Discover
Connect the platforms where your organization builds and runs AI, and bring every agent into one governed inventory.
Airia's discovery engine connects to the platforms where your organization already builds and runs AI (cloud agent platforms, low-code tools, identity providers, and code repositories) and enumerates the agents, bots, workflows, and AI integrations living there. Discovered assets land in a single inventory where they can be classified, risk-scored, governed, and secured.
You create connections under Discover → Connections. Each connector tile walks you through the credentials it needs. The setup guides in this section cover, per connector:
- What Airia discovers through the connector
- The authentication model
- The scopes, roles, and permissions to provision on your side
- Step-by-step setup
- The fields the connection form asks for
Available connectors
| Connector | What it discovers |
|---|---|
| AWS Bedrock | Bedrock Agents and Flows |
| Azure AI Foundry | Foundry project agents |
| Microsoft Entra ID (M365) | Users and their OAuth consents to third-party AI apps |
| Microsoft Copilot Studio | Copilot Studio bots, associated flows and topics |
| Google Workspace | Domain AI deployments plus per-user OAuth grants to AI apps |
| Google Agent Platform | Vertex AI Agent Engine and Dialogflow CX agents |
| GitHub | AI assets in GitHub repositories |
| LangGraph | LangGraph deployments |
| n8n | n8n workflows |
| Databricks | Registered models and serving endpoints |
| Cloudflare | Workers AI and AI Gateway usage |
| Gemini Enterprise | Gemini Enterprise deployments in a GCP project |
| ServiceNow | AI assets in a ServiceNow instance |
| Okta | Identity-side AI app visibility |
| Glean | Glean instance assets |
| Atlan | Atlan catalog assets |
| Microsoft Purview | Purview account assets |
| Salesforce Agentforce | Agentforce agents |
| Microsoft Power Apps | Power Apps across your Power Platform environments |
| Claude | Claude usage across Claude Code, Cowork, and claude.ai |
Code and manual sources
Not every AI asset comes from a platform connector. These cover the rest.
| Source | What it discovers |
|---|---|
| Airia Code Scanner | AI SDK imports, model calls, and agents defined in source code, reported from your CI pipeline |
| External Agent | A single agent added by hand — the catch-all for agents no connector picks up |
| Bulk Import Agents | A list of agents imported from a file |
Endpoint and network sources
These see AI usage on the device and on the wire, rather than in a vendor's console.
| Source | What it discovers |
|---|---|
| Browser Extension | AI sites used in the browser, per user, with monitor / warn / block / redirect enforcement |
| Endpoint Agent | Installed AI apps, AI browser extensions, and MCP configurations on managed Windows and Mac devices |
| SASE Integration | AI apps and data sources seen in your network traffic |
Routing discovered agents through a gateway
Discovering an agent and routing its traffic through an AI Gateway are separate steps. AWS Bedrock and n8n agents can be routed automatically from the inventory; Azure AI Foundry, LangGraph, Databricks, and code agents are routed manually by pointing their model endpoint at your gateway; and the shadow-AI connectors (Okta, Entra ID, Google Workspace, Cloudflare) are governed by revoking or blocking access rather than routed. See Routing Discovered Agents Through a Gateway for the full breakdown.
Multiple environments per connector
Every connector except Cloudflare supports multiple connections of the same type per tenant. Use the per-connection Name field to label them ("Prod subscription", "Dev subscription", "EU AWS account"); the connection list renders one row per connection, and each connection runs its own discovery refresh independently.
Common patterns:
| Scenario | How to set up |
|---|---|
| Prod + dev Azure subscriptions | Two Azure AI Foundry connections, each with its own service principal or role assignment |
| Two AWS accounts (prod + sandbox) | Two AWS Bedrock connections, each with its own access key |
| Two Entra tenants (for example, an acquisition still on a separate tenant) | Two Microsoft Entra ID connections, each with its own tenant-scoped service principal |
| Multiple Google Workspace domains | One Google Workspace connection per domain, each with its own impersonated admin |
| Multiple Copilot Studio environments | One connection per environment, or one connection using Microsoft's Global Discovery Service |
Cloudflare is the one exception: exactly one Cloudflare connection is allowed per tenant. To point Airia at a different Cloudflare account, delete the existing connection first.
To add another connection of a type you already use: Discover → Connections, click the connector tile, then Add another (top right of the connection list).
Refresh behavior
Discovery runs on a schedule per connection, and you can trigger a refresh manually from the connection page. A refresh is a full re-sync:
- New agents in the provider appear after refresh.
- Renamed agents update in place (the inventory entry stays stable across a rename).
- Agents deleted in the provider are removed from the inventory.
- Deleting a connection removes all of its discovered agents. Recreating the connection re-discovers from scratch as new inventory entries.