SaaS Management Vendors

This article provides instructions on how to configure different vendors with your Policy Orchestration Points (POP) and how to locate the Vendor Policy ID according to each vendor. Users will need to modify and add the credential objects as listed in the POP API Documentation according to their preferred vendor. These credentials are acquired from the vendors and are used as parameters in the POP APIs.

Power BI

This section outlines the parameters required for integrating Power BI with your system. It provides a detailed explanation of the general parameters necessary for authentication and access, as well as the optional Discovery Scope Parameters used to customize user permissions and Workspace or Dataset discovery.

General Parameter Table:

Credentials Parameter Table:

Discovery Scope Parameter Table:

Power BI Credentials Examples

Workspace Example:

...
{
    "popConnectionCredentials": {
        "authenticationMethod": "service_principal",
        "credentials": {
            "clientID": "84f8n492-f2ce-446b-bace-6df750c2e8c9",
            "clientSecret": null, //For use with PlainID Internal Store.
            "secretKey": "john-powerbi", //replaces clientSecret when using External Secret Stores.
            "secretStore": "azure", //Store ID
            "tenant": "0d417611-5b17-425e-a5b9-7b98e1aa24b8",
        "discoveryScopeRule": {
            "OR": [
                {
                    "AND": [
                        {
                            "hierarchyScopeKey": "workspace",
                            "operator": "EQUALS",
                            "value": ["workspace1"]
                        }
                    ]
                }
            ]
        }
    }
}
}
...

Dataset Example

...
{
    "popConnectionCredentials": {
        "authenticationMethod": "service_principal",
        "credentials": {
            "clientID": "84f8n492-f2ce-446b-bace-6df750c2e8c9",
            "clientSecret": null, //For use with PlainID Internal Store.
            "secretKey": "john-powerbi", //replaces clientSecret //replaces clientSecret when using External Secret Stores.
            "secretStore": "azure", //Store ID
            "tenant": "0d417611-5b17-425e-a5b9-7b98e1aa24b8",
        "discoveryScopeRule": {
            "OR": [
                {
                    "AND": [
                        {
                            "hierarchyScopeKey": "dataset",
                            "operator": "EQUALS",
                            "value": ["workspace.dataset"]
                        }
                    ]
                }
            ]
        }
    }
}
}
...

Zscaler

Credentials Parameter Table:

Zscaler Credentials Example

...
        "popConnectionCredentials": {
            "authenticationMethod": "client_credentials",
            "credentials": {
                "API Key": "NzIwNTkwMjQyNjIwMzc1Nzg0OTIwOGFjMmUtYjE1OS00NDg4LTllZmQtYTExY2IzZjI0ZWIw",
                "API Key Secret": null,
                "Customer ID": "72059024269137504",
                "Customer based URI": "https://config.zpabeta.net"
            }
        },
...

Snowflake

Credentials Parameter Table:

Snowflake Credentials Examples

Key Pair Authentication Example:

...
"popConnectionCredentials": {
    "authenticationMethod": "key_pair_authentication",
    "credentials": {
        "secretStore": "aws", //Store ID
        "computeWarehouse": "compute_wh",
        "port": 443,        
        "server": "en14622.us-central-99.snowflakecomputing.com",
        "secretKey": "john-keypair-snowflake" //replaces privateKey when using External Secret Stores
        "privateKey": ---BEGIN PRIVATE KEY-----\nMIIEvgIBADANBgkqhkiG9w0BAQEFAASCDKgwggSkAgEAAoIBAQDPXCe7Cr4FDSPml\n04JPDLMBCRHW2R+JIsivYUNUkI4SDF2CydeMw41lPhp4iLldVd7Zgwl4RGvvjxed+Q\nDUqQrWjeuGGW....3g\nHvIliGQqZkACN6n4GcaCZHJJudxZDisDQsIvOQlWuloZ9blkYp34Qnw+0umu1n1Y\nvHs5vuqB7DD2341Xpg+xNLVL\n-----END PRIVATE KEY-----\n"} //For use with PlainID Internal Store
    }
}
...

Databricks

Credentials Parameter Table:

Databricks Credentials Example

...
        "popConnectionCredentials": {
            "authenticationMethod": "service_principal",
            "credentials": {
                "Client ID": "31844d10-84af-4931-8c05-427f1894e598",
                "Client Secret": "null", //For use with PlainID Internal Store
                "Host": "https://adb-3194995835232616.16.azuredatabricks.net/",
                "secretKey": "john-databricks", //replaces clientSecret when using External Secret Stores
                "secretStore": "azure", //Store ID
                "Warehouse ID": "36d1918d74ca0e82"
            }
        },
...

Databricks ABAC

Databricks ABAC connects to a single Unity Catalog through a Databricks Service Principal using OAuth machine-to-machine (M2M) authentication. All connection settings fields are required.

Note: Databricks ABAC supports only the LEARN mode.

