Contact Us 1-800-596-4880
  1. Homepage
  2. Enhanced MuleSoft Experience

  3. Adding Scanners from Providers

Adding Scanners from Providers

A scanner is the configured link between the system and a supported cloud provider that lets discovery jobs find services—such as APIs, agents, and MCP servers—and register them in the right Portfolio catalogs, and to discover and read policies from API configurations. Scanners enable automated discovery so your catalogs stay current without manual registration. Configure a scanner once to turn on discovery for a provider, then extend it as your organization adds catalogs or enabled features.

For how provider connection and catalogs fit together, see Create a Scanner for Provider Services and Adding Services to Your Portfolio.

Before You Begin

Before getting started, make sure you have:

Benefits of Provider Scanners

  • Keep catalogs current

    New and changed services in the provider appear in the system without manually re-entering each registration.

  • Centralize visibility

    Discovered services appear in Portfolio where teams can govern, monitor, and deploy from one place.

  • Stay aligned with the provider

    Scheduled or on-demand scans pick up releases and configuration drift according to the options your administrator allows.

  • Policy-visibility

    When a scanner is enabled, it can discover and read policies from API configurations. This allows the system to enforce policies on the discovered services. This is especially useful for API-based policies, such as web application firewall (WAF) policies.

  • Policy write

    For API gateway providers that support policy write (Azure API Management, Google Apigee, and Kong Gateway), a scanner connection whose credentials carry the provider’s write scope lets you apply, enable, disable, and remove policies on discovered APIs directly from Anypoint. For write scopes and requirements, see Policy Write Prerequisites.

Workflow Entry Points for Adding a Scanner

The system exposes the same underlying connect-and-configure wizard from more than one place; the label depends on context:

  • Home

    Start from the general Add Services area and choose the path that connects a provider and defines a scanner (Connect to Provider).

  • Providers

    Use the area dedicated to provider and scanner management if your navigation includes it. Add or refine scanners alongside other provider work.

    The Akamai API Security scanner doesn’t import services; it scans third-party provider security policies and surfaces vulnerability findings for related APIs, agents, and MCP services already in Portfolio catalogs.

  • Portfolio

    Open the catalog that matches the service type you want (Agents, APIs, MCP Servers, and others your tenant supports). Use that catalog’s add control—the label indicates the type (for example Add API)—then choose provider connection to scan and discover services to add to that catalog. Not all services have a catalog. If the service doesn’t have a catalog, you can still add it to the system by using the Add Service button on the Providers page.

Navigation labels can vary by catalog, enabled features, and release.

Akamai API Security Scanner

The Akamai API Security scanner behaves differently from import-based scanners. It doesn’t discover and import services from third-party providers into Portfolio catalogs. Instead, it scans third-party provider security policies and observed security data, correlates those results to existing services, and surfaces risk scores and vulnerability findings in related Portfolio catalogs. Akamai API Security appears in the provider list only when your administrator has enabled the Akamai API Security feature for your organization.

When you save an Akamai API Security scanner, the system automatically starts Akamai Correlation Policy application. This policy is required for Akamai to attribute security findings to your MuleSoft APIs by stamping correlation headers on API responses.

For setup details, policy behavior, and result interpretation, see Correlating Risk Using Akamai API Security.

Monitor Correlation Policy Status

After creating an Akamai scanner, the scanner detail page shows an Akamai Correlation Policy section with the live policy application status:

  • Correlation policy not applied — amber warning with an Apply policy now button.

  • Partial — a progress indicator showing how many environments are covered while the apply workflow runs.

  • Applied — green badge confirming all environments are covered.

When the policy is applied, the section shows a table with one row per environment and runtime combination. The table includes columns for Environment, Runtime (Omni Gateway or Mule 4), Status (Applied or Disabled), APIM Policy ID, and Asset Version.

If some environments show no policy binding, select Check again to retry the policy application for those environments only. The operation is safe to repeat.

Microsoft Copilot Studio Scanner OAuth Authorization

Microsoft Copilot Studio scanners support two authentication schemes. Create, authorize, and test the provider connection before you continue scanner setup.

  • OAuth: Uses client credentials. Tenant ID is required, and you validate the connection directly without an interactive sign-in.

  • OAuth (Authorization Code): Uses an interactive Microsoft sign-in and consent. Tenant ID is optional; if you don’t provide one, the connection defaults to the home tenant ID after authorization. This scheme requires a pre-configured customer OAuth application. Configure the OAuth application in Azure to request the Dynamics CRM user_impersonation scope, and set the OAuth callback URL to https://<your_anypoint_host>/secrets-manager/api/v1/connections/oauth/callback.

    1. From Platform > Providers, select Microsoft.

    2. In Connect to Provider, under Platform, select Microsoft Copilot Studio.

    3. Under Authentication, select OAuth or OAuth (Authorization Code).

    4. Enter connection values:

  • Tenant ID: Microsoft Entra tenant ID. Required for OAuth; optional for OAuth (Authorization Code).

  • Client ID: OAuth 2.0 client ID from your Azure app registration.

  • Client Secret: OAuth 2.0 client secret from your Azure app registration.

  • Scope: Dataverse environment URL, for example, https://<your-environment>.api.crm.dynamics.com. Required for OAuth (Authorization Code); optional for OAuth.

    1. Complete the connection:

  • For OAuth, click Test Connection and confirm the connection succeeds.

  • For OAuth (Authorization Code), click Create & Authorize Connection. In the Microsoft popup window, sign in and grant consent, then wait for status to progress through Connection created, Authorized, and Tested.

    1. Confirm the connection succeeds or the message Connected to Microsoft appears, then click Continue.

The OAuth (Authorization Code) flow opens a Microsoft sign-in popup. If your browser blocks popups, authorization can’t complete and scanner setup stays in the authorizing state.

Scanner Configuration Overview

Regardless of entry point, adding a scanner establishes trust and scope. You specify which provider platform to reach, how the system authenticates, and how you validate connectivity. You also name and schedule the scanner—or configure another trigger—so discovery runs on the cadence your team expects. Saving the configuration activates the scanner for the catalogs and features your administrator enabled.

For API gateway providers that support policy write, supply connection credentials that include the provider’s write scope during setup. If the connection has only read access, the scanner discovers and reads policies, but the affected APIs appear as Read-Only and policy actions are unavailable until the connection’s identity is granted the provider’s write scope. For provider-specific read and write scopes, see Scanner Prerequisites by Provider.

After the Scanner Runs

When the scanner is active, it applies discovery results according to its settings and your organization’s rules. You review outcomes on the Providers page and on scanner detail pages, and you manage discovered services from the relevant Portfolio catalogs.

For API scanners, policy-read results are visible from each discovered API in Portfolio > APIs > Policies. This includes read policies from Amazon API Gateway, Google Apigee, Azure API Management, and Kong Gateway. Use this view to verify imported controls and confirm scanner coverage by provider.

For ongoing operations (pause, edit, or delete), see Running and Managing Scanners.

See Also