Configure Salesforce.com for AI agent imports

To import AI agents from Salesforce.com, you need to perform several configuration tasks in your Salesforce.com tenant and in Okta.

About this task

Configuring Salesforce.com for AI agent imports requires setup in two systems. In Salesforce, you create a dedicated integration user, assign the required permission set, and configure an OAuth app. In Okta, you set the Login URL for the Salesforce.com app integration.

Before you begin

Your Salesforce org has Agentforce enabled.
Your Salesforce org has the Agent platform builder license, which is required for the AgentPlatformBuilder permission set.
At least one Agentforce agent is listed in Setup > Agents.
You have System Administrator access in Salesforce.
The Salesforce.com app is added from the OIN catalog in your Okta org.
You know your Salesforce org's My Domain URL, which is the URL in your browser when you're logged into Salesforce (for example, https://yourorg.my.salesforce.com or https://yourorg.develop.my.salesforce.com).

Important:

If no Agentforce agents are listed in Setup > Agents, the import appears to succeed but shows no agents in Okta. Create at least one Agentforce agent before running the import.

Create a dedicated integration user

In Salesforce, go to Setup > Users > Users and click New User.
Set First Name to Okta and Last Name to AgentImport.
Enter your admin email address in the Email field.
Enter the username with the format okta.ai.import@yourdomain.com.
The username must be globally unique across all Salesforce orgs.
Set User License to Salesforce.
Set Profile to Minimum Access - Salesforce.
Click Save.

Assign the AgentPlatformBuilder permission set

In Salesforce, go to Setup > Users > Permission Sets.
Search for Agent Platform Builder and click it.
Click Manage Assignments.
Click Add Assignments.
Select the Okta AgentImport user and click Next.
Click Assign.
Go back to Permission Sets > Agent Platform Builder > Manage Assignments and confirm that the Okta AgentImport user has Active status.
This confirmation is required before continuing. If the user doesn't appear as active, the import fails with a no permission error in Okta.

Enable API login

If Test API Credentials fails in Okta, in Salesforce go to Setup > Security > Session Settings and enable Allow API login without IP restriction.
If this setting isn't visible, API login is already enabled in your org. This step is only needed for the initial credential check in Okta.

Create an external client app

In Salesforce Setup, open External Client App Manager and click New External Client App.

Note:
Salesforce recommends external client apps for new integrations. If external client apps aren't available in your org, you can use a connected app instead.
In the External Client App Name field, enter Okta AI Agent Import.
Enter your admin email in Contact Email and set Distribution State to Local.
Select Enable OAuth.
Enter the callback URL as https://localhost.
Add Manage user data via APIs (api) to the OAuth scopes.
Click Save.
Reopen the app and click Edit.
Flow enablement settings only become available after the app is saved.
Under Flow Enablement, select Enable Client Credentials Flow.
In the Run As (Username) field, enter okta.ai.import@yourdomain.com.
Under OAuth Policies, set IP Relaxation to Relax IP restrictions.
Set Permitted Users to All users may self-authorize.
Click Save.
It may take up to five minutes for the app to activate.

Get the consumer key and consumer secret

In Salesforce Setup, go to External Client App Manager.
Find the Okta AI Agent Import app, click the dropdown arrow, and select View OAuth Settings.
Copy the Consumer Key and the Consumer Secret. Store both values safely.
You need these values when you configure the AI agent import in Okta.

Set the login URL in Okta

In the Admin Console, go to Applications > Applications.
Select the Salesforce.com app instance.
Select the General tab and click Edit.
In the Login URL field, enter your org's My Domain URL, copied exactly from your browser.

Important:
Include the full domain with any subdomains, for example https://yourorg.develop.my.salesforce.com. A missing subdomain causes a silent HTTP 500 error when you test credentials and is the most common cause of setup failure.
Click Save.

After you have completed these configurations, see Enable AI agent imports for an app.