> For clean Markdown of any page, append .md to the page URL. > For a complete documentation index, see https://help.sigmacomputing.com/llms.txt. > For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://help.sigmacomputing.com/_mcp/server. # Configure an external AI provider When you [configure AI features for your organization](/docs/configure-ai-features-for-your-organization), you can set up an external AI provider to use AI models provided by a third party, such as OpenAI, Gemini, or Amazon Bedrock. The use of AI features is subject to the following [disclaimer](/docs/notice-for-enabling-ai-enabled-features-in-sigma). You can integrate Sigma with the following external AI providers: * [OpenAI](#add-openai-as-an-ai-provider) * [Azure OpenAI Foundry](#add-azure-openai-as-an-ai-provider) * [Gemini through Google](#add-google-gemini-as-an-ai-provider) * [Amazon Bedrock](#add-amazon-bedrock-as-an-ai-provider) (Beta) Sigma recommends a token limit of at least 100,000 tokens per minute (TPM) for an external AI provider. After setting up an AI provider, you can [change the provider or remove an existing setup](#manage-an-external-ai-provider). ## User requirements * You must be assigned the **Admin** [account type](/docs/create-and-manage-account-types). ## Add OpenAI as an AI provider If you have an OpenAI API key, set up Sigma to use the supported OpenAI model for all AI-powered features. ### Retrieve OpenAI credentials To integrate with OpenAI directly, you must obtain, manage, and secure an OpenAI API key. You can retrieve the API key in the API keys section of the OpenAI developer platform. For instructions, see Where do I find my OpenAPI API key? in the OpenAI documentation. **Supported model**: * If `GPT-5.4` is available in your account, Sigma uses it. * If `GPT-5.4` is unavailable in your account, Sigma uses `GPT-5.1`. ### Add OpenAI as an AI provider to Sigma To add OpenAI as an external AI provider for your organization: 1. Go to **Administration** > **AI settings**: 1. In the Sigma header, click your user avatar to open the user menu. 2. Select **Administration** to open the **Administration** portal. 3. In the side panel, select **AI settings**. 2. In the **AI provider** section, for **Provider hosting**, select the **External models** option. 3. For **AI provider**, select **OpenAI**. 4. In the **API key** field, enter the OpenAI API key. 5. Click **Save** to authenticate. After you save, the **API key** field appears blank and Sigma does not display the key. After the integration is successfully authenticated, AI functionality is available for your organization. ## Add Azure OpenAI as an AI provider If you access OpenAI models through Azure OpenAI in Microsoft Foundry, set up Sigma to use the supported models for AI-powered features. ### Set up Azure OpenAI models To use OpenAI through Azure OpenAI in Microsoft Foundry Models, you must have the following: * An Azure subscription with access to Azure OpenAI. * The following supported models deployed in Microsoft Foundry: * GPT-5.4 * text-embedding-3-small (for an Embeddings model). Both models are required to use AI features in Sigma. If needed, review the prerequisites listed in the Deploy Microsoft Foundry Models in the Foundry portal page of the Microsoft Azure documentation. To integrate Azure OpenAI in Microsoft Foundry Models with Sigma, you must provide a deployment ID, endpoint URL, and API key for each required model. You can retrieve the required information from Microsoft Foundry. See Manage models in the Microsoft Azure documentation. 1. Log in to Microsoft Foundry. 2. Select your project. 3. On the **Models + endpoints** page, retrieve the relevant details: | Details | Where to find | | ---------- | ---------------------------------------------------------------------------------- | | Model name | Listed as the **Model name** for a given resource. | | Endpoint | Next to the resource name, click **Get endpoint** and copy the **Endpoint** value. | | Key | Next to the resource name, click **Get endpoint** and copy the **Key** value. | In Sigma, use the values as follows: * **Model name** as the **Deployment ID** * **Endpoint** as the **Endpoint URL** * **Key** as the **API Key** For more details, see Deploy Microsoft Foundry Models in the Foundry portal in the Microsoft Azure documentation. ### Add Azure OpenAI as an AI provider in Sigma To add Azure OpenAI as an external AI provider for your organization: 1. Go to **Administration** > **AI settings**: 1. In the Sigma header, click your user avatar to open the user menu. 2. Select **Administration** to open the **Administration** portal. 3. In the side panel, select **AI settings**. 2. In the **AI provider** section, for **Provider hosting**, select the **External models** option. 3. For **AI provider**, select **Azure OpenAI**. 4. For each model, provide the [required details](#azure-openai-credentials): * For **Deployment ID**, enter the model name. * For **Endpoint URL**, enter the endpoint. * For **API key**, enter the key for the endpoint. If the language model and embeddings model are in the same project, the endpoint URL and key are the same for both models. 