> ## Documentation Index
> Fetch the complete documentation index at: https://bloodhound.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a Collector Client

> Learn how to create a BloodHound Enterprise collector client.

<img noZoom src="https://mintcdn.com/specterops/tTIczgde9H07oLXf/assets/enterprise-edition-pill-tag.svg?fit=max&auto=format&n=tTIczgde9H07oLXf&q=85&s=b682a26b342bde12302ec829e265bdb6" alt="Applies to BloodHound Enterprise only" width="225" height="45" data-path="assets/enterprise-edition-pill-tag.svg" />

## Purpose

This guide explains how to create a BloodHound Enterprise collector client. It is intended for Administrators who are deploying SharpHound Enterprise or AzureHound Enterprise for data collection.

Collector clients connect your BloodHound Enterprise tenant to your collector applications. They provide the necessary authentication and configuration information for your SharpHound Enterprise or AzureHound Enterprise collector applications to securely upload collected data to your BloodHound Enterprise instance for processing and analysis.

BloodHound Enterprise supports two types of collector clients:

* **SharpHound Enterprise** - Collects data from Active Directory environments
* **AzureHound Enterprise** - Collects data from Entra ID environments

## Prerequisites

* A BloodHound Enterprise <Tooltip headline="tenant" tip="A dedicated instance of BloodHound that contains its own data, configurations, and user access controls.">tenant</Tooltip>
* Logged in as a user assigned a [role](/manage-bloodhound/auth/users-and-roles) authorized to create a collector client

<Note>See [SharpHound Enterprise System Requirements](/install-data-collector/install-sharphound/system-requirements) or [AzureHound Enterprise System Requirements](/install-data-collector/install-azurehound/system-requirements) for more information on the requirements for each collector type.</Note>

## Process

This guide covers the required steps to create a collector client in your BloodHound Enterprise tenant.

Optional configuration settings are also explained, but can be skipped during initial setup and configured later if necessary.

### AzureHound Enterprise

AzureHound collector clients use API token-based authentication. When creating an AzureHound collector client, you must save the generated token information and use it to [configure](/install-data-collector/install-azurehound/create-configuration) the AzureHound collector application.

<Steps>
  <Step title="Open the Manage Clients page">
    In the left menu, click **Administration** > **Manage Clients**.
  </Step>

  <Step title="Create the client">
    1. On the right side of the page, click **Create Client**.

    2. Select **Create AzureHound Client** from the dropdown menu.

    3. Complete the required fields:

       | Field                   | Required | Description                                                                                                                   |
       | ----------------------- | -------- | ----------------------------------------------------------------------------------------------------------------------------- |
       | **Client Name**         | Yes      | A descriptive name for the collector client (e.g., the name of the domain it collects from or system it runs on)              |
       | **Collection Schedule** | No       | Optional configuration options for [scheduling](/collect-data/enterprise-collection/collection-schedule) data collection jobs |

           <Frame>
             <img src="https://mintcdn.com/specterops/NuvEx5RAlEpXt0Eq/images/data_collectors/create-azurehound.png?fit=max&auto=format&n=NuvEx5RAlEpXt0Eq&q=85&s=84f535237560e469a0ffae880c5c215e" alt="A view of the Create Client screen for AzureHound Enterprise" width="1184" height="680" data-path="images/data_collectors/create-azurehound.png" />
           </Frame>

    4. Click **Create**.
  </Step>

  <Step title="Save the client token">
    A *Client Token Info* window will appear with authentication credentials. Copy and save the token information before closing.

    <Note>The token information is required to [configure](/install-data-collector/install-azurehound/create-configuration) the AzureHound collector application.</Note>

    <Frame>
      <img src="https://mintcdn.com/specterops/NuvEx5RAlEpXt0Eq/images/data_collectors/azurehound-client-token-info.png?fit=max&auto=format&n=NuvEx5RAlEpXt0Eq&q=85&s=c4d1b7eda843a062097d8393b421a028" alt="A view of the client token info screen for AzureHound Enterprise" width="1184" height="846" data-path="images/data_collectors/azurehound-client-token-info.png" />
    </Frame>
  </Step>
</Steps>

### SharpHound Enterprise

SharpHound Enterprise collector clients support both API token-based authentication and Integrated Windows Authentication (IWA) via Active Directory Federation Services (ADFS).

When creating a SharpHound Enterprise collector client, you must select the authentication method and provide the required information based on that method. Be sure to save the generated token or configuration information and use it to [configure](/install-data-collector/install-sharphound/local-configuration) the SharpHound Enterprise collector application.

<Steps>
  <Step title="Open the Manage Clients page">
    In the left menu, click **Administration** > **Manage Clients**.
  </Step>

  <Step title="Create the client">
    1. On the right side of the page, click **Create Client**.

    2. Select **Create SharpHound Enterprise Client** from the dropdown menu.

    3. Complete the required fields:

       | Field                       | Required                    | Description                                                                                                                                                                                                                                                                                                            |
       | --------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
       | **Client Name**             | Yes                         | A descriptive name for the collector client (e.g., the name of the domain it collects from or system it runs on)                                                                                                                                                                                                       |
       | **Collection Schedule**     | No                          | Optional configuration options for [scheduling](/collect-data/enterprise-collection/collection-schedule) data collection jobs                                                                                                                                                                                          |
       | **Advanced Options**        | No                          | Optional domain controller targeting<br /><br />By default, SharpHound Enterprise will collect data from the Primary Domain Controller as configured by FSMO roles<br /><br />Specifying a target will prevent cross-trust collection from working unless the targeted LDAP server can respond for all desired domains |
       | **Authentication**          | Yes                         | Authentication method the client will use:<br /><ul><li>**BHE Authentication**: Traditional API token-based authentication (default)</li><li>**Integrated Windows Authentication**: Windows-based authentication via ADFS</li></ul>                                                                                    |
       | **Issuer ID**               | Yes<br /><br />(*IWA only*) | The ADFS well-known endpoint URL, typically: `https://adfs.example.com/.well-known/openid-configuration`                                                                                                                                                                                                               |
       | **Issuer Address Override** | No<br /><br />(*IWA only*)  | An optional override for the token issuer address if your ADFS configuration uses a different issuer URL for token validation                                                                                                                                                                                          |

           <Tabs>
             <Tab title="BHE Authentication">
               The following screenshot shows the client creation form when **BHE Authentication** is selected.

