Microsoft Entra ID + Arbitex Gateway
SAML 2.0 SSO with Entra ID group claim pass-through, SCIM 2.0 automated user sync, and policy engine integration with Conditional Access — govern AI access from inside your Microsoft identity layer.
Three steps to Entra ID-governed AI access
Add Arbitex as an Enterprise Application in Microsoft Entra ID using your existing SAML 2.0 and SCIM provisioning toolchain. No custom middleware or separate credential stores required.
Add Arbitex as an Enterprise Application in Entra ID
In the Microsoft Entra admin center, create a new non-gallery Enterprise Application for Arbitex Gateway. Configure the application with the Entity ID and Reply URL (ACS URL) provided in Arbitex Cloud settings. Arbitex registers as a SAML 2.0 Service Provider and supports Single Sign-On with Single Logout.
- ACS URL and Entity ID available in Settings → Identity → SAML 2.0 in Arbitex Cloud
- Assign users and groups from Entra ID to the application to control who can authenticate
- Download the Federation Metadata XML from Entra ID and upload it to Arbitex Cloud to complete the SP configuration
Configure SAML 2.0 SSO with Group Claim Pass-Through
In the Enterprise Application SAML configuration, add a Group Claims attribute to include group membership in the SAML assertion. Arbitex Gateway reads the groups claim at login and resolves it against your configured group-to-role mappings — users receive the correct RBAC role automatically without any per-user setup.
- Configure group claims to emit Group ID or sAMAccountName depending on your directory type
- Arbitex supports both ObjectID-based and display name-based group claims
- Map Entra ID Security Groups to Arbitex RBAC roles: Admin, Analyst, Viewer
Enable SCIM 2.0 Provisioning for Automated User Sync
Enable automatic provisioning in the Entra ID Enterprise Application to activate SCIM 2.0 user lifecycle management. Provisioning handles user creation, attribute updates, and deprovisioning — when a user is removed from the application assignment or disabled in Entra ID, access to Arbitex is revoked automatically.
- SCIM tenant URL and secret token available in Settings → Identity → SCIM 2.0
- Supports Create, Update, and Deactivate operations on users and groups
- Group push syncs Entra ID Security Group membership to Arbitex RBAC (subject to Entra ID provisioning cycle frequency)
Azure-native security, extended to AI governance
Entra ID Conditional Access policies apply at the identity layer before a user reaches Arbitex. Pairing Conditional Access with Arbitex policy enforcement creates a two-layer control: Entra ID governs who can authenticate; Arbitex governs what they can do with AI models. Together, the combination is designed to align with SOC 2, HIPAA, and zero-trust access requirements.
- SOC 2 (designed for) — Entra ID SSO + Arbitex access controls designed to satisfy CC6.1 and CC6.2 logical access requirements; every authentication and provisioning event is captured in the Arbitex audit log
- HIPAA alignment — workforce authentication controls enforced at the gateway; automatic deprovisioning via SCIM 2.0 reduces PHI access risk from terminated or transferred employees
- Entra ID Conditional Access integration — Conditional Access policies (device compliance, location, MFA) are evaluated by Entra ID before token issuance; Arbitex Gateway enforces policy on every request after authentication
Ready to configure?
The full Entra ID integration guide covers Enterprise Application setup, Federation Metadata XML import, group claims configuration, SCIM provisioning, and Conditional Access alignment.
Microsoft identity, enforced at every AI request.
Connect Entra ID to Arbitex Gateway using your existing Enterprise Application toolchain. SAML 2.0 SSO and SCIM 2.0 provisioning are available on all plans.