F5 SurePath AI is a network-level governance platform for Generative AI adoption across an organization. This guide walks IT admins and stakeholders through the configuration steps required to deploy a SurePath AI tenant, from initial setup through telemetry offload and private portal enablement.

Organizations can begin with basic monitoring to understand GenAI usage patterns, then implement more controls and private AI capabilities as their governance strategy matures. This lets organizations make data-driven policy decisions instead of implementing restrictions without visibility into actual usage.

Each section below is marked Required, Recommended, or Optional to help admins prioritize configuration tasks based on the organization's needs and timeline.

The initial configuration establishes the foundation of a SurePath AI deployment: the admin framework, user identity and authentication, and the network integration required to intercept and govern GenAI traffic.

Admin users are the foundation of a SurePath AI tenant configuration. Unlike end users, who are imported through Directory Synchronization, admin users must be added manually and are assigned specific admin roles (Owner, Admin, or Auditor) that control their level of access to the platform.

Admins first access their SurePath AI tenant using Magic Link authentication. As an initial Owner, the first task is to add any additional admin users the organization requires, based on who needs access to configure policies, review user activity, or audit the platform.

Learn more:Configuring Admin Users

Single Sign-On (SSO) integration lets end users authenticate to SurePath AI using the organization's existing identity provider. This centralizes identity management and ensures user activity is attributed to specific individuals in audit logs and analytics.

SurePath AI supports both OIDC (OpenID Connect) and SAML 2.0 and works with identity providers including Microsoft Entra ID, Okta, Auth0, PingIdentity, OneLogin, WorkOS, and Rippling. SSO is recommended because it enables automatic user authentication when traffic is intercepted. Without SSO, users authenticate with the Magic Link method instead.

Learn more:Configure SSO for Any Provider

Directory Synchronization uses the SCIM (System for Cross-domain Identity Management) protocol to import user and group information from directory services into SurePath AI. This enables group-based policy enforcement and keeps the SurePath AI configuration synchronized with the organizational structure.

Admins can create and manage groups manually, but directory synchronization is recommended because it maintains user and group membership automatically as the organization changes. When employees join, leave, or change roles, SurePath AI reflects those changes without manual intervention. Directory sync also lets admins use existing security groups for policy enforcement — for example, an "Engineering" group from the directory can grant engineering-specific GenAI access through a Group Policy in SurePath AI.

Learn more:Configure Directory Sync for All Vendors

Network integration is the mechanism that lets SurePath AI intercept, inspect, and govern traffic to public GenAI services. Without it, SurePath AI cannot apply policies to public services like ChatGPT, Claude, or Gemini. Network integration is not required to access the SurePath AI admin interface (admin.surepath.ai) or the private portal (portal.surepath.ai) — these are always directly accessible.

There are two primary approaches to network integration: SASE (Secure Access Service Edge) and Proxy PAC (Proxy Auto-Configuration). SASE integration is the preferred method and uses vendor-specific forward proxy chaining (often called "forward-to-proxy") to direct only GenAI traffic to SurePath AI, leaving other web traffic on its normal path. Organizations without a SASE deployment can use Proxy PAC, which uses Mobile Device Management (MDM) platforms to distribute a PAC file URL to endpoints. Both methods steer only GenAI traffic to SurePath AI for inspection and policy enforcement.

Learn more:Network Integration

After the initial configuration steps above, the SurePath AI tenant is configured to monitor and log all GenAI traffic by default. This prioritizes visibility and data collection before policy enforcement.

By default, the Default Public Service Action is set to Allow - Monitor. Workforce interactions with public GenAI services proceed normally, but every interaction is intercepted, recorded, and analyzed by SurePath AI. Users see no disruption or blocking — they continue using ChatGPT, Claude, Gemini, and other GenAI tools as before. SurePath AI captures a complete audit trail of GenAI usage, including which services are accessed, what prompts are sent, what responses are returned, and whether sensitive data or risky content is detected.

Most organizations lack visibility into how their workforce actually uses GenAI. Without data, it is difficult to decide which services to allow, which to restrict, and what sensitive data controls are needed. Enforcing policy without understanding actual usage patterns often leads to policies that are either too restrictive, hampering productivity, or too permissive, failing to mitigate risk.

During this initial phase, admins should review the User Activity logs, analytics dashboards, and violation reports to understand:

This data lets admins move from monitoring-only to active policy enforcement once they have enough evidence to create balanced policies. There is no prescribed timeline; some organizations transition after a week of data collection, others after a month or more.

To begin enforcing policy, admins modify the Default Public Service Action in the Default Policy settings and implement the Public Service Policy controls described later in this guide.

