> ## Documentation Index
> Fetch the complete documentation index at: https://docs.runlayer.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Discovery

> Find the AI agents your teams build in Microsoft and AWS, and list them in AI Inventory

Cloud Discovery reads the AI agents, skills, MCP servers and connectors your teams build in cloud platforms and lists them in **AI Inventory**, next to what AI Watch finds on devices. It's read-only: Runlayer never changes anything in the connected tenant or account.

> [!NOTE]
>
> Cloud Discovery is in early access. Ask your Runlayer team to turn it on for your workspace.

## What it discovers

| Source | What appears in AI Inventory |
| - | - |
| [Microsoft](https://docs.runlayer.com/cloud-discovery/microsoft.md) | Copilot Studio agents with their connectors, skills and custom MCP tools; Azure AI Foundry agents, tools and skills; Entra Agent ID agent identities and their owners |
| [AWS](https://docs.runlayer.com/cloud-discovery/aws.md) | Bedrock Agents; Bedrock AgentCore Runtimes, Harnesses (with their skills), and Gateways with their targets |

Skills that Cloud Discovery can read are scanned for risk the same way as skills AI Watch finds on devices.

## Connect a source

You need the **Manage org settings** permission in Runlayer.

1. Open **AI Inventory** and click **Sources**.
2. Pick Microsoft or AWS and follow the provider's steps.

Runlayer starts the first sync as soon as the connection is ready. After that, every connected source syncs about every six hours, and **Refresh** starts a sync right away. Large tenants and accounts can take several minutes to sync. Assets show up in AI Inventory as they load.

When a source stops returning an asset, the asset stays in AI Inventory with a **Stale** badge and its **Last seen** time, rather than being deleted.

## Disconnect a source

In **Sources**, open the connection's menu and click **Disconnect**. Runlayer deletes the credentials it stored for that tenant or account, stops syncing it, and removes its assets from AI Inventory. You can connect it again later.

Disconnect doesn't remove anything on the provider's side. To remove Runlayer's access there too, see [Remove the Runlayer app from your tenant](https://docs.runlayer.com/cloud-discovery/microsoft.md#remove-the-runlayer-app-from-your-tenant) or [Remove the discovery role](https://docs.runlayer.com/cloud-discovery/aws.md#remove-the-discovery-role).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.