Quickstart

This quickstart takes a new PromptGlass SaaS tenant to a working AI usage dashboard in about 15 minutes. You will connect single sign-on, roll the browser extension out to a pilot group, add one SaaS connector, and confirm events arrive. Nothing is blocked during the quickstart. Every policy starts in log mode.

Tip

Self-hosting instead? Follow Deploy on Kubernetes first, then come back here at step 2.

Before you start

• A PromptGlass tenant. Contact us for a trial and pick a region: US, EU or Canada.
• Admin rights in your identity provider (Entra ID, Okta or Google Workspace).
• Rights to push browser extensions with Intune, Jamf, Google Admin or Group Policy.
• A pilot group of 10 to 50 people. Tell them the pilot is running, because transparency is part of every good rollout. See employee privacy.

Steps

1. Sign in and connect SSO

   Open https://<tenant>.promptglass.ai, then go to Settings → Identity and add your identity provider.

   Entra ID

   Create an enterprise application with OIDC, set the redirect URI to https://<tenant>.promptglass.ai/auth/callback, and paste the client ID, secret and tenant ID into PromptGlass. Turn on SCIM provisioning with the token from Settings → Identity → SCIM.

   Okta

   Add the PromptGlass app from the Okta Integration Network, or create a SAML 2.0 app with ACS URL https://<tenant>.promptglass.ai/auth/saml/acs. Assign the pilot group and turn on SCIM push for users and groups.

   Google Workspace

   Create a custom SAML app with the ACS URL above. Map department and costCenter as attributes so analytics can group by them.

   SCIM matters: PromptGlass uses department, manager and cost center to roll usage up by team. See SSO and SCIM.

2. Deploy the browser extension to the pilot group

   Go to Sensors → Browser extension and copy the tenant enrollment token. Then deploy the extension with that token as managed configuration:

   Intune

   In Devices → Configuration → Settings catalog, add Microsoft Edge → Extensions → Control which extensions are installed silently and the Chrome equivalent. Then add the managed-storage policy with tenant and enrollmentToken.

   Jamf

   Upload the PromptGlass configuration profile (com.promptglass.extension.mobileconfig) from the console. It pins the extension and sets the token.

   Google Admin

   In Devices → Chrome → Apps & extensions, force-install the PromptGlass extension for the pilot OU and paste the JSON policy from the console.

   Full details are in browser extension.

3. Add a SaaS connector

   Connectors read usage from the AI vendor’s admin APIs, so nothing on the network changes. Pick the tool your organization already licenses:

   • Microsoft 365 Copilot: Graph and Purview audit log
   • OpenAI ChatGPT Enterprise: Compliance API and usage API
   • GitHub Copilot: metrics and seats API

   Go to Connectors → Add connector, complete the OAuth or API-key flow, and choose a backfill window. 30 days is a good default.

4. Turn on the starter policy in log mode

   promptglass login --tenant <tenant>
   promptglass policy apply -f https://promptglass.ai/samples/starter-log-only.yaml
   promptglass policy test --text "my card is 4111 1111 1111 1111"

   The test prints the detectors that matched and the action the policy would take.

5. Open the dashboard

   Within a few minutes Overview shows active users, the AI apps in use, top data classes detected, and estimated spend. Shadow AI apps the extension found appear under Discover.

What to do next

• Write your first enforcement rule (coach before you block). See policy examples.
• Send events to your SIEM. See SIEM integration.
• Capture API traffic from internal apps with the gateway in API mode.
• Find idle seats. See cost optimization.