General Parameter Table:

Credentials Parameter Table:

Discovery Scope Parameter Table:

Databricks ABAC Credentials Example

...
    "popConnectionCredentials": {
        "authenticationMethod": "servicePrincipal",
        "credentials": {
            "secretStore": "PLAINID_INTERNAL_SSM_PARAMETER_STORE",
            "host": "https://my-workspace.cloud.databricks.com",
            "clientID": "<service-principal-client-id>",
            "clientSecret": "<service-principal-client-secret>",
            "warehouseId": "<sql-warehouse-id>"
        },
        "discoveryScopeRule": {
            "OR": [
                {
                    "AND": [
                        {
                            "hierarchyScopeKey": "catalog",
                            "operator": "EQUALS",
                            "value": ["main"]
                      
...

Microsoft Azure APIM

PlainID connects directly to your Microsoft Azure API Management (APIM) service instance using client credentials. PlainID uses this connection to discover MCP servers and tools.

Note: Set the vendorName to "apim" when you create the POP.

General Parameter Table:

Credentials Parameter Table:

All credentials are required.

Microsoft Azure APIM Credentials Example

...
"popConnectionCredentials": {
    "authenticationMethod": "client_credentials",
    "discoveryStorageHosting": "PLATFORM_HOSTED",
    "credentials": {
        "azureTenantId": "72f988bf-86f1-41af-91ab-444444444444",
        "azureClientId": "0e5c1a2b-3c4d-4e5f-a6b7-555555555555",
        "azureClientSecret": "xYz~secretValue",
        "azureSubscriptionId": "a1b2c3d4-e5f6-4a7b-8c9d-666666666666",
        "azureResourceGroup": "rg-apim-prod",
        "apimServiceName": "contoso-apim",
        "secretStore": "PLAINID_INTERNAL_SSM_PARAMETER_STORE"
    }
}
...

Kong

Kong connects to a Kong Konnect control plane using an access token. PlainID uses this connection to discover MCP servers and tools.

Note: Set the vendorName to "kong" when you create the POP.

General Parameter Table:

Credentials Parameter Table:

All credentials are required.

Kong Credentials Example

...
"popConnectionCredentials": {
    "authenticationMethod": "client_credentials",
    "discoveryStorageHosting": "PLATFORM_HOSTED",
    "credentials": {
        "kongBaseUrl": "https://us.api.konghq.com",
        "kongControlPlaneId": "b2f3c4d5-6e7f-4a8b-9c0d-333333333333",
        "kongAccessToken": "kpat_xxxxxxxxxxxxxxxxxxxxxxxx",
        "secretStore": "PLAINID_INTERNAL_SSM_PARAMETER_STORE"
    }
}
...

Google BigQuery

Google BigQuery uses a GCP Service Account JSON key file for authentication. The serviceAccountKeyJson field accepts the full contents of the JSON key file downloaded from GCP IAM, encoded as an escaped JSON string.

Parameter Table:

Credentials Parameter Table:

Service Account JSON Key Structure

The serviceAccountKeyJson string, once unescaped, contains this structure:

Google BigQuery Credentials Example

...
        "popConnectionCredentials": {
            "authenticationMethod": "serviceAccount",
            "credentials": {
                "secretStore": "PLAINID_INTERNAL_SSM_PARAMETER_STORE",
                "projectId": "plainid-demo-project",
                "serviceAccountKeyJson": "{\n  \"type\": \"service_account\",\n  \"project_id\": \"plainid-demo-project\",\n  \"private_key_id\": \"1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\",\n  \"private_key\": \"-----BEGIN PRIVATE KEY-----\\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7VJTUt9Us8cKj\\n...\\n-----END PRIVATE KEY-----\\n\",\n  \"client_email\": \"bq-service-account@plainid-demo-project.iam.gserviceaccount.com\",\n  \"client_id\": \"123456789012345678901\",\n  \"auth_uri\": \"https://accounts.google.com/o/oauth2/auth\",\n  \"token_uri\": \"https://oauth2.googleapis.com/token\",\n  \"auth_provider_x509_cert_url\": \"https://www.googleapis.com/oauth2/v1/certs\",\n  \"client_x509_cert_url\": \"https://www.googleapis.com/robot/v1/metadata/x509/bq-service-account%40plainid-demo-project.iam.gserviceaccount.com\",\n  \"universe_domain\": \"googleapis.com\"\n}\n"
            }
        },
...

Vendor Policy ID

Depending on the vendor, the location, and format of the Vendor Policy ID may vary:

Databricks, Snowflake, Zscaler, Google BigQuery

For these vendors, the Vendor Policy ID is displayed in the Policy Details panel. You can use this value directly when managing or troubleshooting vendor-side policies.

Power BI

For Power BI, the Vendor Policy ID is generated using a concatenation format:

role_<datasetID>_<roleId>

Example:

role_3e93e93w-8fs7-8sf8-83d8-9d8s6f6g7h82_19283

In this format:

• role is static
• datasetID refers to the unique identifier of the Power BI dataset.
• roleId refers to the specific role applied to that dataset.