Identity · Identity + SCIM

Fit AI Gateway HQ into an existing Microsoft Entra identity boundary.

Owner-managed OIDC or SAML 2.0 sign-in, exact Entra group-to-built-in-role rules, and connection-bound SCIM 2.0 user/group lifecycle with optional active-user login enforcement; live Entra conformance and workload federation remain planned.

Start in a test environment Read current API behavior

How the connection works

Provider access stays separate from application control.

Keep the customer identity provider authoritative

The organization owner selects OIDC or SAML for human sign-in and maps exact external groups to the gateway's built-in roles. The mapping is connection-bound rather than inferred from a display name or email domain.

Separate sign-in from lifecycle control

SCIM user and group provisioning is enabled independently with a connection-specific bearer. Provisioning records are tenant-scoped and version-bound so a stale or different federation connection cannot mutate the directory.

Label the remaining gate

The protocol implementation exists, but live Microsoft Entra conformance and workload identity federation have not been completed. The public status does not represent those planned checks as a certified or marketplace-listed integration.

Current shared controls

Status determines what can be configured.

Write-only, encrypted BYOK for implemented provider connections Stable model aliases and protocol-eligible route targets Organization and key budgets, RPM, TPM, and concurrency hard limits Observe, Shadow, Enforce, reason codes, and metadata-only evidence

Beta connections require customer validation against the exact model, payload, streaming mode, region, and provider account before production use.

Client boundary

AIGHQ_BASE_URL=https://api.aigatewayhq.com/v1
AIGHQ_API_KEY=from-your-workspace
AIGHQ_MODEL=company-approved-fast

Applications keep a stable gateway URL and model alias while an administrator changes eligible provider accounts and models.

Implemented boundary

Only documented protocols become eligible.

An organization owner creates the federation connection, validates the issuer or signed SAML metadata, maps exact Entra groups to built-in roles, and separately enables the connection-bound SCIM bearer. Live Entra conformance and workload federation remain planned gates.

OIDC or SAML 2.0 sign-in SCIM 2.0 Users and Groups Exact group-to-built-in-role rules

Compatibility is bounded to the provider's current published interface. Review the provider documentation before approving a production model.