Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-02-06
Download PDF
Configure External Agents

Configure External Agents

Security: These domains in the Agent System of Record functional area:
  • Agent Compliance
  • Agent Management Hub
  • Manage: Agents
  • Reports: AI Agent Security
  • Reports: Agent Reporting
  • Setup: Agents
For Ambient-mode agents only:
  • Create a user based security group (requires the
    User-Based Security Group Administration
     domain in the System functional area).
  • Create an X.509 Public Key. Security: The
    Security Administration
     domain in the System functional area.
You can configure external agents using the
Agent Management Hub
.
  1. Access the
    Agent Management Hub
     report.
  2. Select the
    Agent Registry
     tab and then click on the agent name to configure the agent.
  3. From the agent's profile view, click
    Configure Agent
    .
  4. In the
    Status
     column, make each relevant skill available by enabling the toggle slider.
  5. For each available delegate execution mode skill, populate the
    Available To
     prompt and determine the security groups that you want to add for that specific skill for the agent.
    The security groups you select in the
    Available To
     prompt must also have permissions to the domain or business process security policies that secure the agents’ tools. You can use the
    View Security for Agent Skill
     report to assist with your agent security configurations. This report shows you detailed information about the agent’s Tools APIs and the respective domain or business process security policies and permissions. At agent runtime, Workday evaluates both user access to the agent and the user access to the APIs the agent is executing as tools.
  6. Click the
    Confirm
    check box, and then click
    OK
    .
    1. For delegate skills, you must provide a
      Redirect URI
       as the callback endpoint for your agent. Your agent development partner can provide this information.
    2. For ambient skills, you must provide an x509 Public key from your agent development platform. Your agent development partner can provide this information. Select a unique key that’s not in use by another agent. See also: Create an X.509 Public Key. Security: The
      Security Administration
       domain in the System functional area.
  7. Click
    OK
    .
  8. When you configure the agent for the first time, we display the OAuth client details for the agent.
    Copy and save the Client ID and Client Secret values. This page won’t display again and you won’t be able to access this information again.
  9. Enter the OAuth client details and endpoint URLs back into the agent development platform code for the agent to enable access during runtime. The OAuth client and endpoint URLs details that we display include:
    • Authorize Endpoint URL
    • Token Endpoint URL
    • Endpoint URL
    • OAuth 2.0 Client ID
    • OAuth 2.0 Client Secret (Delegate only)
    • Username for Agent System Account (Ambient only)
  10. Select
    Agent Registry
    , and click the agent you want to activate.
  11. From the agent's profile view, click
    Activate Agent
    . On the
    Activate Agent
    window, select the
    Confirm
    check box, and then
    OK
    to complete the activation.
    Note: For external agents with ambient skills, your security admin needs to:
    1. Create a security policy on the relevant domains for the APIs the agent is using.
    2. Add the security group with your Ambient ASU (use the Username for Agent System User Account) and set view/modify permissions.
    3. Run the
      Activate Pending Security Policy Changes
       task (secured to the
      Security Activation
       domain in the System functional area) and activate policies.