Identity · Identity + SCIM

Use Microsoft Entra ID for staff access and provisioning.

Use Microsoft Entra ID for staff sign-in, exact group-to-role rules, and SCIM user and group provisioning.

Create a free workspace Read current API behavior

How the connection works

How Microsoft Entra ID works with the gateway

Keep Entra authoritative

An owner selects OIDC or SAML and maps exact Entra groups to built-in roles. The gateway does not infer access from a name or email domain.

Separate sign-in from provisioning

SCIM uses its own connection-specific credential. Tenant and version checks prevent a stale or unrelated connection from changing the directory.

Know what remains

The protocol path exists. Live Entra conformance, workload federation, and a marketplace listing are not complete.

Current shared controls

What every supported connection includes

Encrypted BYOK credentials that remain hidden after setup Stable model aliases and compatible route targets Organization and key budgets, rate limits, and concurrency limits Observe, Shadow, and Enforce modes with metadata-only evidence

Test sign-in, group changes, deprovisioning, and tenant isolation with the customer's Entra configuration before production use.

Client boundary

AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Entra manages staff identity and lifecycle. It does not store provider keys, route model requests, or grant access from an email-domain match.

Implemented boundary

Supported protocols

An owner adds the OIDC issuer or signed SAML metadata, maps exact Entra groups to built-in roles, and enables SCIM separately. Live Entra conformance and workload federation remain planned checks.

OIDC or SAML 2.0 sign-in SCIM 2.0 Users and Groups Exact group-to-built-in-role rules

Compatibility follows the provider's current published interface. Review the provider documentation before approving Microsoft Entra ID for production.