Teams & Directory Sync
One policy per team, synced from your directory
Setting access developer by developer stops working past a handful of people, and it drifts the moment someone changes teams. Organization Teams put developers under one shared policy: a project ceiling, per-developer budget ceilings for active keys, lifetime spend, and recurring spend, and IAM rules for models, providers, pricing, and IP ranges. Effective project access is the intersection of the team's list and each developer's own grants, and member and API-key rules run after the team's, so personal settings can only narrow what the team allows. Mark one team as the default and developers who join by invite, direct add, SSO domain auto-join, or SCIM provisioning land in it automatically. With Microsoft Entra ID, map an Entra group to a team and membership follows the directory: add a user to the group and they join the team, remove them and the synced assignment goes too. Pairs with Single Sign-On (SAML / OIDC) and Per-Member Budgets & Developer Role.
Why teams turn it on
Shared policy, not per-person setup
Set the project ceiling, per-developer budgets, and IAM rules once on the team. Every developer in it inherits them.
Membership from your directory
Map a Microsoft Entra group to a team over SCIM. Joining or leaving the group moves the developer, with no dashboard work.
A default team for new joiners
Developers who join by invite, direct add, SSO domain auto-join, or SCIM land in the default team unless a group mapping places them elsewhere.
Personal rules only narrow
Member and API-key IAM rules run after the team's and can only restrict further, so a personal grant never widens the team's ceiling.
How it works
From decision to deployed in three short steps
- 01
Create a team
Under Teams, create a team and set its project ceiling, per-developer budget ceilings, and IAM policy.
- 02
Assign developers
Assign developers by hand, or mark the team as the default so new joiners are placed automatically.
- 03
Sync from Entra
In SSO settings, map an Entra group name to the team. SCIM membership updates assign and remove developers for you.
Real-world use cases
Why customers actually adopt this
Engineering groups at scale
Give each group its own projects, model allow-list, and per-developer spend ceiling.
Contractor access
Put contractors in a team scoped to one project and a tight budget, managed from an Entra group your IT team already maintains.
Zero-touch onboarding
New hires provisioned over SCIM arrive in the right team with the right limits on day one.
Frequently asked
- Who can belong to a team?
- Developers. Each developer belongs to at most one organization team, and promoting a developer to project admin clears their assignment.
- What happens if I move a synced developer by hand?
- An explicit assignment to another team is preserved. Unassigning a synced developer only lasts until the next SCIM update.
- Which identity providers sync groups to teams?
- Microsoft Entra ID group provisioning maps onto teams. For other identity providers, see Single Sign-On (SAML / OIDC).
- What if Enterprise access ends?
- Existing team policy stays enforced and can still be reviewed. Developers can be unassigned and empty teams deleted, but new teams and policy changes require Enterprise.
More enterprise capabilities
The rest of the enterprise stack
Organization-Wide Analytics
Cost, requests, and tokens totaled across every project, with breakdowns by model, project, API key, and member. Built on pre-aggregated rollups, so any date range stays fast.
Per-Member Budgets & Developer Role
Per-member spend caps enforced at request time, org-wide default developer limits, and a project-scoped Developer role. An over-budget request is rejected before it ever reaches a provider.
Enterprise Audit Logs
Tamper-evident audit trails for SOC 2, HIPAA, ISO 27001, and internal investigations. Every config change, key rotation, and admin action — captured, attributed, exportable.
Data Streams to Your SIEM
Forward audit logs to your SIEM and export request log metadata to your own HTTPS endpoint in signed, ordered batches, with replay of up to 30 days.
Per-Project Routing Overrides
Override global routing rules at the project level — region, provider order, fallback chain, and cost ceilings. Production stays pinned; experimental teams stay flexible.
Dynamic Routes
Named, versioned routing flows with conditions, classifier branches, A/B splits, and model targets. Call one with dynamic/<name> and roll back instantly.
Enterprise Guardrails
Server-side detection for prompt injection, PII, secrets, and policy violations. Configured centrally, enforced at the gateway, auditable per-request.
Provider Compliance Policies
Require SOC 2, ISO 27001, GDPR, zero data retention, no prompt training, or approved headquarters countries, and the gateway refuses every provider that falls short.
Zero Data Retention
Enforce zero data retention across provider routing, gateway storage, response caches, and the Responses API, for the whole organization or a single API key.
Discord & Slack Alerts
Native webhook integrations for Discord and Slack. Get the enterprise contact-sales form, billing events, guardrail trips, and SLA breaches in the channels your team already monitors.
Single Sign-On (SAML / OIDC)
SAML 2.0 and OIDC SSO with SCIM provisioning, group-based role mapping, and enforced-only access. No local credentials, no shared passkeys, no off-boarding gaps.
Master Keys & Provisioning API
Org-scoped bearer tokens that create projects, gateway API keys, IAM rules, and custom providers from your backend, and report cost per member and model.
Organization Skills
Publish shared agent skills once and let developers install them into Claude Code, Codex, Cursor, OpenCode, and other agents with one CLI command.
White-Label Chat & Playground
Embed or stand up a fully white-labeled chat app and playground under your own domain. Customize branding, default models, system prompts, and feature toggles.
See teams & directory sync on your real workloads
Bring a sample workload to a 30-minute call. We'll wire it up live and show you the actual experience your team will get.