Third-party Registration and Integration
Register AI Red Teaming as a trusted application in a third-party identity provider
to authenticate and run security scans against protected APIs and AI agents.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma AIRS (AI Red Teaming)
|
- Prisma AIRS AI Red Teaming License
- Prisma AIRS AI Red Teaming Deployment Profile
- An Azure account with an active subscription
- Admin access to Microsoft Entra ID (to grant application
permissions)
|
Many AI systems and agents restrict access behind authentication layers. To run security
scans against these protected targets, AI Red Teaming must authenticate as a trusted
client before it can send attack payloads. By registering AI Red Teaming as an
application in a third-party identity provider, you give it the credentials, including
client ID, tenant ID, and client secret, that allow it to obtain access tokens
automatically and interact with the target without any manual login or browser
interaction during a scan.
Supported Authentication Scenarios
AI Red Teaming supports two authentication scenarios through Microsoft Entra ID:
- OAuth 2.0 client credentials flow: Use this when your target is a REST
API or streaming endpoint protected by Azure Entra ID. This flow is designed for
server-to-server, fully automated authentication. AI Red Teaming uses the
client_credentials grant type to fetch and cache access
tokens throughout the scan without requiring a user to be present. Token refresh
is handled automatically.
- Microsoft Copilot Studio: Use this when your target is a Microsoft
Copilot Studio agent. This scenario uses a one-time delegated authentication
flow where you log in through Microsoft once to authorize AI Red Teaming. This
generates a refresh token valid for 90 days that AI Red Teaming uses to
authenticate for subsequent scans.
| Scenario | Target Type | Grant Type | User Interaction Required |
|---|
| OAuth 2.0 client credentials | REST APIs or streaming endpoints protected by Entra ID | client_credentials | None (fully automated) |
| Microsoft Copilot Studio | Copilot Studio agents | authorization_code (one-time) | Required once for initial authorization |
What Registration Enables
For both scenarios, you register AI Red Teaming as an application in Microsoft Entra
ID. The registration process differs depending on your target:
- (For OAuth 2.0) Configure Application permissions (not Delegated) and
skip the redirect URI. AI Red Teaming authenticates using its own identity and
does not require a user sign-in during scanning. Admin consent is required to
activate the Application permissions.
- (For Microsoft Copilot Studio) Configure Delegated permissions with
the CopilotStudio.Copilots.Invoke scope and add a redirect
URI. The redirect URI receives the authorization code after your one-time login,
which AI Red Teaming exchanges for a refresh token.
