---
title: Pre-migration
slug: pre-migration
docTags: 
createdAt: 2026-09-02T11:16:01.444Z
---

Before migrating to Bridge Automation Service (BAS), complete the required setup and access configuration tasks described in this section.

## Prerequisites

Before using BAS, ensure that:

- The account is onboarded to the appropriate Kyndryl Bridge, and BAS is enabled. For more information, go to [Onboarding and enabling Bridge Automation](docId:1ipTNb5rxza-2rCOlW-U5).
- A user with the **Bridge Platform Administrator** role completes the prerequisite configuration tasks.
  - Verify that the required automation access groups are available in Bridge IAM. The access groups typically begin with **automation**. Common access groups include:
    - **automation\_admin** or **automation\_administrator**
    - **automation\_editor**
    - **automation\_operator**
    - **automation\_viewer**

## Create dedicated CACF credentials

To allow BAS to access the CACF, create dedicated credentials for each organization or account.

1. Follow the IAM process to obtain a Functional ID for BAS access to CACF. This task is typically performed by the Delivery Program Executive (DPE). For more information, go to [Identity Management at Kyndryl](https://kyndryl.sharepoint.com/sites/IdentityandAccessManagement/SitePages/Identity%20Management.aspx#how-to-create-a-functional-or-application-id-1).
2. Sign in to Ansible Automation Platform (AAP) using the Functional ID. This step creates the AAP user profile associated with this ID.
3. The Tower Account/Organization Administrator grants the required permissions to the AAP user profile.
4. A Tenant Automation Administrator (TAA) can generate a token in AAP. BAS uses this token as the FID token to connect to AAP for a specific organization.

:::hint{type="info"}
For assistance with creating a Functional ID or completing CACF-related tasks, contact the CACF team. For more information, go to, [Automation Services Onboarding and Enablement](https://kyndryl.sharepoint.com/sites/CTO-Automation/SitePages/Automation-Services-Enablement.aspx?TeamsCID=745d84aa-a321-42a6-8d5d-9ee941928136#aap-communication-with-aiops-automation-services).
:::

## Onboard a dedicated CACF connection as a Bridge credential

:::hint{type="info"}
A user must have the **Bridge Platform Administrator** role to create connections in Bridge. 
:::

1. From the main menu :inlineImage[]{src="https://api.archbee.com/api/optimize/QU1TIK52ntw5Jsos0uOt5/NK7Yw9tQgnlqBGwu7eG4H-20260601-205917.svg" alt caption width="57" height="57"}, go to **Administration** → **Connections Management.**
2. Select **Tool Connections**, and then select **Add Connection**.
3. Configure the connection:
   1. Set Connection type to CACF.
   2. Under Supported apps, select Provisioning Orchestration and Automation.
   3. Enter a connection name using the following format:

:::Paragraph{indent="3"}
\<GSMA\_CODE>@CACF\_INSTANCE
:::

:::Paragraph{indent="3"}
**Example:** ace\@devtest4
:::

4. Enter a description to identify the target environment (Optional).
5. Click **Next**.
6. Enter the endpoint URL and GSMA organization information.

:::hint{type="info" indent="1"}
Enter the endpoint URL and GSMA organization information.
:::

7. Click **Next**.
8. Enter the authorization token. For more information, go to **Create dedicated credentials for CACF**.
9. Click **Next**.
10. Review the configuration details and click **Submit**.

## Enable automation admin access group with admin role

1. From the main menu :inlineImage[]{src="https://api.archbee.com/api/optimize/QU1TIK52ntw5Jsos0uOt5/NK7Yw9tQgnlqBGwu7eG4H-20260601-205917.svg" alt caption width="57" height="57"}, go to **Access Management** → **Access Groups.**
2. Login as a user with the **Bridge Platform Administrator** role.
3. Edit the **automation\_admin** or **automation\_administrator** access group.
4. Assign the **Orchestration Administrator** role.
5. Save the changes.