FOR EVERYTHING THAT SIGNS IN TO WHAT YOU BUILD
Sign-in and access for everything you build.
Set up your own Microsoft Entra or Azure AD B2C directory for the apps you build on OpenX, give each automated job its own identity, and decide who and what may act on your data, all from one window.
New to OpenX? Key terms →
ONE WINDOW · SIGN-IN TO ACCESS
- Who signs in
- Your own Entra or B2C directory
- Which job is this
- Its own identity, no password-style secret
- What may it reach
- Access rights and access cards
- Who rotated it
- Shown on the app's card
Your directory. Your apps. Your rules.
FROM THE FIRST SIGN-IN TO THE LAST JOB
Every job has a name.
Your own sign-in directory
Set up Microsoft Entra or Azure AD B2C for your apps, guided step by step, in your own tenant.
Identities for jobs, without passwords
"Create it for me" makes a scheduled job its own identity in your directory, with a certificate or a federated credential, never a password-style secret.
Revoke and set lifetimes
Revoke a job identity OpenX made and its directory credential goes at once. Set each job's token lifetime.
Know which job did what
What a job uploads, sends or runs is stamped with that job's identity.
Connected apps you can manage
Rotate an app's secret, keeping the old one for 24 hours or turning it off now. Delete the app when you are done, and see who last rotated its secret.
Access in one place
Access rights, configurations and access cards sit beside sign-in, so "who can sign in" and "what they may reach" are answered together.
IF A SECRET HAS EVER EXPIRED ON YOU
For teams that need to know who, and what, did it.
IT and security leads
Fewer long-lived app secrets to carry: jobs get certificates or federated credentials, made for you.
Integration owners
Say which automation uploaded a file or sent a message, by name.
Regulated teams
A named actor, human or machine, on what each job does.
Teams adopting AI agents
Agents connected over MCP can suggest access changes for a person to accept, and never handle secrets.
INSTEAD OF FOUR CONSOLES
Not a new directory. Yours, set up and read together.
OpenX does not replace your directory; it uses your own. The difference is that the directory, the jobs' identities, their rights, the API and the record are set up and read in one workspace, instead of across a directory console, a secrets tool, an API gateway and a log product.
- One window answers who signs in, which job this is and what it may reach.
- A person's access cards decide what their MCP connections can reach, and feed your API Manager rules for API calls.
- Job identities are made with the job, in your own Azure.
HOW TEAMS WIRE IT UP
From a new job to a named actor.
A partner integration
- 01App Identity creates the job identity.
- 02The API Manager trusts it, and its rules limit what it reaches.
- 03Its uploads carry its name.
AI-assisted onboarding
- 01An agent connected over MCP proposes access cards for a new team.
- 02A lead accepts them in App Identity.
- 03The API and the MCP server honour them.
Sell your app
- 01Your customers sign in through your directory.
- 02They subscribe to a plan.
- 03Licenses grants the plan's rights.
WHERE MACHINE ACTORS MATTER
Every integration, on its own identity.
LIFE SCIENCES
A LIMS sync job uploads results under its own identity, so the upload names the machine actor.
MANUFACTURING
A historian export and an MES integration each get their own identity and rights, revoked separately.
ENERGY AND BUILDINGS
A utility-feed import job with its own short-lived tokens.
Your directory. Your rules.
Set up sign-in for your apps and identities for your jobs, in your own tenant.
GO DEEPER
MORE OF OPENX
AI governance →
Over MCP, AI proposes and a person accepts. Only a person deploys.
OpenX MCP Server →
A few tools let any MCP-capable AI read your workspace and propose changes to it.
API Manager →
Your workspace is already an API. Decide who may call it and what each caller reaches.
Warm queries →
Save a question over live data and serve the answer to dashboards, apps and AI.
Provenance →
A record you can prove, kept in your own cloud, with corrections and signatures.
Your cloud →
Connect your Azure, build the landing zone, and the rest of OpenX runs inside it.
Databases →
A Cosmos DB store in your subscription, with a governed API for each container.
Licenses →
Sell what you build on your own Stripe, and turn a subscription into a plan's rights.
IoT →
IoT Hub and Data Explorer in your Azure, feeding queries, APIs and AI.
Communications →
Send mail through your own relay, with the password in your vault and sends on record.
App building →
Data, sign-in, access, an API and billing: your app's backend, already there.