Skip to content

W 23865924 scanners agentforce and oauth for copilot jh #546

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
JennyHajee wants to merge 2 commits into
base: W-23753039-EME-08-R2-dm
Choose a base branch
from
+44 −19
Open

W 23865924 scanners agentforce and oauth for copilot jh #546

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6f16b83
added new OAuth code flow for Copilot scanner
JennyHajee Aug 14, 2026
6fd31a3
added Salesforce Agentforce scanner and updated scanner permissions t…
JennyHajee Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 5 additions & 9 deletions modules/ROOT/pages/exp-providers-manage.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,15 +8,8 @@ The *Providers* page shows which cloud platforms and API management systems are
Before getting started, make sure you have:

* An Anypoint Platform account.
* Any of these permissions:
+
--
** Exchange: Exchange Administrator
** Exchange: Exchange Contributor
** API Manager: API Creator
** API Manager: Manage Policies
--
+
* Exchange Administrator permission.

For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions].

== Access the Providers Page
Expand Down Expand Up @@ -67,6 +60,8 @@ To add a provider connection:
. From *Platform* > *Providers*, select a provider from the *Not Connected* section.
. Follow the connection workflow to authenticate and configure scanner settings. The wizard walks through three steps: *Choose Provider*, *Connect to Provider*, and *Connection Setup*.

For Microsoft Copilot Studio scanners, select *OAuth (Authorization Code)* and complete authorization in the Microsoft sign-in popup before you continue. For details, see xref:exp-scanners-add-from-providers.adoc#microsoft-copilot-studio-scanner-oauth-authorization[].

For detailed scanner setup instructions, see xref:exp-scanners-add-from-providers.adoc[].

== Akamai API Security Data in Portfolio
Expand All @@ -91,6 +86,7 @@ The enhanced experience supports connections to these providers:
* Kong
* LangChain
* Microsoft
* Salesforce
* Snowflake

[NOTE]
Expand Down
32 changes: 24 additions & 8 deletions modules/ROOT/pages/exp-scanners-add-from-providers.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,14 +10,9 @@ For how provider connection and catalogs fit together, see xref:exp-services-con
Before getting started, make sure you have:

* An Anypoint Platform account.
* Any of these permissions:
+
--
** Exchange: Exchange Administrator
** Exchange: Exchange Contributor
** API Manager: API Creator
** API Manager: Manage Policies
--
* Exchange Administrator


+
For more information, see xref:exp-home-start.adoc#permissions[Enhanced Experience Permissions].
For provider-specific roles, credentials, and permission scopes, see xref:exp-scanners-prerequisites-reference.adoc[].
Expand Down Expand Up @@ -78,6 +73,27 @@ When the policy is applied, the section shows a table with one row per environme

If some environments show no policy binding, select *Check again* to retry the policy application for those environments only. The operation is safe to repeat.

== Microsoft Copilot Studio Scanner OAuth Authorization

Use OAuth 2.0 Authorization Code for Microsoft Copilot Studio scanners to create, authorize, and test the provider connection before you continue scanner setup.

. From *Platform* > *Providers*, select *Microsoft*.
. In *Connect to Provider*, under *Platform*, select *Microsoft Copilot Studio*.
. Under *Authentication Method*, select *OAuth (Authorization Code)*.
. Enter connection values:
* *Base URL*: Dataverse environment URL, for example `https://<org-id>.api.crm.dynamics.com/`

@felkfurymule felkfurymule Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Base url is not needed, lets use Tenant Id, same as the other scheme, but in this case optional as it will default to the home tenant id after authorization if none is provided

* *Client ID*: OAuth 2.0 client ID from your Azure app registration
* *Client Secret*: OAuth 2.0 client secret from your Azure app registration
. Click *Create & Authorize Connection*.
. In the Microsoft popup window, sign in and grant consent.
. Return to the setup page and wait for status to progress through *Connection created*, *Authorized*, and *Tested*.
. Confirm the message *Connected to Microsoft* appears, then click *Continue*.

[NOTE]
====
The OAuth flow opens a Microsoft sign-in popup. If your browser blocks popups, authorization can't complete and scanner setup stays in the authorizing state.
====

== Scanner Configuration Overview

Regardless of entry point, adding a scanner establishes trust and scope. You specify which provider platform to reach, how the system authenticates, and how you validate connectivity. You also name and schedule the scanner—or configure another trigger—so discovery runs on the cadence your team expects. Saving the configuration activates the scanner for the catalogs and features your administrator enabled.
Expand Down
17 changes: 15 additions & 2 deletions modules/ROOT/pages/exp-scanners-prerequisites-reference.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,11 +101,15 @@ a|
| Microsoft Azure Copilot
| Agent
a|
*Credentials:* Azure app registration; tenant ID, client ID, client secret
*Credentials:* Azure app registration; Dataverse base URL, client ID, client secret

@felkfurymule felkfurymule Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as the other comment, tenant is optional for the oauth-authorization-code scheme and required for the client credential scheme, there should be a clear distinction that there are 2 auth schemes now


*Role:* Copilot Studio Scanner

*Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL, `\https://<org-Id>.crm.dynamics.com`
*Authorization:* OAuth 2.0 Authorization Code flow (interactive sign-in and consent in Microsoft popup)

*Setup:* App added as an Application User in Power Platform; scope set to Dataverse environment URL, `https://<org-id>.crm.dynamics.com`

@felkfurymule felkfurymule Aug 24, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This requires a different setup, we can sync on that


For setup steps, see xref:exp-scanners-add-from-providers.adoc#microsoft-copilot-studio-scanner-oauth-authorization[].

| Microsoft Foundry
| Agent
Expand All @@ -118,6 +122,15 @@ a|

*Setup:* Project endpoint URLs (discovery is project-specific)

| Salesforce Agentforce
| Agent
a|
*Connection:* xref:access-management::managing-connected-salesforce-orgs.adoc#enable-disable-connection[Enable the connection to a Salesforce organization] that has an established tenant relationship with your Anypoint Platform organization.

*Setup:* xref:access-management::enabling-agentforce.adoc#enable-einstein-anypoint[Enable Agentforce in Anypoint Platform], accept the terms and conditions and set a default organization for Agentforce

*Permissions:* Exchange Administrator permission

| Snowflake Cortex AI
| Agent
a|
Expand Down