← All integrationsINTEGRATION · IDENTITY

Kapālins for Microsoft Entra ID

People and groups from Microsoft Entra ID, and the OAuth grants that reveal AI apps someone connected with one click. Every plane of Kapālins, the gateway, the workspace and the laptop, knows who the person is, which group they belong to and which policy applies to them.

See it governed liveSetup in four steps

Policy by group, not by spreadsheet

Roles and AI entitlements follow the groups you already keep in Microsoft Entra ID. Move a person and their access moves with them.

Leave once, lose access everywhere

De-provisioning in Microsoft Entra ID removes the person from the gateway, the workspace and the device plane in the same sweep.

AI apps nobody told you about

OAuth grants in Microsoft Entra ID are matched against the AI app catalogue, so an app someone connected with one click shows up with a name and an owner.

WHO

Every verdict names a person.

Because people and groups arrive from Microsoft Entra ID, every row in the timeline carries a person and a group, not an API key or a username string.

  • SCIM 2.0 keeps people and groups current
  • Only people assigned to the Kapālins app are imported
Kapālins Logs: one timeline of AI requests and policy verdicts
The Kapālins timeline in the pilot tenant on production. Personal addresses masked.
NON-HUMAN

The identities no directory holds.

Microsoft Entra ID brings the people. Agents and service keys are in no directory, so Kapālins profiles each one from its own behaviour, flags the ones that drift, and shows the score line by line, beside the people Microsoft Entra ID provides.

  • Calls, hours, models and injection rate against baseline
  • Quarantine a key in one click, reversibly
Kapālins Agentic Behaviour: an agent key flagged, with its score derivation and behavioural fingerprint
Console replay · illustrative data
A replay of the Kapālins console: an agent flagged for injection activity, its score explained line by line, its fingerprint against baseline, and the MCP calls it made outside its declared scope. Agent names and activity are illustrative.
ACT

The person, not a guess.

An incident names who did it and which group policy applied, so the review is a conversation with one person, not a hunt through logs.

  • Roles in Kapālins assigned from your groups
Kapālins incidents: sensitive data stopped before it left
Incidents in the pilot tenant: sensitive data stopped before it reached an AI service. Personal addresses masked.
Setup

Four steps.

  1. Create the SSO appAdd Kapālins as an OIDC application in Microsoft Entra ID and enter its client details in Kapālins.
  2. Turn on SCIMCreate a provisioning token in Kapālins and paste it into the app’s provisioning settings.
  3. Allow the grant sweepConsent to read-only access to application grants.
  4. Assign the appOnly people assigned to the Kapālins app are imported.
Request a briefing

See Microsoft Entra ID governed in thirty minutes.

Bring the person who holds the credential. We connect it live and watch the first events land.

Request a briefing All integrations
FAQ

Questions buyers ask.

Does Kapālins write to my directory?

No. Provisioning flows one way, from your directory to Kapālins, and any grant sweep is read-only.

Which groups should I provision?

Only the groups that should use Kapālins. Assign the Kapālins app in Microsoft Entra ID to those groups and SCIM sends exactly them.

What happens when someone leaves?

The next SCIM push deactivates them, and every plane stops recognising their identity.