osFoundry / Platform
Enterprise SSO
SAML and OIDC against Okta, Azure AD, Google Workspace or any IdP. SCIM provisioning included.
What it is
Enterprise SSO lets your team sign in to osFoundry through the identity provider you already run, using SAML 2.0 or OIDC. It works with Okta, Azure AD (Microsoft Entra ID), Google Workspace, and any standards-compliant IdP, so authentication follows the policies your IT team already enforces: MFA, conditional access, session limits, and device posture checks all stay in your IdP where they belong. osFoundry never becomes a second place your team has to manage passwords.
Inside osFoundry, SSO governs access to the whole workspace: chat and agents, apps, code, knowledge, and data. Because osFoundry is bring-your-own-key and local-first, SSO controls who can open the workspace on their device and act under your organization's identity, while your model API keys and your data stay under your control rather than a vendor's. SCIM provisioning is included, so accounts are created, updated, and deactivated automatically from your IdP. When someone joins, changes role, or leaves, the change propagates without manual account cleanup, which closes the offboarding gap that manual invite flows leave open.
This matters most for teams that treat AI as production infrastructure rather than a personal tool. You get one auditable front door, centralized deprovisioning, and directory-driven membership, without paying per-seat SSO surcharges that many vendors reserve for enterprise tiers. osFoundry's model is no per-seat fees and no reseller markup, and enterprise authentication is part of that stance rather than a paywalled add-on.
Key capabilities
- SAML 2.0 and OIDC sign-in against Okta, Azure AD (Microsoft Entra ID), Google Workspace, or any standards-compliant IdP
- SCIM provisioning included: user accounts created, updated, and deactivated automatically from your directory
- MFA, conditional access, and session policy stay in your IdP, so osFoundry inherits the controls you already enforce
- One SSO-governed entry point to the full workspace: chat and agents, apps, code, knowledge, and data
- Automatic deprovisioning closes the offboarding gap, without per-seat SSO surcharges or reseller markup
Use cases
- IT admin: Federate osFoundry to Okta with SAML so every employee signs in with existing MFA and conditional access, no separate passwords to manage
- Security lead: Turn on SCIM against Azure AD so departing employees lose workspace access the moment they're deactivated in the directory
- Team lead: Sync group membership from Google Workspace so new hires get workspace access automatically on day one without manual invites
Frequently asked questions
Which identity providers does osFoundry support?
Any IdP that speaks SAML 2.0 or OIDC. That includes Okta, Azure AD (Microsoft Entra ID), and Google Workspace out of the box, plus any other standards-compliant provider you run.
Is SCIM provisioning included, or is it a separate add-on?
It's included. SCIM lets osFoundry create, update, and deactivate accounts automatically from your directory, so membership and offboarding stay in sync with your IdP without manual account management.
Does Enterprise SSO cost extra per user?
No. osFoundry has no per-seat fees and no reseller markup, and enterprise authentication is part of that model rather than a paywalled tier. Because osFoundry is bring-your-own-key, you still supply your own model API keys and your data can stay on your device.