Skip to main content

Integrations

Integrations is where Beak AI Security and Governance connects to the AI platforms, agent platforms and security tooling your organization already runs. It is a top-level menu under Administration; before this release the same connectors were a tab inside Settings, and the old link continues to work by redirecting here.

Twelve integrations are available. Each one is presented as a card, and selecting a card opens that integration's own configuration page.

Viewing the catalog requires integrations:read. Saving an integration and running Test connection both require integrations:update — a test writes the result to the stored configuration, so it is not a read. Disabling one requires integrations:delete.

The two integrations that predate that permission — Copilot Studio threat detection and Anthropic inference hooks — are governed by settings:read and settings:update instead. Their cards are hidden from a user who holds neither, and the Integrations menu itself appears for a user holding either integrations:read or settings:read, so an admin who can configure only those two still has a path to them.

Finding an integration​

The catalog can be grouped two ways, using the By type / By vendor control above the cards. Grouping changes only how the same twelve cards are arranged — nothing is added or hidden by switching.

  • By type (the default) groups by what the integration does: AI Platforms, Agent Platforms, Security Operations, Data Governance and Notifications. Use this when you know the outcome you want — for example forwarding blocks to a SIEM — but not which product provides it.
  • By vendor groups by who provides it: Anthropic, Microsoft, Amazon, Google, Salesforce and A2A. Use this to see everything Beak does with one vendor's stack. A2A is an open protocol rather than a company; it appears as a vendor because vendor is the grouping axis and it needs somewhere to be found.

Search integrations… filters the cards as you type, and matches the integration's name, its vendor, its group, and the description on the card — so searching audit finds Microsoft Sentinel without knowing that Sentinel is the answer.

What the status on a card means​

Each card carries at most one status label:

  • Connected — a credential is stored and the integration is switched on. It is dispatching, syncing or accepting calls.
  • Disabled — a credential is stored but the integration is switched off. Nothing dispatches. This is the state to look for when an integration that used to work has gone quiet.
  • Not connected — nothing has been configured.
  • No label — the status could not be read. Either your account may not read that integration's configuration, or the request failed. The card deliberately shows nothing rather than reporting "not connected", which would be a confident and possibly wrong statement about a live integration.

AI Platforms​

Anthropic Inference Hooks​

Connects Beak to a Claude Enterprise organization. Once configured, Anthropic sends every prompt in the organization to Beak for an allow-or-deny decision before Claude sees it. Selecting Create configuration mints the endpoint URL that is pasted into the Anthropic admin console.

  • Endpoint URL — The address Anthropic delivers to. Copy it with the adjacent button and paste it without retyping; the host, the /api prefix, and the trailing segment are all part of the route. The trailing segment is unique to the tenant and is effectively a credential, so treat the whole URL as sensitive.
  • Signing secret — Anthropic reveals this once, when the endpoint is first saved. Beak encrypts it at rest and never displays it again; the field shows Stored or Not set rather than the value. Pasting a new value rotates the secret, and the previous one stays valid briefly so in-flight requests still verify — the card shows the exact expiry time while that window is open.
  • Policy applied to Claude prompts — Selects which policy evaluates these prompts. The default, All organization-wide policies (default), applies every active policy that covers API traffic. Choosing a single policy restricts evaluation to that one. Only policies of kind api_guardrail or hybrid are listed, because the rule engine considers no others on this surface.
  • If a policy says redact — Inference hooks cannot return a modified prompt, so a redaction policy has no exact equivalent here. Deny the request (the default) blocks it; Allow it through unredacted lets the original prompt reach Claude with nothing removed, while the policy still reports as firing.
  • Enabled — Stops or resumes evaluation without deleting the configuration.
  • Rotate endpoint URL — Mints a new slug. There is no overlap: the previous URL stops resolving immediately, so the Anthropic console must be updated straight away.

Note: Policies scoped to individual users or groups never apply to Claude prompts. Anthropic identifies the person who typed the prompt, but Beak does not yet resolve them to a Beak user, so only organization-wide policies are evaluated on this surface.

Note: If the selected policy is later renamed, deleted, or deactivated, no policy matches and every prompt is allowed. The field reports this state as no longer available with a warning that nothing is being enforced — select a policy again to restore enforcement.

Agent Platforms​

Microsoft Copilot Studio​

Copilot Studio's external security calls Beak when an agent is about to execute a tool. Beak verifies which agent is calling and evaluates the tool's arguments against policy. This direction is inbound: Copilot Studio calls Beak, and Beak cannot list agents over it. Full configuration detail is in Copilot Studio Configuration.

Power Platform​

Enumerates the Copilot Studio agents that exist in the Power Platform environments you name, so they appear in the Agent Registry before any of them has called Beak. This direction is outbound: Beak calls Microsoft.

Configuration fields: Client ID (Entra App) (required), Tenant ID (Entra Directory) (required), Power Platform environment IDs (required — comma-separated), and API base URL override (optional, for sovereign cloud endpoints). Secret field: Client Secret. The Entra app needs permission to read bots in each environment you list. Discovery reads every page of each environment's bot listing, and a missing Entra tenant ID or a refused client secret is named as such rather than reported as an outage.

Note: Power Platform and Copilot Studio threat detection are not the same integration and neither replaces the other. Threat detection is inbound and enforces; Power Platform is outbound and finds. Configure threat detection to enforce, and Power Platform to see agents that have never called. Test connection lists bots in every environment you named rather than only exchanging a token, because an app can obtain a Power Platform token and still be refused by every environment.

Note: At least one environment ID is required. Power Platform has no usable "list every environment" call, so discovery covers exactly the environments you name — configuring none would report success while enumerating nothing.

Microsoft Agent 365​

Holds the Entra application Beak uses to sync the Agent 365 agent inventory and to write its governance verdict back onto each agent's directory object. The inventory itself, the write grants, and the property-write audit are on the Microsoft Agent 365 page; this card holds the credential and the sync settings only.

Amazon Bedrock​

Enumerates the Bedrock agents that exist in one AWS region, so they appear in the Agent Registry before any of them has called Beak. This direction is outbound: Beak calls AWS.

Configuration fields: AWS region (required), Access key ID (required), and Session token (optional). Secret field: Secret access key. The IAM principal needs bedrock:ListAgents and bedrock:GetAgent.

Note: A Session token is only for temporary STS credentials. Discovery stops working when the token expires, with no warning beforehand — use a long-lived principal unless you intend to re-enter the credential.

Salesforce Agentforce​

Enumerates the Agentforce agents in one Salesforce org. This direction is outbound: Beak calls Salesforce.

Configuration fields: Instance URL (required) and Consumer key (connected app) (required). Secret field: Consumer secret. The connected app needs the api scope. Discovery reads every page of the agent listing, and a refused consumer secret is reported as a credential problem with Salesforce's own error code rather than as an outage.

OpenAI Assistants (retired)​

OpenAI sunset the Assistants API on 26 August 2026, and its replacement, the Responses API, has no agent listing, so there is nothing left to enumerate. The card was removed from the catalog on 4 September 2026. A credential saved before then now reports the retirement when tested; remove it. Agents built on the OpenAI Agents SDK are still discovered from traffic — the prompt hook and the OpenTelemetry receiver — and appear in the Agent Registry under the openai_agents_sdk source.

A2A​

Reads the Agent2Agent card published by each agent whose base URL you name, whoever built it. This direction is outbound: Beak calls each agent.

Configuration fields: Agent base URLs (required — comma-separated). Secret field: Bearer token, optional — this is the only integration in the catalog that saves without a secret, because an A2A agent card may be served without authentication.

Note: At least one URL is required. A2A has no registry to query, so discovery covers exactly the agents you name. Beak appends the well-known agent-card path to each URL (agent-card.json, then agent.json for agents on A2A 0.2), so enter the agent's base URL and not the card path itself. Each agent is recorded under the URL its card declares, so two agents that share a display name stay two records.

Note: URLs must be public http(s) addresses. Beak refuses loopback, private-network, link-local and cloud-metadata hosts, and does not follow redirects from an agent card, because the cards are fetched from inside the Beak cluster.

Note: One unreachable card does not discard the others — the agents whose cards were read still arrive. If no card could be fetched, Test connection reports a failure rather than "no agents found", because "could not look" and "found nothing" must not read as the same result.

Azure AI Foundry Agent Service​

Enumerates the agents in one Foundry project so they appear in the Agent Registry before any of them has called Beak. Foundry is the one hyperscaler agent platform with an official bring-your-own-model path: register Beak's Gateway /v1 base URL as a model connection in the project and those agents reach the Full Gateway level — Microsoft's own content filters do not apply to bring-your-own-model traffic, Beak's scan does.

Configuration fields: Project endpoint (required — https://<resource>.services.ai.azure.com/api/projects/<project>), Application (client) ID (required) and Entra tenant ID (required). Secret field: Client secret. Beak exchanges the secret for a token scoped to the Agents data plane on every call; the app registration needs the Azure AI User role on the project and nothing broader.

Google Vertex AI Agent Engine​

Enumerates the agents deployed to Agent Engine in one project and region — ADK, LangGraph, LlamaIndex or custom, every deployment is listed the same way.

Configuration fields: GCP project ID (required) and Vertex AI region (required). Secret field: a service-account key — the JSON file Google issues for a service account holding aiplatform.reasoningEngines.list and .get (the Vertex AI Viewer role covers both). Beak signs a token request with the key when it needs one and caches the result until shortly before it expires, so a saved integration keeps working unattended. A raw OAuth2 access token (gcloud auth print-access-token) is still accepted for a one-off check, but it expires within the hour; when it does, Test connection says so and suggests saving a service-account key instead.

Amazon Bedrock AgentCore​

Enumerates the agent runtimes hosted on AgentCore in one region. These are a different resource from the classic Bedrock Agents the Amazon Bedrock integration lists, on a different control plane, so an account that uses both needs both integrations; one AWS credential can back the two.

Configuration fields: AWS region (required), Access key ID (required), and Session token (optional). Secret field: Secret access key. The IAM principal needs bedrock-agentcore:ListAgentRuntimes and bedrock-agentcore:GetAgentRuntime. Both key parts are required: Beak never falls back to its own cloud identity to read a tenant's estate. Runtime environment variables, execution roles and authorizer settings are not recorded — only the runtime's id, name, ARN, version and status.

iGentic​

Enumerates every flow on iGentic 2.0 and lists each flow's orchestrator and member agents as separate agents, so they appear in the Agent Registry before any of them has called Beak. An agent that belongs to several flows is one registry row that records all of them; a GroupAgent flow's orchestrator is listed too, because it is the agent that hands work off and the one most worth governing.

Configuration fields: iGentic URL (required — the host where iGentic is deployed for your environment, for example https://<igentic-host>), Application ID (required — the X-App-Id registered with iGentic) and Agents path (optional — leave empty unless your iGentic serves all_agents on a route other than /api/iGenticAgents/all_agents). Secret field: Application API key — the X-Api-Key value, which is the shared secret immediately followed by your application's API key. Both values are provisioned from Azure Key Vault by the iGentic platform team; request them there. Beak sends the two headers on every call and never a user token.

The card also carries Generate integration key: one secret for the iGentic deployment that is a broker token for Beak's hooks and an integration key at the Gateway at the same time. Choose the Gateway team whose budget and allowlist cap the deployment; the key is shown once. Generating again rotates it — every adopted agent keeps the per-agent key Beak holds for it, only the deployment's secret changes. How the key is used in each integration mode is on iGentic.

Only each agent's id, name and agent type, and the id, name and type of the flows it belongs to, are recorded. Run history, prompts and configuration are not read. One caveat from the vendor: iGentic answers 200 with an empty list both when no flows are visible to your application and when its own database query failed, so an unexpectedly empty result is worth a look at the iGentic logs before assuming the estate is empty. Test connection reports the number of agents found for the same reason.

What each connection needs​

Every discovery integration's detail page carries a What this connection needs panel listing the exact permissions, roles or OAuth scopes the connector asks for. The list is not written into the console: it is declared by the connector that makes the calls and read from there, so it cannot drift from the code. Grant what it lists and nothing broader.

What discovery does and does not give you​

The eight outbound integrations above — Power Platform, Bedrock, AgentCore, Foundry Agent Service, Agent Engine, iGentic, Agentforce and A2A — all answer one question: what agents exist? None of them puts Beak on an agent's call path.

Every agent they find therefore arrives as a candidate, not as governed inventory:

  • Its governance state is discovered, and its coverage is observed.
  • Its governance tier is registered — inventory and identity only. No tool authorization, no prompt or completion inspection, no cost attribution.
  • Nothing is enforced for it until you onboard it. See Governing an Agent from Any Platform.

Warning: A platform reporting an agent as proxied does not mean Beak brokers its calls. Several of these platforms describe their agents that way as a matter of course, and Beak deliberately ignores it: a tier is declared from the source, never inferred from how a vendor describes its own agents. An agent appearing in this list is evidence that it exists, and nothing more.

Security Operations​

Microsoft Defender XDR​

Mirrors endpoint-DLP block events into Defender as custom alerts. Requires an Entra app registration with SecurityAlert.ReadWrite.All granted.

