Managing Agent Settings

After onboarding, manage agent settings in Identity Security Cloud. These settings include sensors and the EDR and SIEM platforms.

Deploying Sensors

You can deploy SailPoint's sensors to discover AI on your devices. The endpoint agent and browser extension are deployed separately with their own artifacts and configuration. You can deploy both the endpoint agent and browser extension to your fleet.

Endpoint Agents

You can configure SailPoint Endpoint Agent Security to discover and monitor AI agent software that is installed and running on your organization's managed laptops and desktops. SailPoint's endpoint agent runs as a background service with little interaction. Discovered agents, MCP servers, credentials, and related non-human identities are added to the Agentic Fabric for users to review.

Generating Deployment Artifacts

To deploy the endpoint agent in your MDM provider, you will generate the following artifacts in Agentic Fabric:

Platform	Installer	Tenant Configuration
macOS (Jamf)	.pkg installer package	.mobileconfig configuration profile
Windows (Intune)	A 64-bit MSI, packaged as an .intunewin file for Intune	`Set-SeasPolicy-<tenant>.ps1`, deployed as a platform script

Note

You can only generate the artifacts for one provider at a time. If your organization manages both macOS and Windows devices, you can generate the artifact for the second provider after Agentic Fabric is activated. In Identity Security Cloud, go to Admin > Global > Agent Settings.

To generate deployment artifacts:

In Identity Security Cloud, go to Admin > Global > Agent Settings > Sensors and select Endpoint Agent.
Select your organization's MDM provider.
Enter a name for the endpoint agent in the Name field.
Select Generate Deployment Packages to generate an installer package and configuration profile.
Select Download for both files.
Give the files to your MDM administrator.
Provide the deployment guide for your MDM provider to your MDM administrator.

To deploy Endpoint Agent Security to macOS devices via JamfPro or Windows devices via Intune, refer to Deploying Endpoint Agent Security.

Browser Extensions

SailPoint Browser Agent Security (SBAS) provides visibility and supports GenAI governance processes across both managed and unmanaged SaaS environments. It operates in the browser to detect, correlate, and enhance governance of GenAI-related activities. The browser extension discovers AI business apps that users access and surfaces browser agent frameworks accessed through web browser, along with their agentic surface area across MCP servers.

Deployment is supported by any MDM solution, including Intune and Jamf. Once deployed, the browser extension installs and begins operation.

As the browser extension automatically authenticates using the logged-in user's corporate identity, you'll first configure a connection to your identity provider. You can then select installation methods based on your MDM provider.

Integrating the Browser Extension with Microsoft Entra ID

The Agentic Fabric platform is deployed in Microsoft Entra ID as a multi-tenant application. Agentic Fabric uses Microsoft Entra ID API to authenticate end users and administrators logging into the Agentic Fabric platform and to gather information on applications integrated with Microsoft Entra ID and their permissions.

Once integrated with Microsoft Entra ID, Agentic Fabric can:

Allow the browser extension and Shadow AI Remediation administrators to authenticate against the IdP.
Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO'ed accounts.
Support listing user accounts, user groups, application, and related user activity in Agentic Fabric.
Review the IdP configuration, such as MFA settings and last password rotation dates.

You will first create an application integration in Microsoft Entra ID to configure authentication, and then create a Privileged Role Administrator.

To establish trust with Microsoft Entra ID, an Azure Active Directory Administrator with the Privileged role administrator role is required.

To configure authentication:

Go to Agentic Fabric > Onboarding > Deploy Sensor > Browser Extension.
If you are an Azure Active Directory Administrator with an admin privileged role:
- Within the Configure Identity Provider card, hover over the BROWSER SENSOR OAUTH URL and select Open link icon .
- Select the checkbox to accept the permissions requested by Agentic Fabric. For a full list of requested permissions, refer to Requested Permissions.
- A confirmation page is displayed confirming trust has been successfully established.
If you are not an Azure Active Directory Administrator with an admin privileged role:
- Select Copy link icon .
- Ask your Microsoft Entra ID administrator with an admin privileged role to click on the copied link and establish trust.
Once trust is established, select Connect.
Select Test Connection to test the connection.
In the Configure Browser Extension section, select Installation Methods.
Select the checkbox for any methods you want configured.
Select the top checkbox to select all methods.
Select Save Changes.

