Skip to content

Enterprise Features

PRO / ENTERPRISE Features

Some advanced features require a PRO licence; the Corporate Tenant Registry requires an ENTERPRISE licence.

CertifyClouds PRO and Enterprise include advanced features for organisations with SSO, multi-user, B2C tenant monitoring, multi-tenant requirements, and governed AI-client access to read-only security data.

Overview

Enterprise features include:

  • SSO/OIDC: Single Sign-On integration with Microsoft Entra ID, Okta, and other OIDC providers
  • Tenants: one page in the left-hand navigation with two tabs. Corporate covers other Entra ID tenants of your own organisation (ENTERPRISE); External covers Azure AD B2C and Entra External ID tenants (PRO). See Corporate tenants, Azure AD B2C and Entra External ID, and Registering and managing external tenants for the in-app steps
  • Multi-User Support: Multiple users with role-based access control
  • MCP Connector: ENTERPRISE read-only tools for approved AI clients

Feature Summary

  • MCP Connector (ENTERPRISE)

    Connect approved AI clients to read-only CertifyClouds security, expiry, dependency, compliance, and audit data.

  • SSO Setup

    Integrate with Microsoft Entra ID, Okta, or any OIDC provider for Single Sign-On.

  • External tenants (Azure AD B2C)

    Monitor credential expiry across your Azure AD B2C tenants.

  • Entra External ID Tenants

    Discover, rotate, and alert on App Registration credentials in External ID external tenants.

  • Corporate Tenant Registry (ENTERPRISE)

    Discover and rotate credentials across multiple Entra ID tenants of the same organisation.

  • User Management

    Manage multiple users with roles and permissions.

Comparison: STARTER vs PRO / ENTERPRISE

Advanced Feature STARTER PRO ENTERPRISE
Local username/password auth
SSO/OIDC integration
External Tenant Registry
Entra External ID Tenants
Corporate Tenant Registry
MCP Connector (read-only)
Multiple users
Role-based access control

Prerequisites

Before configuring enterprise features:

  1. PRO or Enterprise licence: Advanced features require Pro or Enterprise
  2. Admin account: Must be signed in as administrator
  3. Identity provider access: Admin access to Microsoft Entra ID, Okta, etc. for SSO setup
  4. Public HTTPS path for MCP: Required only when using the MCP Connector with remote AI clients

Getting Started

1. Configure SSO (Optional)

If your organisation uses centralised identity:

  1. Set up SSO with your identity provider
  2. Test SSO sign-in
  3. Optionally disable local password authentication

2. Add Corporate Tenants (Optional)

If you have customer corporate tenants to manage:

  1. Register corporate tenants in CertifyClouds
  2. Run an initial Key Vault scan
  3. Configure expiry alerts

3. Add External ID Tenants (Optional)

If you have Azure AD B2C or Entra External ID tenants to monitor:

  1. Register B2C tenants in CertifyClouds
  2. Register Entra External ID tenants in CertifyClouds
  3. Run initial discovery
  4. Configure expiry alerts

4. Manage Users

Set up your team:

  1. Create user accounts
  2. Assign appropriate roles
  3. Configure SSO auto-provisioning (if using SSO)

5. Configure the MCP Connector (Optional, ENTERPRISE)

If your organisation wants approved AI clients to query CertifyClouds:

  1. Review the MCP Connector prerequisites
  2. Create the Entra MCP API and one client App Registration per approved hosted AI surface
  3. Configure the trusted issuer and run the setup diagnostic

Security Considerations

Authentication Options

Option Description Security Level
Local only Username/password stored locally Basic
SSO only Disable local auth, SSO required Enhanced
SSO + Local Both options available Flexible

Recommendations

For production environments:

  1. Enable SSO for centralised identity management
  2. Disable local auth after SSO is working
  3. Use MFA via your identity provider
  4. Review audit logs for authentication events

Service Credentials CertifyClouds Uses

To act as itself in your Microsoft Entra tenant, CertifyClouds uses two distinct credentials, which are easy to confuse:

Credential Used for Notes
B2C discovery service-principal secret Reading App Registrations in each registered B2C tenant Per-tenant discovery service principal
SSO application secret CertifyClouds' own SSO sign-in application Rotated by the platform Managed Identity

Both are monitored for expiry and can be rotated automatically or on demand from Settings; see Secret Rotation. These are separate from the customer App Registration credentials that the Rotation feature manages.

Support

For enterprise feature support:

  • Email: [email protected]
  • Response time: PRO tier receives priority support with a 2 UK business day target. Enterprise response targets are defined in the signed support agreement.