5. Click **Save** to authenticate. After you save, Sigma does not display the values of your credentials. If Sigma displays a "Failed to validate" error, you might have restricted access to your Azure instance using an IP allowlist. To fix this issue: 1. Retrieve the IP addresses used by Sigma. See [Add Sigma IPs to the allowlist](/docs/connect-to-data-sources#add-sigma-ips-to-the-allowlist). 2. Update your allowlist in the Azure portal. See Grant access from an internet IP range in the Microsoft Azure documentation. After the integration is successfully authenticated, AI functionality is available for your organization. ## Add Google Gemini as an AI provider If you use Google Gemini, set up Sigma to use the supported model for AI-powered features. ### Google Gemini credentials To use Google Gemini, you must obtain, manage, and secure a Gemini API key. You can retrieve the API key in the API keys section of Google AI Studio. **Supported model**: Sigma uses `Gemini 2.5 Pro`. When using AI features in Sigma, consider the rate limits set by Gemini. For more details, see Rate limits in the Gemini API documentation. ### Add Gemini as an AI provider to Sigma To add Google Gemini as an external AI provider for your organization: 1. Go to **Administration** > **AI settings**: 1. In the Sigma header, click your user avatar to open the user menu. 2. Select **Administration** to open the **Administration** portal. 3. In the side panel, select **AI settings**. 2. In the **AI provider** section, for **Provider hosting**, select the **External models** option. 3. For **AI provider**, select **Gemini**. 4. For **API key**, enter the Gemini API key. 5. Click **Save** to authenticate. After you save, the **API key** field appears blank and Sigma does not display the key. After the integration is successfully authenticated, AI functionality is available for your organization. ## Add Amazon Bedrock as an AI provider This documentation describes one or more public beta features that are in development. Beta features are subject to quick, iterative changes; therefore the current user experience in the Sigma service can differ from the information provided in this page. This page should not be considered official published documentation until Sigma removes this notice and the beta flag on the corresponding feature(s) in the Sigma service. For the full beta feature disclaimer, see [Beta features](/docs/sigma-product-releases#beta-features). You can use Amazon Bedrock as your AI provider and power Sigma AI features. You can use Amazon Bedrock models directly by setting up a role for Sigma to use in Amazon Web Services (AWS). To set up Amazon Bedrock as an AI provider, complete the following steps in your AWS console and Sigma: 1. Review the [Amazon requirements](#amazon-requirements). 2. [Step 1: Create a role in AWS](#step-1-create-a-role-in-aws). 3. [Step 2: Add Amazon Bedrock as an AI provider in Sigma](#step-2-add-amazon-bedrock-as-an-ai-provider-in-sigma). 4. [Step 3: Set up a trust relationship in AWS](#step-3-set-up-a-trust-relationship-in-aws). 5. [Step 4: Test the AI provider connection](#step-4-test-the-ai-provider-connection). ### Amazon requirements You must have access to Amazon Bedrock and have permissions to create roles in the AWS console. When you set up Amazon Bedrock as your AI provider, Sigma accesses the following types of models using the Amazon Bedrock runtime API: * Anthropic foundation models * Amazon Titan Text Embeddings models For inference, Sigma currently uses one of the following supported models: * Claude Sonnet 4.5 * Claude Sonnet 4.6 * Claude Haiku 4.5 For details about all Anthropic models, see Anthropic in the Regional availability page in the Amazon Bedrock documentation. If a supported model is not available in your AWS region, set up Cross-region inference to access it from your geographic region. If data residency is not a requirement, set up global inference instead. ### Step 1: Create a role in AWS To use your Amazon Bedrock models with Sigma, you must create a role to allow a Sigma user for your organization to access Amazon Bedrock model resources. In your AWS console, follow the steps to Create a role to give permissions to an IAM user in the AWS Identity and Access Management User Guide: * Create the role for **This account**. * Skip adding permissions. You add permissions to the role in [Step 3: Set up a trust relationship in AWS](#step-3-set-up-a-trust-relationship-in-aws). * Do not require MFA. Sigma uses an API to assume the role and cannot use multi-factor authentication to sign in. * When prompted, create a policy. Set up an IAM policy for the role that allows the [required actions](#required-iam-policy-actions) and [resources](#required-iam-policy-resources), or refer to the example: [Example IAM policy](#example-iam-policy). For guidance creating IAM policies, see Define custom IAM permissions with customer managed policies in the AWS Identity and Access Management User Guide. For the specific action and resource options available for Amazon Bedrock, see Actions, resources, and condition keys for Amazon Bedrock in the AWS Service Authorization Reference. * Choose an identifiable role name. For example, `sigma_bedrock` to indicate that this is a role used by Sigma to access Amazon Bedrock. #### Required IAM policy actions The IAM policy that you set up must allow the following actions: * `bedrock:InvokeModel` * `bedrock:InvokeModelWithResponseStream` For full details on those IAM actions, see Permissions Reference for Amazon Bedrock in the