @@ a| | Microsoft Azure Copilot | Agent a| -*Credentials:* Azure app registration; Dataverse base URL, client ID, client secret +*Credentials:* Azure app registration; client ID and client secret. Two authentication schemes are supported: -*Role:* Copilot Studio Scanner +* *OAuth 2.0 Authorization Code:* Interactive sign-in and consent in a Microsoft popup. Tenant ID is optional; if you don't provide one, the connection defaults to the home tenant ID after authorization. +* *Client Credentials:* Tenant ID is required. -*Authorization:* OAuth 2.0 Authorization Code flow (interactive sign-in and consent in Microsoft popup) +*Role:* Copilot Studio Scanner *Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL, `https://.crm.dynamics.com`