Refer to Requested Permissions for more information.

Refer to Creating a Privileged Role Administrator in Azure Active Directory for more information.

Integrating the Browser Extension with Okta

Agentic Fabric uses Okta API to authenticate end users and administrators logging into the Agentic Fabric platform and to gather information on applications integrated with Okta and their permissions.

Once integrated with Okta, Agentic Fabric can:

Allow the browser extension and Shadow AI Remediation administrators to authenticate against the IdP.
Read the list of SaaS applications that have been installed in your organization, and parse SSO logs to continuously detect SSO'ed accounts.
Support listing user accounts, user groups, application, and related user activity in Agentic Fabric.
Review the IdP configuration, such as MFA settings and last password rotation dates.

You will first create an app integration in Okta to configure authentication, and then configure a service application.

To configure authentication:

Log into Okta at https://www.okta.com/.
Go to Applications and select the Applications dropdown.
Select Create app integration.
On the Create app integration page, complete the following:
- In the Sign-in method section, select OIDC OpenID Connect.
- In the Application type section, select Web Application.
Select Next.
On the New Web Application Integration page, complete the following:
- In the App integration name field, enter Agentic Fabric authentication.
- In the Grant type field, select Authorization Code and Implicit (hybrid).
- In the Sign-in redirect URIs field, enter https://auth2.savvy.security/self-service/methods/oidc/callback.
- In the Sign-out redirect URIs field, remove the default URI.
- In the Assignments section, select whether to assign the app integration to everyone in your org, only selected group(s), or to skip assignment until after app creation.
Select Save to save these settings.
Select the Okta API Scopes tab.
Grant the okta.users.read.self scope.
Select the General tab.
Copy the following details from the Okta General tab, into the Agent Settings page at Admin > Global > Agent Settings > Sensors > Browser Extension:
- Okta Domain
- Client ID
- Client Secret
- Service Application Client ID

To configure the service application:

Log into Okta at https://www.okta.com/ .
Go to Security > Administrators.
Select the Roles tab.
Select Create to create a new role.
On the Create new role page complete the following:
- In the Role name field, enter SAF-Role.
- In the Description field, provide additional details about the role and the access it grants.
- In the Select permissions section, search for "view roles", and add the View roles, resources and admin assignments permission.
Select Save to save the role settings.
Select the Resources tab.
Select Create new resource set.
On the Create new resource set page complete the following:
- In the Resource name field, enter SAF-Resource.
- In the Description filed, provide additional details about the resource.
Select Add Resource.
On the Add Resource page, select Identity and Access Management and then select All Identity and Access Management resources.
Select Save to save these settings.
Go to Applications > Applications.
Select Create app integration.
On the Create app integration page complete the following:
- In the Sign-in method section, select API Services.
Select Next.
On the New API Services App Integration page, complete the following:
- In the App integration name field, enter Agentic Fabric services app.
Select the Admin roles tab.
- On the Complete the assignment page, complete the following:
  - In the Role field, select SAF-Role.
  - In the Resources set field, select SAF-Resource.
  - In the Role field, select the Read-only Administrator role.
Select Add assignment.
Select the Okta API Scopes tab.
Grant the following scopes:
- okta.users.read - Read users for policy matching.
- okta.groups.read - Read groups for policy matching.
- okta.apps.read - Read oauth/saml applications to create inventory items.
- okta.logs.read - Read sign in events.
- okta.policies.read - Read policies in order to understand MFA status per application.
- okta.domains.read - Fetching any verified domain.
- okta.roles.read - Determine role per user, primarily to evaluate if a user is an administrator.
- okta.appGrants.read - Read all app grants.
Select the General tab.
Select Edit to edit the client credentials.
In the Client Credentials section, for Client authentication select Public key / Private key.
In the PUBLIC KEYS section complete the following:
- In the Configuration field, select Use a URL to fetch keys dynamically.
- In the URL field, enter the URL from the Agent Settings page at Admin > Global > Agent Settings > Sensors > Browser Extension.
- Deselect the Proof of possession selection.
Select Save to save the settings.
Select the General tab.
Copy the following details from the Okta General tab into the Agent Settings page in Identity Security Cloud by going to Admin > Global > Agent Settings > Sensors > Browser Extension:
- Okta Domain
- Client ID
- Client Secret
- Service Application Client ID
Select Test Connection to test the connection.
Select Save Changes.

