# Connecting Sources

You can configure the AWS SaaS and Microsoft Entra SaaS connectors as sources to discover and aggregate agents and other non-human identities.

## Configuring the AWS SaaS Connector

To configure the AWS SaaS connector to discover non-human identities, you'll create a CloudFormation StackSet to create an IAM role. This will allow Agentic Fabric to discover Amazon Bedrock agents and other non-human identities.

!!! important

If your organization already has configured an AWS SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

**To configure the AWS SaaS connector:**

1. In the AWS Bedrock & AgentCore section, enter a name for the source in the **Source Name** field.

2. In the **Source Owner** field, select the identity who will own the source.

3. In the **StackSet Name** field, enter a name for the StackSet.

4. In the **Administrator Account ID** field, enter your Administrator Account ID.

5. In the **Role Name** field, enter the IAM role name that will be created on your AWS accounts.

6. In the **Region** field, enter the region name for the AWS data center. The default region is us-east-1.

7. Select **Create StackSet**.

!!! important

To deploy the IAM role across your accounts, an administrator must approve the delegation request in the AWS console. After access has been approved, StackSet events will start to populate on the Connect Sources page.

8. Select **Next** to configure the Microsoft Entra SaaS Connector or select **Continue** to connect your EDR or SIEM tool.

## Configuring the Microsoft Entra SaaS Connector

To configure the Microsoft Entra SaaS connector to discover non-human identities, you'll register an application and generate a client secret in Microsoft Entra. This will allow Agentic Fabric to discover agents and credentials from Entra and aggregate them as non-human identities.

!!! important

If your organization has already configured a Microsoft Entra SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

### Registering an Application in Microsoft Entra ID

1. Follow Microsoft's [product documentation](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app) to register an application. On the Application page, note the Application (client) ID. You'll provide this value to connect Microsoft Entra ID and Agentic Fabric.
2. [Generate a client secret for the application](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials?tabs=client-secret).
3. Copy the application's client secret. You'll provide this value to connect Microsoft Entra ID and Agentic Fabric.

### Connecting Microsoft Entra ID to Agentic Fabric

1. Go to the **Connect Source** step of the Agentic Fabric onboarding experience.
2. Select **Microsoft Entra** from the left pane.
3. In the **Microsoft Entra** section, complete the following:

- In the **Source Name** field, enter a unique name for the source.

- In the **Source Owner** field, select the identity who will own the source.

- In the **Description** field, enter a unique description for the source to distinguish it from similar connections.

4. In the **Configure Authentication** section, complete the following:

- In the **Client ID** field, enter the application ID of the application you registered.
     - In the **Client Secret** field, enter the client secret you generated for the application.
     - In the **Domain Name** field, enter the name of your organization's Microsoft Entra domain.

5. Select **Continue** to save these changes and continue setting up Agentic Fabric.

Connecting Sources

You can configure the AWS SaaS and Microsoft Entra SaaS connectors as sources to discover and aggregate agents and other non-human identities.

Configuring the AWS SaaS Connector

To configure the AWS SaaS connector to discover non-human identities, you'll create a CloudFormation StackSet to create an IAM role. This will allow Agentic Fabric to discover Amazon Bedrock agents and other non-human identities.

Important

If your organization already has configured an AWS SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

To configure the AWS SaaS connector:

In the AWS Bedrock & AgentCore section, enter a name for the source in the Source Name field.
In the Source Owner field, select the identity who will own the source.
In the StackSet Name field, enter a name for the StackSet.
In the Administrator Account ID field, enter your Administrator Account ID.
In the Role Name field, enter the IAM role name that will be created on your AWS accounts.
In the Region field, enter the region name for the AWS data center. The default region is us-east-1.
Select Create StackSet.

Important

To deploy the IAM role across your accounts, an administrator must approve the delegation request in the AWS console. After access has been approved, StackSet events will start to populate on the Connect Sources page.
Select Next to configure the Microsoft Entra SaaS Connector or select Continue to connect your EDR or SIEM tool.

Configuring the Microsoft Entra SaaS Connector

To configure the Microsoft Entra SaaS connector to discover non-human identities, you'll register an application and generate a client secret in Microsoft Entra. This will allow Agentic Fabric to discover agents and credentials from Entra and aggregate them as non-human identities.

Important

If your organization has already configured a Microsoft Entra SaaS source, you can use the existing source for agent discovery. The fields will be prepopulated with the source's information. You can edit these fields to configure a new integration.

Registering an Application in Microsoft Entra ID

Follow Microsoft's product documentation to register an application. On the Application page, note the Application (client) ID. You'll provide this value to connect Microsoft Entra ID and Agentic Fabric.
Generate a client secret for the application.
Copy the application's client secret. You'll provide this value to connect Microsoft Entra ID and Agentic Fabric.

Connecting Microsoft Entra ID to Agentic Fabric

Go to the Connect Source step of the Agentic Fabric onboarding experience.
Select Microsoft Entra from the left pane.
In the Microsoft Entra section, complete the following:
- In the Source Name field, enter a unique name for the source.
- In the Source Owner field, select the identity who will own the source.
- In the Description field, enter a unique description for the source to distinguish it from similar connections.
In the Configure Authentication section, complete the following:
- In the Client ID field, enter the application ID of the application you registered.
- In the Client Secret field, enter the client secret you generated for the application.
- In the Domain Name field, enter the name of your organization's Microsoft Entra domain.
Select Continue to save these changes and continue setting up Agentic Fabric.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.