Amazon Bedrock documentation. #### Required IAM policy resources The IAM policy that you set up must specify the following resources: * Anthropic foundation models * Amazon Titan Text Embeddings models * An inference profile that provides access to Anthropic models. For details about inference profiles, see Set up a model invocation resource using inference profiles in the Amazon Bedrock User Guide. To track model usage from Sigma, you can create an application inference profile and reference that inference profile resource in your IAM policy. See Create an application inference profile in the Amazon Bedrock User Guide. For example, for an inference option for an EU region with data residency requirements, specify the following resources: * `arn:aws:bedrock:eu-central-1::foundation-model/anthropic.*` * `arn:aws:bedrock:eu-central-1:*:inference-profile/eu.anthropic*` * `arn:aws:bedrock:eu-central-1::foundation-model/amazon.titan-embed-text-*` Sigma recommends using a wildcard to refer to the model resources to allow Sigma to upgrade models without requiring you to update your IAM policy in AWS. #### Example IAM policy If your AWS region is in the United States, you can copy the following IAM policy JSON: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream" ], "Resource": [ "arn:aws:bedrock:us-*::foundation-model/anthropic.*", "arn:aws:bedrock:us-*:*:inference-profile/us.anthropic.*", "arn:aws:bedrock:us-*::foundation-model/amazon.titan-embed-text-*" ] } ] } ``` ### Step 2: Add Amazon Bedrock as an AI provider in Sigma To add Amazon Bedrock as an external AI provider for your organization: 1. Go to **Administration** > **AI settings**: 1. In the Sigma header, click your user avatar to open the user menu. 2. Select **Administration** to open the **Administration** portal. 3. In the side panel, select **AI settings**. 2. In the **AI provider** section, for **Provider hosting**, select the **External models** option. 3. For **AI provider**, select **Amazon Bedrock**. 4. For **AWS IAM role ARN**, enter the Amazon Resource Name (ARN) of the role to which you assigned the IAM policy with access to invoke Amazon Bedrock models. 5. For **AWS region**, specify the region of the models that you want to access. The region you specify must match the region associated with the model resource paths in the IAM policy. For example, `eu-central-1`. 6. Click **Save**. 7. After you save, Sigma displays an **Amazon Bedrock external ID**. Copy the external ID and store it somewhere secure. After storing the external ID, click **Close**. 8. Review the AI provider details and copy the **AWS IAM user ARN** for your Sigma organization. You need the **Amazon Bedrock external ID** and **AWS IAM user ARN** in [Step 3: Set up a trust relationship in AWS](#step-3-set-up-a-trust-relationship-in-aws). ### Step 3: Set up a trust relationship in AWS In the AWS console, use the external ID and IAM user ARN associated with your Sigma organization to set up a trust relationship. The trust relationship allows the Sigma IAM user to assume the role associated with the Amazon Bedrock IAM policy. Follow the steps to Update a role trust policy in the AWS Identity and Access Management User Guide. For the trust policy, use a policy like the following example, replacing `` with the **AWS IAM user ARN** and `` with the **Amazon Bedrock external ID** values copied in [Step 2: Add Amazon Bedrock as an AI provider in Sigma](#step-2-add-amazon-bedrock-as-an-ai-provider-in-sigma): ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "" } } } ] } ``` ### Step 4: Test the AI provider connection After setting up a trust relationship in AWS to allow Sigma to use Amazon Bedrock models, test the AI provider connection: 1. Go to **Administration** > **AI settings**: 1. In the Sigma header, click your user avatar to open the user menu. 2. Select **Administration** to open the **Administration** portal. 3. In the side panel, select **AI settings**. 2. In the **AI provider** section, click **Test connection**. If the connection is successful, you see a message like "Connection verified: Sigma successfully assumed your IAM role and reached Amazon Bedrock." If you see an error, review your IAM policy settings or contact [Sigma Support](/docs/submit-a-support-request). ## Manage an external AI provider You can edit the external AI provider integration at any time. For example, to update your credentials. 1. Go to **Administration** > **AI settings**. 2. In the **AI provider** section, click **Edit**. 3. Make the desired changes. For example, change the AI provider or add a new API key. To change the AI provider, first click **Remove**. 4. Click **Save**. ### Remove an AI integration To disable AI functionality within Sigma, you can remove the AI provider: 1. Go to **Administration** > **AI settings**. 2. In the **AI provider** section, click **Edit**, then click **Remove**. 3. When prompted to confirm, click **Remove**. 4. Click **Save**. After the integration is successfully removed, the **AI provider** section displays a **Save** button, and AI functionality is unavailable for your organization. ## Related resources * [Explain charts with AI](/docs/explain-visualizations-with-ai) * [Use AI with formulas](/docs/use-ai-with-formulas) * [Ask natural language queries with Sigma Assistant](/docs/ask-natural-language-queries-with-assistant)