               <Frame>
                 <img src="https://mintcdn.com/specterops/D55xoeIL2FwCP-YZ/images/data_collectors/create-sharphound-bhe-auth.png?fit=max&auto=format&n=D55xoeIL2FwCP-YZ&q=85&s=781dd46f73c8865b3c84e35e397efcdf" alt="A view of the Create Client screen for SharpHound Enterprise" width="1196" height="1368" data-path="images/data_collectors/create-sharphound-bhe-auth.png" />
               </Frame>
             </Tab>

             <Tab title="Integrated Windows Authentication">
               The following screenshot shows the client creation form when **Integrated Windows Authentication** is selected. Note the additional required **Issuer ID** field and optional **Issuer Address Override**.

               <Frame>
                 <img src="https://mintcdn.com/specterops/D55xoeIL2FwCP-YZ/images/data_collectors/create-sharphound-iwa-auth.png?fit=max&auto=format&n=D55xoeIL2FwCP-YZ&q=85&s=965c73cdc079153103f6df1eacfbfd35" alt="A view of the Create Client screen for SharpHound Enterprise IWA" width="1196" height="1516" data-path="images/data_collectors/create-sharphound-iwa-auth.png" />
               </Frame>
             </Tab>
           </Tabs>

    4. Click **Create**.
  </Step>

  <Step title="Save the client token or configuration">
    A pop-up window will appear and display the client token (for BHE Authentication) or client ID information (for Integrated Windows Authentication). Follow the instructions in it before clicking **Close**.

    <Note>
      **Switching Authentication Methods**

      If you are switching an existing SharpHound Enterprise collector client to a different authentication method, this step replaces the current credentials.

      * Switching to **Integrated Windows Authentication** invalidates existing API tokens and requires you to update the `settings.json` file and remove the `auth.json` file.
      * Switching to **BHE Authentication** generates a new token and requires you to update the `auth.json` file and disable IWA in the `settings.json` file.
    </Note>

    <Tabs>
      <Tab title="BHE Authentication">
        A *Client Token Info* window will appear with authentication credentials. Copy and save the token information before closing.

        <Note>The token information is required to [configure](/install-data-collector/install-sharphound/local-configuration#auth-json) the SharpHound Enterprise collector application in the `auth.json` file.</Note>

        <Frame>
          <img src="https://mintcdn.com/specterops/D55xoeIL2FwCP-YZ/images/data_collectors/sharphound-client-token-info.png?fit=max&auto=format&n=D55xoeIL2FwCP-YZ&q=85&s=f0ac33f2a2cb70450b9be7ce7c9df81b" alt="A view of the client token info screen for SharpHound Enterprise" width="1352" height="706" data-path="images/data_collectors/sharphound-client-token-info.png" />
        </Frame>
      </Tab>

      <Tab title="Integrated Windows Authentication">
        A *Client Configuration Info* window will appear with the Client ID required to set up ADFS.

        <Note>The Client ID and configuration details are required to [configure ADFS](/install-data-collector/install-sharphound/configure-adfs-iwa) and to [configure](/install-data-collector/install-sharphound/local-configuration) the SharpHound Enterprise collector application in the `settings.json` file.</Note>

        <Frame>
          <img src="https://mintcdn.com/specterops/D55xoeIL2FwCP-YZ/images/data_collectors/sharphound-client-config-info.png?fit=max&auto=format&n=D55xoeIL2FwCP-YZ&q=85&s=6eae2f1765b14f1c786c289e2d4819bc" alt="A view of the client configuration info screen for SharpHound Enterprise IWA" width="1792" height="678" data-path="images/data_collectors/sharphound-client-config-info.png" />
        </Frame>
      </Tab>
    </Tabs>
  </Step>
</Steps>

## Outcome

BloodHound Enterprise displays collector clients in the table on the **Manage Clients** page with a **Status** of **Unconfigured**.

<Frame>
  <img src="https://mintcdn.com/specterops/NuvEx5RAlEpXt0Eq/images/data_collectors/create-collector-outcome.png?fit=max&auto=format&n=NuvEx5RAlEpXt0Eq&q=85&s=a5056613630c55bbf48e0614084b6558" alt="A view of the clients table showing a newly created AzureHound and SharpHound Enterprise collector clients with a status of Unconfigured" width="2254" height="646" data-path="images/data_collectors/create-collector-outcome.png" />
</Frame>

## Next Steps

* SharpHound Enterprise clients:
  * **BHE Authentication**: Use the token information to [configure](/install-data-collector/install-sharphound/local-configuration#auth-json) the SharpHound Enterprise collector application in the `auth.json` file.
  * **Integrated Windows Authentication**: Follow the [ADFS configuration guide](/install-data-collector/install-sharphound/configure-adfs-iwa) to set up ADFS, then [configure](/install-data-collector/install-sharphound/local-configuration#settings-json) the SharpHound Enterprise collector application in the `settings.json` file.

* AzureHound Enterprise clients:
  * Use the token information to [configure](/install-data-collector/install-azurehound/create-configuration) the AzureHound collector application.