Skip to main content
Documentation
Documentation
Administrator Guide
Last Updated: 2026-03-13
Configure External Agents

Configure External Agents

Security: These domains in the Agent System of Record functional area:
  • Agent Compliance
  • Agent Management Hub
  • Manage: Agents
  • Reports: Agent Reporting
  • Setup: Agents
Security:
Reports: AI Agent Security
 in the System functional area.
For Ambient-mode agents only:
You can configure external agents using the
Agent Management Hub
.
  1. Access the
    Agent Management Hub
     report.
  2. Select the
    Agent Registry
     tab and then click on the agent name to configure the agent.
  3. From the agent's profile view, click
    Configure Agent
    .
  4. In the
    Status
     column, make each relevant skill available by enabling the toggle slider.
  5. For each available delegate execution mode skill, populate the
    Available To
     prompt and determine the security groups that you want to add for that specific skill for the agent.
    The security groups you select in the
    Available To
     prompt must also have permissions to the domain or business process security policies that secure the agents’ tools. You can use the
    View Security for Agent Skill
     report to assist with your agent security configurations. This report shows you detailed information about the agent’s Tools APIs and the respective domain or business process security policies and permissions. At agent runtime, Workday evaluates both user access to the agent and the user access to the APIs the agent is executing as tools.
  6. Click the
    Confirm
    check box, and then click
    OK
    .
    1. For delegate skills, you must provide a
      Redirect URI
       as the callback endpoint for your agent. Your agent development partner can provide this information.
    2. For ambient skills, you must provide an x509 public key from your agent development platform. Your agent development partner can provide this information. Select a unique key that’s not in use by another agent. See also: Create an X.509 Public Key. Security: The
      Security Administration
       domain in the System functional area.
  7. Click
    OK
    .
  8. When you configure the agent for the first time, we display the OAuth client details for the agent.
    Copy and save the Client ID and Client Secret values. This page won’t display again and you won’t be able to access this information again.
  9. Enter the OAuth client details and endpoint URLs back into the agent development platform code for the agent to enable access during runtime. The OAuth client and endpoint URLs details that we display include:
    • Authorize Endpoint URL
    • Token Endpoint URL
    • Endpoint URL
    • OAuth 2.0 Client ID
    • OAuth 2.0 Client Secret (Delegate only)
    • Username for Agent System Account (Ambient only)
  10. Select
    Agent Registry
    , and click the agent you want to activate.
  11. From the agent's profile view, click
    Activate Agent
    . On the
    Activate Agent
     window, select the
    Confirm
     check box, and then
    OK
     to complete the activation.
Workday automatically creates an Agent System User (ASU) and assigns an Agent Security Group (ASG) for the agent - which you can find through the
All AI Agent Accounts
 report, secured to the
Workday Accounts
 domain in the System functional area. You can use these as you configure the security policies and permissions for your agent.