Collector Connections¶

A connection is one Databricks workspace, or one service of one Microsoft tenant, that the AI Assets Collector scans on a runtime plane. You add each one on its own, and they can share one collector pod instead of each running its own.

Use connections when one runtime plane has to scan several workspaces or tenants — for example, a production and a development Databricks workspace, or the Azure AI Foundry projects of two business units.

The collector tiles¶

Open the runtime plane (Settings > Runtime > your runtime plane), select the Collectors tab and click Add New. Available Connectors shows the AI Assets Collector tiles:

A connection is for one source. A Microsoft connection queries only its own service: an Azure AI Foundry connection never calls Copilot Studio or M365, so a service principal that can only read Foundry gets no errors for the others. To scan more than one service of a tenant, add one connection per service. They can use the same tenant and the same saved credential.

What each Microsoft connection needs¶

All three use a service principal of the tenant: tenant ID, client ID and client secret, or a saved credential of type Azure Entra Service Principal.

Interaction monitoring reads the tenant's Copilot interactions from Microsoft Defender and Microsoft Graph. It needs the Graph application permissions ThreatHunting.Read.All, AiEnterpriseInteraction.Read.All and AuditLogsQuery.Read.All.

One connection per workspace and per service¶

Each workspace, and each service of a tenant, is read by one connection on a runtime plane, Shared or Dedicated. A save that breaks one of these rules is refused, and the form shows why under the field concerned.

A refusal reads like "Tenant …'s … is already collected by the Shared connection …" or "The Shared connection '…' on this runtime plane already uses this Databricks host" ("Dedicated connection" for a Dedicated one). Use the existing connection, or delete it first.

Good to know:

• A connection whose discovery switch is off collects nothing and is not checked.
• Editing a connection is checked only for a service the edit turns on, so other edits — a secret rotation, tags — always save.
• A saved Azure credential's client ID cannot change after it is created, so editing a credential never makes two Foundry connections clash.

Choose the Deployment Mode¶

Deployment Mode is on the BASIC INFO tab, after Name.

A Custom agents connection has no choice: it is always Dedicated.

Choose a shared host¶

A runtime plane can have several shared hosts. Each runs up to 10 Shared connections in one pod and has its own settings — scanner interval, trace classification and Kubernetes settings — so a group of connections can scan on its own schedule.

When you choose Shared, the Shared host list shows:

• Default first: the runtime plane's original shared host, ai-assets-collector. On a runtime plane with no shared host yet it reads "Default · new · created on Save", and saving the connection creates it.
• Then each named shared host, with how many connections it runs ("6 / 10"). Hover a host to see its description. A full host (10 / 10) cannot be chosen.
• Last, + Create new shared host. Give it a name (lowercase letters, digits and hyphens, up to 33 characters) and an optional description. It is created when you save the connection, named ai-assets-collector-<name>, and starts with the Default host's settings. Change its settings afterwards on its own page.

A named host never becomes the Default host. The host is fixed at create: to move a connection to another shared host, delete it, then create a new connection there.

An imported Shared connection always goes to the Default host, and the import result says so.

What the form shows¶

A Shared connection shows only its own section (Databricks or Azure) and the Custom Properties sections. There is no Kubernetes Configs card. The settings every connection on a host uses together are on the shared host:

1. Open the runtime plane and select the System Applications tab. On a Trust3 AI Cloud runtime plane this tab appears once the plane has its first shared host.
2. Open the connection's shared host — ai-assets-collector for the Default host. From a connection's row on the Collectors tab, View status takes you there.
3. Set General (scanner interval), Monitoring (trace classification) and the pod's Kubernetes settings. Saving restarts that host's pod only.

A Dedicated Databricks or Microsoft connection shows the full form for its own pod — General, Monitoring and the Kubernetes settings.

Neither shows Custom Agents or Trace Ingester: those run only on a Custom agents connection, or on a Legacy collector.

What cannot change after create¶

• Deployment Mode
• Shared host
• Databricks host (Databricks) or Azure tenant ID (Microsoft). This is the connection's identity; to scan another workspace or tenant, add a new connection.
• The connection's type — the tile it was created from. An Azure AI Foundry connection cannot become an Azure M365 one; add a connection of the other type and delete the old one.

These fields show as disabled when you edit a connection.

Pause, delete and restart¶

Pause a Shared connection with its row's Enable/Disable toggle. A Shared connection has no pod of its own, so it has no stop or restart. Switched off, the shared host skips the connection on every scan and shows it as disabled; the assets it already found stay as they are. Switch it back on to resume. A paused connection still holds its workspace or tenant services, so a second connection to them is still refused.

Delete a Shared connection with the connection card's delete icon. The shared host stops scanning it straight away, and the connection's assets are marked inactive after 24 hours.

A Dedicated connection stops, starts and deletes like a standalone collector: its own pod stops, starts or is removed.

Delete a shared host from System Applications once it runs no connections. While it still runs some, the delete is refused with "This shared host still runs N connections". A shared host with no connections keeps running, and using resources, until you delete it.

When one connection fails¶

One bad connection does not stop the others. If a connection cannot start — for example, its credential is missing — the shared host leaves it out, logs an error naming it, and keeps scanning the rest. It tries that connection again on its next cycle, so fixing its settings is enough; no restart is needed.

Custom agents connections¶

A Custom agents connection is a collector of its own for agents you build yourself. It reads the agents' Langfuse / OTLP traces from S3, and can run the trace ingester that receives them.

• Always Dedicated. It runs in its own pod, never on a shared host.
• No workspace or tenant. It scans no Databricks workspace or Microsoft tenant. Add a Databricks or Microsoft connection for those.
• Add as many as you need. With the default prefixes, each one writes and reads its own traces, under trust3/agent/traces/tenant=<tenant>/plane=<plane>/app=<application ID>.

Setup, the S3 prefix rules, and the endpoint hostname are on Collect Traces (OTLP).

Existing collectors are unchanged¶

A collector created from the AI Assets Collector (Legacy) tile — including every collector created before connections existed:

• keeps its own pod and its full form, Custom Agents and Trace Ingester included;
• keeps writing ingested traces under trust3/agent/traces/tenant=<tenant>/plane=<plane> when its prefix is blank;
• is never moved onto a shared host;
• can still edit Databricks host and Azure tenant ID;
• still covers Foundry, Copilot Studio and M365 together.

Nothing is migrated. A collector created before 9.2.45.3 also keeps its application name, which ends in -aias.

Move a workspace into a connection¶

1. Add the connection for the workspace or tenant service.
2. Remove that workspace (or tenant) from the old collector, or delete the old collector.

Limits¶

A connection can't be named ai-assets-collector: that is the Default shared host's name.

Secrets saved through the API¶

On a runtime plane that encrypts its secrets, the portal encrypts a token or client secret before saving it. A Shared connection saved through the API with a secret that is not encrypted for this runtime plane is refused with "These secrets are not encrypted with this runtime plane's key".

• In the portal: enter the secret again.
• Through the API: encrypt each secret with the runtime plane's active key and send the encrypted value, as described in Saved Credentials API.

If such a connection is already saved, the shared host leaves it out, and after 24 hours its assets show as inactive. Saving the secret encrypted brings it back.

Messages you may see¶

Next steps¶