> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/access-control/unauthorized-application-monitoring-agent.md).

# Unauthorized Application Monitoring Agent

The Unauthorized Application Monitoring agent automatically scans your identity provider (IdP) for applications that have not been formally approved and surfaces them to your team on a recurring schedule. Instead of manually auditing your application catalog, you get a ready-made ticket, a detailed report, and a direct notification every time the agent runs - so unauthorized apps never go unnoticed.

### What the Agent Does

Each time the agent runs, it performs the following actions:

1. **Scans your IdP** for any application that lacks an approved status in your catalog.
2. **Creates a ticket** that lists every unauthorized application found during that scan.
3. **Attaches a CSV report** to the ticket containing enriched details for each app, including owner, status, assigned users, first-seen date, last-seen date, and more.
4. **Notifies the IT desk owner or assignee** via Slack or Microsoft Teams so the right person can act immediately.

### Supported Identity Providers

The agent works with the following IdPs:

* Okta
* Microsoft Entra
* Google Workspace
* JumpCloud

### Prerequisites

Before activating the agent, make sure you have:

* A connected IdP integration (Okta, Entra, Google Workspace, or JumpCloud)
* A ticketing integration configured (for ticket creation)
* A Slack or Microsoft Teams integration configured (for notifications)
* Defined which applications in your IdP catalog are considered approved

### Setting Up the Agent

1. Navigate to **AI Agents** in the left sidebar and select **Unauthorized Application Monitoring**.
2. Choose the IdP you want the agent to scan.
3. Select your ticketing destination where new tickets should be created.
4. Choose the IT desk owner or assignee who will receive Slack or Teams notifications when the agent surfaces unauthorized apps.
5. Set the recurring schedule that controls how often the agent runs (for example, daily or weekly).
6. Save your configuration and activate the agent.

Once activated, the agent will run automatically on the schedule you defined.

### Understanding the CSV Report

Every ticket created by the agent includes an attached CSV report. The report contains one row per unauthorized application and includes the following fields:

| Field            | Description                                 |
| ---------------- | ------------------------------------------- |
| Application Name | The display name of the app in your IdP     |
| Owner            | The user or team assigned as the app owner  |
| Status           | The current approval or provisioning status |
| Assigned Users   | Number of users with access to the app      |
| First Seen       | Date the app was first detected in your IdP |
| Last Seen        | Most recent date the app was observed       |

Use this report to prioritize remediation, track repeat offenders, and maintain an auditable record of your application catalog reviews.

### Recurring Schedule

The agent runs on a schedule you configure during setup. On each run:

* Only applications that are currently unauthorized at the time of the scan are included.
* A new ticket is created for each run so you have a clear, time-stamped history of findings.
* The designated owner or assignee receives a fresh notification via Slack or Teams.

Adjust the schedule at any time by returning to the agent's configuration page.

### Notifications

When the agent completes a scan and finds unauthorized applications, it sends a notification to the configured IT desk owner or assignee through your connected messaging platform. The notification includes a summary of what was found and a link to the newly created ticket, so the recipient can jump directly into the details without searching for context.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/ai-agents/access-control/unauthorized-application-monitoring-agent.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.