Your company perimeter,
on Microsoft Entra ID.
PromptOps on our EU cloud, open only to users from your tenant. Sign-in, users and roles governed by Entra ID, agent policies set by IT. No servers to install.
No server installation · SSO enforced · live in a few days
How it works
Your company identity is the perimeter
You don't need servers in-house to keep outsiders out: your Microsoft tenant does it.
Only your tenant
The PromptOps organization is bound to your Entra ID tenant: only your company's Microsoft accounts get in, accounts from other tenants are refused.
SSO enforced on your domains
Every address on the verified domains must sign in with Microsoft. Passwords, Google and GitHub are refused and sessions opened any other way are closed.
Users managed from Entra ID
With SCIM, users are created, suspended and removed from the Microsoft portal. Whoever leaves the company loses PromptOps access too.
Data in the EU, code nowhere
Accounts, teams, boards and chat live on PromptOps servers in Milan. Code and prompts only go from the agents to the AI providers you chose.
Company identity
Company Single Sign-On
Your people sign in to PromptOps with the work account they already use and join your company organization automatically. Anyone suspended or removed in Entra ID loses access here too, with no passwords to revoke by hand.
How it works with Microsoft Entra ID
Connect your tenant
An administrator signs in with their Microsoft work account and creates the PromptOps organization, bound to your company tenant. They become its owner.
Verify your domain
The administrator's domain (e.g. @company.com) is verified right away, because Microsoft already verified it. Other domains are added with a DNS TXT record.
Enforce SSO
From then on every address on the verified domains must sign in with Microsoft from that tenant: passwords, Google and GitHub are refused, and sessions opened without Microsoft are closed.
- Sign-in, sign-up, social logins and guest accounts all checked the same way
- Only Microsoft accounts from your tenant: other companies are refused
- SCIM provisioning from Entra ID: users created, suspended and removed from the Microsoft portal
- Owner, admin and member roles assigned from Entra ID app roles
- Activity log of every action, visible to admins
- Free email domains (Gmail, Outlook…) are not accepted
- SSO can only be enabled by an admin signed in with Microsoft: nobody gets locked out
Included in Enterprise. Registering the app in your tenant is part of the setup phase. SAML 2.0 connects Okta, ADFS and other compatible providers; people sign in from "Sign in with company SSO" by entering their email. With Google Workspace the organization is bound to your domain and personal Gmail accounts are refused. SCIM and automatic roles are available with Entra ID.
IT control
Governed by your IT team
IT sets the rules once, the app enforces them on every machine, and every action leaves a trail.
Agent policies
Allowed AI providers, sub-agent spawning, provider switching, auto-approval and plugin installs decided for the whole organization and enforced by the app after sign-in.
Deploy with Intune / MDM
The desktop app reads an IT-managed configuration (Windows policy, macOS profiles, system files): your backend address, HTTPS only, Microsoft sign-in only.
Events to your SIEM and Teams
Organization events are sent to your SIEM (e.g. Microsoft Sentinel) through a signed webhook and to a Microsoft Teams channel.
Exportable activity log
Every admin and member action is logged, visible in the console and exportable as CSV or JSON for audit and retention.
Pricing
One contract for the whole organization
Price depends on the number of users and the support level. We define it together after a 30-minute call.
Enterprise SaaS
PromptOps Enterprise on the PromptOps EU cloud, with a perimeter on Microsoft Entra ID.
- Microsoft Entra ID SSO enforced and SCIM provisioning
- Owner, admin and member roles from Entra ID app roles
- Agent policies, company plugins and skills
- Desktop deployment with Intune / MDM
- Events to SIEM and Teams, exportable activity log
- Continuous updates included
- Contract, DPA and NDA signed with your company
Prices in US dollars, excluding taxes.
Action plan
Live in a few days
Four steps from the call to a working team.
Call and contract
Days 1-2We learn about your team, AI providers and security requirements. Contract, DPA and NDA signed.
Result: PromptOps organization ready
Connect your tenant
Day 3An administrator signs in with Microsoft, binds the organization to the tenant and verifies company domains.
Result: Tenant and domains connected
Policies and SCIM
Day 4Allowed providers, agent policies, plugins and skills. SCIM provisioning and roles from Entra ID.
Result: Company configuration active
Enforced SSO and go-live
Day 5SSO enforced on every domain, app rollout with Intune, team training.
Result: Team productive, dedicated contact
FAQ
Frequently asked questions
Does our code go through PromptOps servers?
No. Agents run on developers' computers or your own machines: code and prompts only go to the AI providers you chose. Our EU servers only hold accounts, organization, teams, boards and chat.
Does it also work with Google Workspace or SAML?
Yes. Google Workspace and SAML 2.0 providers (Okta, ADFS…) connect the same way; SCIM and automatic roles are available with Entra ID.
Can we move to Self-hosted later?
Yes. The app is the same and the organization's configuration carries over to your instance.
Let's talk
Request a call with the Enterprise team
Fill in the fields: your email client will open with the message ready to send. We reply within one business day.
PromptOpsspinoff by