Okta Salesforce AI Agent Import Fails with Unsupported Import Source for Copilot-Class Agents

Okta fails to import Salesforce Artificial Intelligence (AI) agents when the Salesforce organization uses legacy Copilot-class agents instead of the supported Agentforce agents. Administrators must manually register legacy agents in Universal Directory or verify the configuration of connected applications for Agentforce agents. When an administrator imports AI agents from a Salesforce organization via Admin Console > AI Agents > Import from AI Agent Providers > Salesforce, the Test API Credentials step fails with the following user interface message:

credentials don't have permission to list AI agents

Reviewing the underlying Application Programming Interface (API) response shows the actual cause:

{"errorSummary": "Api validation failed: AIAgentImportProvider",
 "errorCauses": [{"errorSummary": "Unsupported import source."}]}

This failure occurs even when the administrator configures the Salesforce Connected App correctly with the Client Credentials flow, a pre-authorized admin profile, and Run As set to a System Administrator. A direct API test confirms the token issues successfully with all required Salesforce permissions in place.

• Okta Identity Engine (OIE)
• AI Agents
• Salesforce Integration

The Okta Salesforce AI Agent Import integration only supports Agentforce agents backed by the modern GenAiPlanner object. Legacy Salesforce Copilot-class agents, stored as botDefinition records with Type = ExternalCopilot or InternalCopilot, are not a supported import source. Okta fails the import at the source-validation step regardless of the connected application and permission configurations because the rejection happens before Okta evaluates credentials.

How does an administrator confirm the Salesforce agent type?

Confirm the Salesforce organization agent type by querying the GenAiPlanner object and checking for an invalid type error.

1. Query the GenAiPlanner object using the Salesforce API.
2. If the query returns an invalid_type error and the existing agents appear as botDefinition records with Type = ExternalCopilot or InternalCopilot, the organization uses Copilot-class agents.

How can administrators register the Copilot-class agents manually in Okta?

Navigate to the Okta administrator dashboard, manually register the legacy Copilot-class agents in Universal Directory, and submit feedback for broader support.

1. Navigate to the Admin Console.
2. Register the agents manually as AI Agents in Universal Directory.
3. Submit feedback via Okta Ideas if broader support for Copilot-class agents is required.

What steps resolve the issue for Agentforce agents?

Verify the Client Credentials flow configuration and confirm the Run As profile settings in the connected application.

1. Verify the Client Credentials flow configuration in the connected application.
2. Confirm the Run As profile is set correctly.