> ## Documentation Index > Fetch the complete documentation index at: https://docs.cobalt.peoplereign.io/llms.txt > Use this file to discover all available pages before exploring further. # Integrations overview > Connect an agent to your external systems — the primary way to grant capabilities. # Integrations overview An **Integration** connects an agent to an external system — your service desk, HRIS, identity provider, file store, or collaboration tool — and turns that system's capabilities into tools the agent can use. Integrations are the **primary** way an agent gets the ability to find information and take action. Reach for one before authoring a [Skillset](/build-agent/skillsets-and-skills). Each integration is built and maintained by Cobalt, with guardrails and audit logging built in. ## Two kinds of capability Integrations provide two kinds of tools, and they're authorized differently: * **Reads (on behalf of the user).** Search and lookup tools that run as the asking user. Each end user authorizes once, and the agent only ever sees what that user can already see. No administrator credential is required beyond enabling the integration. * **Privileged actions (granted by an administrator).** Tools that act for the organization — reset a password, add a user to a group, change a record. These require an administrator to grant access once, run under policy, and write an audit entry on every call. Until they're authorized, these tools wait in an "awaiting authorization" state while the read tools work normally. ## Adding an integration For the verified integrations, adding one is a guided **three-step wizard**: Pick which parts of the system to enable (for example, mail and calendar but not files) and fine-tune individual tools. Reads start on; every write starts off until you enable it. Review the access requested and authorize. Reads use per-user authorization (each end user signs in for themselves the first time the agent acts for them); privileged actions use one of the administrator methods below, with a setup guide for the credentials the vendor needs. Name the integration and choose whether it's active immediately. Other integrations use a single configuration form with the same capability-and-authorization choices. Either way, after setup you can run the built-in connection test, and for systems that hold documents — a knowledge base, a file store, a wiki — choose which spaces, sites, or folders to index so the agent can search and cite them. ## Administrator authorization methods Privileged actions use whichever method a given system supports. All credentials are encrypted at rest and never shown back in the console. | Method | How it works | Typical systems | | ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------- | | **Admin authorization** | One-click grant — you're sent to the vendor to approve, and Cobalt stores the resulting token. | Slack, Okta, Zendesk, ServiceNow, Atlassian | | **Service-account key** | Upload a service-account key file and name the account to act as. | Google Workspace | | **Credential form** | Enter the vendor's connection fields (for example a directory ID, client ID, and secret). | Microsoft 365, Workday | | **Designated principals** | No shared credential — you designate specific managers or admins, each signs in once, and privileged actions run as the appropriate designated person (for example, the requester's manager). | Workforce-management and HR approvals | ## What's available Cobalt includes integrations across the systems an IT or HR agent typically needs, including: * **Productivity & collaboration** — Google Workspace, Microsoft 365, Outlook, SharePoint / OneDrive, Slack, Microsoft Teams, Notion, Asana, Box, Dropbox. * **IT service management** — ServiceNow, Zendesk, Freshservice, Freshdesk, HappyFox, BMC Remedy, Atlassian (Jira, Confluence, Jira Service Management). * **Identity & security** — Okta, Microsoft Entra, SailPoint, Ping Identity, Duo Security, Adobe Admin Console. * **HR, HRIS & payroll** — Workday, UKG Pro, UKG Workforce Management, Gusto, Rippling, Dayforce. * **CRM & finance** — Salesforce, Freshworks CRM, Coupa. * **Intranet** — Unily, LumApps. For the full list — every integration, its maturity, and what it does — see the [Integration catalog](/integrations/catalog). The catalog in your console is the live source of truth for what's available and which capabilities each integration supports. ## Generally available vs. experimental Each integration in the catalog carries a **maturity** badge: * **Generally available (GA)** — verified end-to-end and ready to rely on. * **Experimental** — usable, but not yet verified against a live vendor instance. Activating one shows an **Experimental** badge and asks you to acknowledge that status before it goes live. Try these in [Preview](/get-started/create-your-first-agent) before putting them in front of employees. The GA integrations have a detailed setup guide here in the docs: Work incidents, requests, knowledge, and the catalog as each person. Tickets, knowledge, and governed admin actions over one API key. Tickets and knowledge over one API key, scoped to each person by Cobalt. Gmail, Drive, Docs, Sheets, Calendar — plus admin actions. Each person's own mail, calendar, contacts, and tasks. Search, message, and meet in Teams on each person's behalf. Search and read sites and files; upload and share. Search Slack, manage channels, and run governed admin actions. Confluence, Jira, and Jira Service Management. Connect any MCP-compliant server you host or trust. ## A flagship example See [Google Workspace](/integrations/google-workspace) for an end-to-end setup — read access in about a minute, plus the steps to enable privileged admin actions. See [Microsoft Teams](/integrations/microsoft-teams) for a worked example of an agent acting inside a workspace tool on each person's behalf — searching, messaging, and creating meetings as the user — and how that differs from hosting the conversation in the [Teams channel](/channels/teams). For an ITSM example with per-person and organization modes, see [Freshservice](/integrations/freshservice). [Freshdesk](/integrations/freshdesk) is the same shape, and is worth reading if you want to understand what happens when a vendor offers no per-person sign-in at all: the API key is organization-wide, so Cobalt itself enforces the per-person boundary and refuses rather than guessing when it can't identify someone.