← All integrations
View the setup guide →
Identity Provider
Integrate Entra with Barndoor
Barndoor connects to Entra and uses your existing users, roles, and groups as the starting point, then scopes further down into least-privileged, runtime-enforced access for AI and agents.
View documentationHow does Barndoor scope access for humans using AI?
Barndoor connects to Entra via SAML or OIDC, bringing your existing users, roles, and groups in without rebuilding them. Then scope what each person can do when using AI — least privilege for how humans use AI, not just whether they can log in.
How does Barndoor classify autonomous AI agents?
Every agent gets its own AgentProfile: a distinct record with its own credentials and a human sponsor, scoped to the tools, models, and data its job requires. Every tool call, model call, and token traces back to that agent.
Read more about agent profiles →What can you govern when you integrate Entra with Barndoor
| Control | What it covers |
|---|---|
| Tool access | Which MCP servers and tools each person, team, or AI agent can use |
| Data protection | Scope access to specific fields, records, or types, with DLP: PII detection, masking, tokenization |
| Model access | Which LLM models teams & agents can use, through virtual keys, so no one holds raw provider credentials |
| AI cost control | Spend limits and token budgets, usage attributed by user, team, or agent |
| Visibility | Every tool action and model call, logged, down to the user or agent |
Works with every AI client
View all supported AI clients →
Set up Entra with Barndoor
Connect Entra to Barndoor in a few steps.
Frequently asked questions
What do I need to set up SSO or identity provider integration?
You'll need an admin from your identity provider on a short setup call with a Barndoor engineer to create a connected app and exchange a client ID and secret. That exchange, plus a callback URL and the right scopes, is what lets Barndoor authenticate through your identity provider going forward.
How does Barndoor work with existing SSO or user setup?
Barndoor connects alongside your existing SSO setup.
Can I scope AI access by attributes from my identity provider?
Yes. Barndoor can apply access policies at the group, team, role, and user level defined in your identity provider.
Can we revoke AI access without changing our identity provider settings?
Yes. Access can be revoked directly in Barndoor without touching your identity provider's configuration. This matters when you need to cut off AI access fast, for a specific tool, model, or agent.
How do I get started?
Connect your identity provider to Barndoor in a few steps, then scope access for how your team and their AI agents use AI on top of your existing roles and groups. Book a demo at barndoor.ai/get-a-demo or see the setup guide for Entra at docs.barndoor.ai/how-tos/idp-setup.