Once network integration is in place and GenAI traffic is intercepted, SurePath AI captures and analyzes workforce interactions with GenAI services. This gives admins two capabilities: User Activity for event-level investigation, and Insights for dashboard-based analytics.

User Activity centralizes up to 30 days of governed GenAI events and lets admins review who used which services, when, and for what purpose. Each event includes user identity, risk level, policy outcome, intent classification, and full conversation history (when available). Admins can filter and search events, investigate specific requests, and export CSV files for offline analysis. This visibility supports investigating policy violations, conducting security audits, and understanding how specific users or teams use GenAI.

Insights turns raw event data into dashboards covering Public Services, Risk, Adoption, and Private Portal usage. These dashboards help admins quantify sensitive data exposure, track adoption trends across departments, identify shadow AI usage, and evaluate licensing costs. Insights supports filtering with unlimited look-back, drill-through to underlying transactions, and automated PDF exports or email subscriptions.

During the initial monitoring phase, User Activity and Insights show baseline GenAI usage patterns before policy enforcement begins. Once enforcement is active, they provide ongoing visibility into policy effectiveness, emerging risks, and adoption trends. Most organizations use User Activity for tactical investigations and compliance auditing, and Insights to report usage trends to business leaders.

Learn more:

Telemetry Offload exports SurePath AI user activity logs to a customer-managed AWS S3 bucket for long-term retention, SIEM integration, compliance archiving, and analytics. By default, SurePath AI retains user activity logs within the platform; Telemetry Offload centralizes that data in the organization's own systems for regulatory compliance, cross-system correlation, and specialized reporting.

Telemetry Offload files upload to the S3 bucket every 15 minutes in structured JSON format. To enable this feature, admins configure an AWS Connector (the same connector used for Private Models, or a separate dedicated connector) and specify a Telemetry Destination identifying the S3 bucket location.

Learn more:Telemetry Schema and Format

Once admins have gathered data from the initial monitoring phase, creating a public service policy is the next step in GenAI governance. A Public Service Policy defines which public GenAI services the workforce can access, what content controls apply, and how sensitive data is protected.

Public Service Policies use a least-privilege model: a Default Policy applies to all users, and optional Group Policies grant additional access to specific user populations. The policy framework has three components: Service Access Control (using the Public Service Catalog), Content Controls (High-risk Request, Confidential Data, Programming Language, Harmful Content, and Prompt Injection), and Sensitive Data PII Detection for personally identifiable information.

Most organizations start with less restrictive actions like Monitor or Warn to build understanding and coach users, then move to stronger enforcement as governance maturity increases.

Learn more:

The SurePath AI Private Portal provides a unified interface where the workforce accesses private AI models that run in the organization's own cloud environment, governed by the same policy framework that controls public services. The distinction between private and public AI is data residency and control: when users interact with private models through the portal, their prompts and model responses stay entirely within the organization's cloud environment. The organization controls the infrastructure, pays the cloud provider directly for inference costs, and retains ownership of all data.

The Private Portal is always directly accessible at portal.surepath.ai and does not require network integration or traffic interception. Access to portal resources (private models, data sources, and assistants) is controlled through the same Default Policy and Group Policy framework used for public services.

Private models are GenAI foundation models that organizations operate in their own cloud environment (AWS, Azure, or Google Cloud) and make available to the workforce through policy. To enable private models, admins first create a connector that establishes authentication and authorization for SurePath AI to communicate with the cloud AI services. SurePath AI supports AWS (Bedrock) using an assumed role approach, and Azure OpenAI and Google Gemini using API key-based authentication.

Configuration involves enabling the foundation model in the cloud environment, creating a connector in SurePath AI, and adding the specific private model to make available. Admins then control which users or groups have access to specific private models through the Default Policy and Group Policies, the same way they control access to public services.

The Private Portal also supports Data Sources (private knowledge bases that provide proprietary context to model responses) and Assistants (pre-configured AI helpers with specialized prompts and data access). Both are governed through the same policy framework, letting admins use Group Policies to grant specific users or groups access to targeted resources based on their role, department, or use case.

Admins use the Default Policy and Group Policies to control Private Portal resources the same way they control access to public GenAI services. For example, admins might enable a general-purpose private model in the Default Policy for all users, then use Group Policies to grant engineering teams access to an engineering-specific data source, or give customer support teams access to a support-focused assistant.

Model inference charges for private models apply directly to the organization's cloud provider account (AWS, Azure, or Google Cloud), not to SurePath AI. Organizations should monitor cloud usage and costs as they roll out private model access.

Learn more:

After completing the configuration steps in this guide, the SurePath AI deployment is operational with a foundation for GenAI governance. Admins should consider these additional areas: