All Products
Search

This Product

    Agent Identity:Enterprise services for IDaaS

    Document Center

    Agent Identity:Enterprise services for IDaaS

    Last Updated:Sep 03, 2026

    When IDaaS users need to access enterprise services through an agent, configure enterprise services and Scope permissions for the user pool in Agent Identity. Follow these steps to authorize enterprise services, create or select an enterprise M2M application, configure Scope and the corresponding user permissions and outbound authorization scope, and verify the configuration.

    How it works

    Outbound enterprise service configuration involves two products:

    • IDaaS: Registers the target system as an enterprise M2M application, configures the audience identifier, and lets the permissions center manage Scopes, authorization methods, and user authorization.

    • Agent Identity: Lets you select enterprise services and Scopes for a user pool that is connected to the same IDaaS instance, creating the enterprise service authorization scope.

    Configure authorization in the following order:

    1. Authorize enterprise services: When you use enterprise services for the first time, select a credential vault and set the credential provider name in Agent Identity. The platform automatically creates and connects a dedicated IDaaS instance.

    2. Create an enterprise service and configure permissions: Create an enterprise M2M application, and configure its audience identifier, Scopes, and authorization method. An automatically authorized Scope is granted by default to all users who can access the current client. A manually authorized Scope requires user authorization.

    3. Configure the outbound authorization scope: In Agent Identity, select a user pool and an enterprise service, and select the user Scopes or user-and-machine Scopes required by the agent. Machine-only Scopes aren't currently shown in the Scope selection list.

    After the initial authorization, Agent Identity uses the automatically created dedicated IDaaS instance to manage access tokens for enterprise services. When an agent accesses an enterprise service on behalf of a user, it obtains and uses an access token as follows:

    1. Based on the authenticated user identity and the configured outbound authorization scope, Agent Identity initiates a token exchange (RFC 8693) with IDaaS.

    2. IDaaS issues an access token for the target enterprise service. The token's Scopes are restricted by the outbound authorization scope and the Scope authorization method. Automatic authorization applies to all users who can access the current client. Manual authorization also requires a match with the current user's authorization. The access token retains the user's identity information.

    3. The agent sends the access token when it calls the enterprise service. The enterprise service identifies the user and checks permissions based on the user identity and Scopes in the token. The user doesn't need to authorize each enterprise service request at runtime.

    For more information, see Token Exchange protocol. This topic doesn't cover token exchange request parameters, token claim fields, or calling code.

    Prerequisites

    Before you start, complete the following prerequisites:

    • Each user pool that requires authorization is connected to IDaaS. Its configuration details show the same IDaaS instance and its corresponding inbound application.

    • Identify the enterprise M2M application to authorize and its audience identifier.

    • Identify the minimum Scopes that the enterprise service must expose.

    • Identify the accounts, groups, or organizations that can access the enterprise service.

    • Grant the AliyunAgentIdentityFullAccess system policy to the RAM user or role used by the operator. Use an account with IDaaS management permissions.

    Authorize enterprise services

    Authorize an enterprise service before you use it for the first time. After authorization, the platform automatically creates and connects a dedicated IDaaS instance in the background.

    1. Sign in to the Agent Identity console.

    2. In the left-side navigation pane, select Outbound > Enterprise Service.

    3. Click Authorize.

    4. In the Authorize dialog box, complete the following settings:

      • Token Vault: Select the credential vault that stores the enterprise service credentials.

      • Name: Enter a credential provider name, or keep the default name generated by the system.

    5. Click Authorize.

    Create an enterprise service and configure permissions

    After authorizing the enterprise service, prepare its permissions in the following order: create an enterprise M2M application, manage Scopes, and configure user authorization.

    The permissions center centrally manages Scopes, application authorization, and user authorization. You can manage Scopes and user authorization in the Agent Identity console. You must go to the IDaaS console to create an enterprise service (M2M).

    Create an enterprise service (M2M application)

    First, create an enterprise M2M application and configure the audience identifier for the enterprise service:

    1. On the enterprise service page in Agent Identity, click Add Application to open IDaaS.

    2. In IDaaS, create or open the target enterprise M2M application.

    3. Go to Feature Permission Management, enable the feature, and configure the ResourceServer Identifier. The resource server identifier identifies the enterprise service that receives access tokens.

