SSO and SCIM

Identity integration does two jobs in PromptGlass. SSO (OIDC or SAML 2.0) signs administrators and analysts into the console. SCIM 2.0 provisions the whole workforce directory, with users, groups, departments, managers and cost centers. Sensors use that directory to attribute every AI interaction to a person and roll usage up by team.

Supported providers

Provider	SSO	SCIM	Notes
Microsoft Entra ID	OIDC, SAML	✓	Gallery app or custom enterprise app
Okta	OIDC, SAML	✓	OIN app
Google Workspace	SAML	Directory API sync	Uses a service account instead of SCIM
Ping Identity, OneLogin, JumpCloud	SAML	✓	Generic SCIM 2.0
Keycloak / ADFS (self-hosted)	OIDC, SAML	LDAP sync	For air-gapped deployments

Attribute mapping

PromptGlass attribute	SCIM attribute (default)	Used for
`email`, `upn`	`userName`, `emails[primary]`	Matching sensor identities
`department`	`urn:ietf:params:scim:schemas:extension:enterprise:2.0:User:department`	Team rollups
`costCenter`	`…enterprise:2.0:User:costCenter`	Showback
`manager`	`…enterprise:2.0:User:manager`	Hierarchy views
`location`	`addresses[work].country`	Regional policies, residency
`employeeType`	`userType`	Contractors vs employees

Override mappings under Settings → Identity → Attributes.

Entra ID (OIDC + SCIM)

Enterprise applications → New application → PromptGlass (or create a non-gallery app).
Single sign-on: OIDC redirect https://<tenant>/auth/callback. Optionally add a groups claim.
Provisioning: mode Automatic, tenant URL https://<tenant>/scim/v2, secret token from PromptGlass.
Assign All users (or a pilot group) for provisioning, and assign only admins for console sign-in.

Matching sensor identities

Each sensor reports identities differently. PromptGlass resolves them all to one person:

Sensor	Identity signal
Browser extension	Managed browser profile (Entra/Google)
Gateway	Extension header, Kerberos/NTLM, SWG header, device cert, IP map
Endpoint agent	Logged-in OS user + device primary user (Intune/Jamf)
Connectors	Vendor user ID/email, GitHub SAML identity, IAM principal mapping

Identities that can’t be resolved appear as unknown with the raw signal, so you can add aliases.

Console roles from groups

roleMappings:
  - group: "SG-PromptGlass-Admins"       role: admin
  - group: "SG-Security-Investigations"  role: investigator
  - group: "SG-Privacy-Office"           role: privacy.reidentify.approve
  - group: "SG-AI-CoE"                   role: analytics.individual
  - group: "All-Managers"                role: viewer