Configuration fields: Client ID (Entra App) (required), Tenant ID (Entra Directory) (required), Portal URL (optional — included as alertWebUrl so analysts can deep-link back to Beak), and Alert URL override (optional — for sovereign cloud endpoints). Secret field: Client Secret.

Microsoft Sentinel​

Batch-forwards every moderation audit to a Data Collection Endpoint and Data Collection Rule, writing into a custom Log Analytics table.

Configuration fields: Client ID (required), Tenant ID (required), DCE URI (required), DCR Immutable ID (required), Stream name (optional, defaults to Custom-BeakModerationAudit_CL), and API version (optional). Secret field: Client Secret.

Defender for Cloud Apps​

Pushes daily AI-site usage rollups so shadow-AI dashboards in Microsoft Defender for Cloud Apps (MCAS) reflect endpoint-level activity.

Configuration fields: Portal URL (required) and Activities path (optional). Secret field: API Token.

Data Governance​

Microsoft Purview​

Pulls sensitivity labels into Beak on a nightly sync so administrators can reference Purview classifications when building endpoint DLP policies.

Configuration fields: Client ID (required), Tenant ID (required), and List URL override (optional — for sovereign cloud endpoints). Secret field: Client Secret.

Notifications​

Microsoft Teams​

Posts an adaptive card to a channel webhook on every block event. Supports a Minimum severity field to filter low-noise events (low, medium, high, or critical). Secret field: Incoming Webhook URL.

Saving, testing and disabling​

Every integration configured through a credential form shares the same three actions and the same secret handling.

  • Save — Persists the configuration fields and, when provided, updates the secret. Required fields are validated before submission. The secret field is write-only: leave it blank to keep the stored value.
  • Test connection — Verifies that the saved credentials can reach the external service. The result — success with elapsed time, or failure with an error message — appears below the card, and the timestamp and outcome of the last test are shown in the card footer.
  • Disable — Stops the dispatch pipeline without deleting the configuration. The stored credential is kept, the card reads Disabled, and saving again re-enables it.

Secrets are encrypted at rest and are never returned by the API.

Where an integration's data appears​

Configuring an integration does not create a place to look at it. Each one feeds an existing screen, linked from the top-right of its configuration page:

IntegrationWhere its effect is visible
Anthropic Inference HooksIncidents — prompts allowed or denied
Microsoft Copilot StudioIncidents, Agent Registry
Power PlatformAgent Registry — discovered candidates
Microsoft Agent 365Microsoft Agent 365
Amazon BedrockAgent Registry — discovered candidates
Amazon Bedrock AgentCoreAgent Registry — discovered candidates
Azure AI Foundry Agent ServiceAgent Registry — discovered candidates
Google Vertex AI Agent EngineAgent Registry — discovered candidates
iGenticAgent Registry — discovered candidates
Salesforce AgentforceAgent Registry — discovered candidates
A2AAgent Registry — discovered candidates
Microsoft Defender XDRIncidents — the External systems section of an incident
Microsoft SentinelAudit Log, and the KQL query on an incident
Defender for Cloud AppsShadow AI
Microsoft PurviewPolicies — labels available to endpoint DLP rules
Microsoft TeamsDelivery status on an incident

Best Practices​

  • Group by type when you know the outcome, by vendor when you know the stack. The two groupings answer different questions. "How do I get blocks into my SIEM" is a type question and lands on Security Operations without knowing the answer is Sentinel; "what does Beak do with Microsoft" is a vendor question.
  • Read Disabled as a live finding, not a resting state. A stored credential with the integration switched off dispatches nothing. If something that used to reach your SIEM has gone quiet, this is the first card state to look for — it is distinct from Not connected for exactly that reason.
  • Do not read a missing status as Not connected. A card with no status label means the state could not be read, either because your account may not read that integration's configuration or because the request failed. Nothing can be concluded about the integration from it.
  • Run Test connection after every credential change, and read what it tested. A test is not a formality: for Power Platform it lists bots in each environment you named, because an app can obtain a token and still be refused by every environment. A green token exchange alone would prove nothing.
  • Configure Copilot Studio threat detection and Power Platform separately. They both mention Copilot Studio and neither replaces the other — one is inbound and enforces, the other outbound and finds. Configuring only the first leaves agents that have never called Beak invisible.
  • Leave the secret field blank when editing anything else. Every secret field is write-only; blank preserves the stored value. Retyping a secret you are not deliberately rotating is how a working integration breaks during an unrelated edit.
  • Check where the data lands before assuming an integration does nothing. Configuring a connector creates no new screen — each one feeds an existing page, listed in the table above.