Your directory identity, carried all the way to the evidence.

NopsAI accepts Entra ID as a standard OIDC provider. What makes it worth configuring is not the login screen — it is that the identity resolved there becomes the effective subject on the run record, the approval decision and the AI usage accounting.

Book a demo All integrations

Microsoft Entra ID inside a governed run.

How Microsoft Entra ID participates once it is connected — and what the platform does with what it returns.

Standard OIDC configuration
Point NopsAI at your tenant's issuer with the authorization, token, JWKS and userinfo endpoints, an application client ID and a credential reference for the client secret.
Auto-provisioning on first login
auto_create_users creates the NopsAI user on first successful sign-in, with default_role and domain_mapping deciding where they land. Onboarding does not require a second manual step.
Tenant-scoped sign-in
allowed_email_domains restricts which identities may authenticate at all, so a misconfigured multi-tenant application cannot become an access path.
Identity on every record
Once resolved, the subject is stamped on the run, the approval and the AI usage event. An auditor asking who ran this gets a directory identity, not a shared token.

The controls that make it safe to leave connected.

An integration is easy to add and hard to bound. These are the parts that decide whether it stays reviewable six months later.

Team membership is managed in NopsAI

Automatic entitlement synchronization is implemented for Keycloak only. With Entra ID, authentication is federated but team membership is managed in NopsAI configuration under Git review. That is a real difference worth planning for rather than discovering during rollout.

The client secret is a reference

The secret lives in the encrypted credential registry with rotation and access logging. Configuration in Git holds only credential://system/oidc/... which keeps the repository reviewable.

Approval teams still gate risk

Because approval steps name teams and self-approval defaults to off, federated login does not by itself grant the ability to approve anything.

Break-glass is explicit

local_enabled decides whether local login remains available if the identity provider is unreachable. Making that a setting rather than an accident is the point.

Owned by Git, reviewed like code.

Configuration is a reviewable file rather than a form someone filled in once. Credentials appear as references; the values live in the encrypted registry.

setting/system/auth.yamlYAML

oidc:
  enabled: true
  auto_create_users: true
  domain_mapping:
    example.com: nopsai
  providers:
    entra:
      type: oidc
      display_name: Microsoft Entra ID
      issuer: https://login.microsoftonline.com/<tenant-id>/v2.0
      client_id: <application-id>
      client_credential_ref: credential://system/oidc/entra/client-secret
      scopes: ["openid", "email", "profile"]
      allowed_email_domains: ["example.com"]
      allow_email_linking: true

Workflows where Microsoft Entra ID shows up.

The same integration, seen from the workflow rather than from the connection.

05Release

Preparing a release

Scope mismatch, unmerged PRs, failed gates and an outdated runbook can all cause a late surprise.

JiraGitHubCI/CDConfluence

Open use case

09Onboarding

A new employee onboards to a project

Docs go stale, active work is scattered, and every new hire rebuilds the same mental model on their own.

ConfluenceJiraGitHub

Open use case

10Reporting

Monthly status report to leadership

The report takes hours, invites copy-paste mistakes, and is often stale by the time leadership reads it.

JiraCI/CDServiceNowSalesforce

Open use case

What teams ask about Microsoft Entra ID.

Can Entra ID groups become NopsAI teams automatically?

Not today. The one entitlement synchronization mode implemented is keycloak_team_roles. With Entra ID, sign-in is federated and team membership is maintained in NopsAI configuration, which is reviewed in Git like any other access change.

Does an Entra ID identity change what a run may do?

Yes. Authorization is resolved for the effective subject before dispatch, covering the pipeline and every protected resource the run references, so two people running the same pipeline can get different outcomes.