Connecting EDR or SIEM Platforms

You can connect and manage your Endpoint Detection and Response (EDR) software or Security Information and Event Management (SIEM) solution for agent discovery and monitoring.

The following EDR and SIEM platforms can be connected to Agentic Fabric:

CrowdStrike Falcon Data Replicator
Sumo Logic SIEM

Connecting CrowdStrike Falcon Data Replicator

Follow the Crowdstrike Falcon Data Replicator integration guide to create the credentials you'll need to connect the tool to Agentic Fabric.

In Identity Security Cloud, go to Admin > Global > Agent Settings > SIEM and EDR Connections.
Select Google SecOps SIEM.
Enter a name for the source in the Source Name field.
In the SQS Queue URL field, enter the SQS URL from the CrowdStrike Falcon Console.
In the AWS Access Key ID field, enter your Client ID from the CrowdStrike Falcon Console.
In the AWS Secret Access Key field, enter your Secret from the CrowdStrike Falcon Console.
Select Test Connection to confirm the connection is successful.
Select Save Changes to complete the connection.

Connecting Sumo Logic SIEM

Agentic Fabric connects to the Sumo Logic Search Job API to execute queries and retrieve log results. This is a read-only integration using HTTP Basic authentication.

Before connecting Sumo Logic, ensure you have the following available:

A Sumo Logic account
Admin access to create roles, users, and access keys
Service account with an Access ID and Access Key
Correct search filter configured on the role

To connect Sumo Logic:

In Sumo Logic, create a role with the ability to create an access key.
Create a service account that is assigned the role you created.
In Sumo Logic, create an access key. Copy the Access ID and Access Key as you'll need them to connect Sumo Logic and Agentic Fabric.
In Identity Security Cloud, go to Admin > Global > Agent Settings > SIEM and EDR Connections.
Select SumoLogic SIEM.
Enter a name for the source in the Source Name field.
In API URL field, enter your deployment-specific API v1 base URL. For information on API URLs, refer to SailPoint's Sumo Logic connector documentation.
In the Access ID field, enter the Access ID you received from creating an access key.
In the Access Key field, enter the access key you generated.
Select Test Connection to confirm the connection is successful.
Select Save Changes to complete the connection.

Troubleshooting Common Errors and Connection Issues

Common Errors

Error	Platform	Cause	Fix
403 Forbidden	Sumo Logic	Access key is invalid or role has restrictive search filter	Verify access key. Check role permissions and search filter.
Access Key shown once	Sumo Logic	Key was not saved at creation time	Delete the old key and create a new one.

Common Connection Issues

If you experience issues during the connection test, try the following:

Verify network connectivity: Ensure Agentic Fabric can reach the SIEM endpoint (no firewall blocking outbound HTTPS).
Check credentials: Copy-paste errors are the most common cause of authentication failures.
Test outside Agentic Fabric first: Use curl to confirm the endpoint responds before entering credentials in the wizard.
Review audit logs: Check logs for failed API auth attempts for additional context.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.