SSO and provisioning for agents

Enterprise identity answers three questions before the first prompt runs. Authentication (who is this?) comes from the customer's identity provider (IdP) through SSO, using OIDC or SAML. Provisioning (do they exist here, and still?) comes from SCIM, which lets the IdP create, update and deactivate users in your application. Authorisation (what may they do?) starts with mapping IdP groups to roles and continues in Authorization and multi-tenancy. The agent-specific work is carrying the person's identity through every hop with a narrower token at each, and making sure that when someone leaves, every session, delegated token and running job the agent holds for them stops.

Key takeaways:

• Validate ID tokens fully: signature with a pinned algorithm, exact issuer, audience, expiry, nonce and tenant. Decoding is not validating.
• Key users on the IdP's immutable ID (Entra's oid with tid), never on email or display name.
• SCIM deprovisioning is the control the security team will test. It must revoke what the agent holds, not just flip a flag.
• Map groups by object ID, deny by default, and handle group overage.
• Delegation, not impersonation, from agent to tool: a narrower token per downstream audience, with both the user and the agent in the audit record.