AuthGuard Request a demo

IAM · identity and access

Who is who, what they can do, and proof of all of it.

AuthGuard holds your organisation’s identities and decides access to your applications: people and groups, provisioning from Entra ID or Okta, single sign-on through OpenID Connect, SAML and Microsoft 365, a policy that denies by default and a chained audit log.

Talk to us about IAM See how it works
  • SCIM 2.0
  • OIDC · SAML · M365
  • Deny by default
  • Chained audit log
Organisation · example.comillustrative example
  • SCIM · Microsoft Entra IDactivePeople and groups created, changed and deactivated
  • Finance groupgroupUsed in the policy and as approvers
  • Access policy · revision 12activeDenies by default, simulated before activation
  • HR Portal · OpenID ConnectruleSign-in allowed for the Staff group
Chained audit logevery change confirmed with a passkey or phone
  1. SCIM creates the person
  2. Joins a group
  3. Policy evaluates
  4. Audit records

Watch

From the first day to the last.

Narrated in English, with English and Portuguese subtitles. Real product screens; people, organisations and amounts are fictitious.

How it works

From person to application.

A lifecycle with automatic provisioning, explicit rules and a record that cannot be erased.

  1. 01 · Organisation

    One organisation, its own address

    Each organisation has its own address, its own branding and, if you want, custom domains with automatic certificates. On AuthGuard SaaS, data stays in the EU (Ireland, with backups in Frankfurt).

  2. 02 · Provisioning

    People and groups arrive on their own

    SCIM 2.0 from Microsoft Entra ID or Okta: create, update, deactivate and deprovision accounts, with groups and memberships. Leavers are suspended and their AuthGuard sessions end at once.

  3. 03 · Policy

    Explicit rules, deny by default

    Groups, roles, authentication method, network zones, country, schedules and computer state feed the rules. Every revision is immutable and can be simulated and rolled back.

  4. 04 · Evidence

    Everything is recorded

    A chained, append-only audit log, signed receipts for approvals, and GDPR requests handled in the console, each with its own receipt.

Illustrative example

Leaves on Friday. Locked out by Monday.

Rui leaves the company. In Entra ID his account is disabled; SCIM passes the change on, AuthGuard suspends him and ends his sessions. On Monday, no application connected to AuthGuard accepts a new sign-in from him.

Nothing is silently deleted: the suspended account and the audit log show who did what and when. If the organisation chooses, inactive suspended accounts are erased automatically after the period it sets, with pseudonymisation that keeps the proof.

Modules

Everything identity needs.

Single sign-on

OIDC, SAML 2.0 and Microsoft 365

  • OpenID Connect provider with PKCE and private_key_jwt
  • SAML 2.0 provider with templates for well-known services
  • Microsoft 365 domain federation
  • Sensitive applications always ask for a passkey
See details: Single sign-on
Provisioning

SCIM 2.0

  • Microsoft Entra ID and Okta, step by step
  • Scoped tokens with validity and rotation with a grace period
  • Groups and memberships kept in step
  • SCIM never creates or promotes administrators
Administration

Roles and confirmation

  • Member and Administrator roles
  • Every administrative change needs a passkey or phone confirmation under 5 minutes old
  • Helpdesk factor resets with optional dual approval
  • The last active administrator cannot be suspended
Policy

Access by rule

  • Up to 256 rules with group, role, method, network zone, country, schedule and computer conditions
  • Immutable revisions, candidate mode and rollback
  • Simulation before activation
  • Windows computer state, reported by the agent
Audit and GDPR

Evidence and privacy

  • Append-only audit log with cryptographic chaining
  • GDPR export, rectification and erasure in the console, each with a receipt
  • Erasure pseudonymises and keeps the proof
  • Backups kept for 35 days
Partners

Distributors and white label

  • Distributor portal with organisations, licences and domains
  • Your own brand on sign-in, console, emails, Windows and the approval screen
  • Your choice of product and approver-app name
  • One plan with every feature, priced per active user

Worth knowing

  • Direct sync with Active Directory or LDAP (the directory connector) is not available on AuthGuard SaaS yet. Use SCIM from Entra ID or Okta.
  • Custom roles and delegated administration are not available yet; today there are the Member and Administrator roles.
  • There is no bulk CSV import or SCIM /Bulk, and AuthGuard does not create accounts in your applications.
  • Service emails are sent in Portuguese only.
  • With white label, the Android app’s icon, installed name and store listing remain AuthGuard.
  • The Sovereign profile does not include SCIM, single sign-on or the console’s GDPR tools.

In the help centre

Pilot

Connect your directory and one application.

SCIM provisioning from Entra ID or Okta, a pilot group and one application through OpenID Connect or SAML. We review the policy with you before it goes live.

geral@authguard.pt