    4. Return to the enterprise service page in Agent Identity and reload the list.

    Manage Scopes

    If the enterprise M2M application doesn't include a required Scope, add it through Scope management.

    1. In the authorization scope of the target enterprise service, click Scopes Management.

    2. In the Scope Configuration panel, click Add Scope.

    3. Configure the following information:

      • Scope Name: Enter the display name of the Scope. This name is used only for management purposes.

      • Scope Identity: Enter the permission identifier. IDaaS includes this identifier in the access token it issues. Use the resource.action or resource.action.constraint format, such as user.read. The Scope identifier must be unique within the application.

      • Authorization Method:

        • Auto-Authorize: By default, grants the Scope to all users who can access the current client. No separate user authorization is required.

        • Manually: Requires user authorization to grant the Scope to specified accounts, groups, or organizations.

    Enterprise service Scopes are classified as follows. Scopes added through Scopes Management are user Scopes.

    • User Scope: Used to authorize user access and displayed in the outbound authorization scope in Agent Identity.

    • Machine Scope: Used for machine-to-machine access. It isn't displayed in the outbound authorization scope in Agent Identity, even if it has been created in IDaaS.

    • User & Machine Scope: Used for both user access and machine-to-machine access, and displayed in the outbound authorization scope in Agent Identity.

    Configure user authorization

    1. In the authorization scope of the target enterprise service, click User Authorization.

    2. In the User Authorization panel, click Authorize.

    3. Select an authorization type. You can authorize at the following levels:

      • Account

      • Group

      • Organization

    4. Select the accounts, groups, or organizations to authorize.

    5. Select the Scopes to grant.

    Note

    Automatically authorized Scopes can't be selected. The page displays Authorization is granted automatically.

    Configure the outbound authorization scope

    After configuring the enterprise service and Scopes, and completing user authorization for manually authorized Scopes, configure the outbound authorization scope in Agent Identity as follows:

    1. Open the target enterprise service from Outbound > Enterprise Service.

    2. In Basic Info, verify the IDaaS instance ID, credential provider name and ARN, and credential vault.

    3. On the Authorization tab, click Edit.

    4. In the User Pool section, select the user pools that can access the service. Handle unavailable items based on the reason shown on the page.

    5. In the Enterprise Service section, expand the target enterprise M2M application and select the minimum Scopes required by the agent to complete its tasks.

    6. Verify the user pools, enterprise service, and Scopes. Then click Submit.

    Note

    The Scope selection list currently shows only user Scopes and user-and-machine Scopes. Machine-only Scopes aren't currently shown in the list, even if they have been created in IDaaS.

    Verify the configuration

    After completing the configuration, check the following authorization relationships:

    • Basic information: Shows the correct IDaaS instance ID, credential provider name and ARN, and credential vault.

    • User pool scope: In edit mode, the summary shows the selected user pool count. In the details view, the authorized user pool count is displayed.

    • Enterprise service and Scopes: In edit mode, the summary shows the selected enterprise service and Scope count. In the details view, the authorized count is displayed.

    • Audience identifier: The correct resource server identifier is displayed in Feature Permission Management for the enterprise M2M application in IDaaS.

    Troubleshoot configuration issues

    Symptom

    Check

    Solution

    The user pool can't be selected.

    Check whether the page indicates that the user pool isn't connected to an IDaaS identity source.

    Open the Identity Providers page for the user pool, connect the IDaaS instance used by the current enterprise service, and reload the list.

    The enterprise service can't be selected.

    Check whether the page indicates that the enterprise service hasn't enabled “Feature Permission Management”.

    Open the IDaaS configuration from the Add Application entry point. Enable Feature Permission Management, configure the resource server identifier, and reload the list.

    Scopes aren't shown in the outbound authorization scope.

    Confirm the Scope type in IDaaS.

    Only user Scopes and user-and-machine Scopes are currently shown. Machine-only Scopes aren't shown. If a user Scope is missing, add it through Scopes Management and reload the list.

    A Scope can't be selected in user authorization.

    Check whether its authorization method is Auto-Authorize.

    An automatically authorized Scope is granted by default to all users who can access the current client, so no duplicate configuration is required. To restrict access to specific users, use a manually authorized Scope.

    The user doesn't have the required permissions.

    Check whether the Scope uses manual authorization and whether user authorization covers the target account, group, or organization.

    For a manually authorized Scope, use User Authorization to grant the required Scope to the target account, group, or organization.

    Related documentation