Procedure

1. Register the AI agent from one of these entry points:
   1. In the Admin Console, go to Directory > AI Agents, and click Register AI Agent.
   2. Alternatively, you can go to Applications and Resources > Applications and select an app integration that's configured for Cross App Access. Select Machine Assignments > Resources, and then click Register AI Agent.
2. Under Profile, add a name and description for your AI Agent.
3. Click Next.
4. Under User access and authentication > Allow users to access this agent, select one of the following options.
   • Create a new OIDC app linked to this AI agent: To create a custom OIDC app integration instance for users to sign in to access the AI agent.
   • Select an existing app: To select an existing app integration instance in your org for users to sign in to access the AI agent. If you register an AI agent from an existing app, the existing app is prepopulated in this section.

   For details, see AI agent configuration settings - supported requesting apps.

   Note: For OIDC apps, this action permanently links the AI agent to the app. If you need to make a change to the linked OIDC app, delete the AI agent and recreate it. The app that you select in the User access tab acts as the requesting app role for the XAA flow. It allows your users to sign in to the agentic app through Okta. After the user is signed in, the agentic app can access resource apps on behalf of the signed in user.

   The app that you select in the User access tab acts as the requesting app role for the XAA flow. It allows your users to sign in to the agentic app through Okta. After the user is signed in, the agentic app can access resource apps on behalf of the signed in user.

5. Click Next. Your AI agent appears in the AI agents list with the STAGED status.

6. On the Client registration tab, click Configure next to the a client registration method that you want to use:
   1. Client ID Metadata Document (CIMD): Recommended for AI agents that are identified by a developer-hosted URL.
      Note: If you configure CIMD as the client registration method, you can't change this later.

      1. Enter the CIMD URL.
      2. Click Activate CIMD client registration.
      3. Click Activate. The CIMD URL activates and appears on the Client registration tab for the AI agent and on the General tab of the app that's linked to the AI agent.
         Note: Alternatively, you can add the CIMD URL directly to the app that's linked to the AI agent. The URL is automatically configured as the AI agent's client registration method.
   2. Client ID only: Recommended for public clients that can't store a secret, like local coding agents.
   3. Client secret: Recommended for server-side AI agents. Click Generate secret and provide it to the AI agent builder or developer.
   4. Public/private key: Recommended for AI agents that have builder-managed key pairs.
      1. Click Add public key.
      2. Enter your public key, or click Generate new key. Okta creates a public key that's associated with a private key that you can view in JSON or PEM.
      3. Click Copy to clipboard and store the private key safely.
      4. Click Done.
7. Copy the identifier that appears in the Client ID field and provide it to the AI agent builder or developer.
8. Click Activate.
   Note: If a client registration method is already active, a Switch button appears. If you switch to a different client registration method, the original registration details are disabled, and its details are retained on the Client registration tab.
9. Click Enable on the dialog that appears.
   Note: The AI agent can't use this client registration method until the AI agent builder or developer implements the client secret.
10. To deactivate a client secret or public key, click the vertical ellipses and select Deactivate. To remove it, click the vertical ellipses again and select Delete.

11. Select your AI Agent from the list of Directory > AI Agents.
12. Click the User access tab.
13. Under User access > Users and groups assigned to this agent, click Application > Assignments. The Assignments tab appears for your linked SSO app.
14. In the Assignments tab, select the users or groups who can access the AI agent. See Assign an app integration to a user and Assign an app integration to a group.
    Note: Your linked SSO app is initially inactive, so if you're navigating from the Applications page, it may be listed in the Inactive tab.

15. On the AI agent page, select Actions > Activate.
    Note: Activating your AI agent can take a few seconds. Wait until you see the AI agent activated successfully message before you continue configuring or using your AI agent.

    You can also activate the AI agent indirectly by activating the linked requesting app.

    1. Go to Applications and Resources > Applications.
    2. Select the Inactive tab from the STATUS column, and find the linked requesting app that you want to activate.
    3. Select Activate from the dropdown menu beside your app integration. The AI agent is automatically activated when you activate the linked app.

    To deactivate the AI agent, go to the AI agent page and select Actions > Deactivate.

    Note:

    • • Deactivating your AI agent can take a few seconds. Wait until you see the AI agent deactivated successfully message before you continue with other configurations.
      • The requesting app linked to the AI agent is also deactivated.