Configure an external AI provider

When you configure AI features for your organization, you can set up an external AI provider to use AI models provided by a third party, such as OpenAI, Gemini, or Amazon Bedrock.

You can integrate Sigma with the following external AI providers:

• OpenAI
• Azure OpenAI Foundry
• Gemini through Google
• Amazon Bedrock (Beta)

💡

Sigma recommends a token limit of at least 100,000 tokens per minute (TPM) for an external AI provider.

After setting up an AI provider, you can change the provider or remove an existing setup.

User requirements

• You must be assigned the Admin account type.

Add OpenAI as an AI provider

If you have an OpenAI API key, set up Sigma to use the supported OpenAI model for all AI-powered features.

Retrieve OpenAI credentials

To integrate with OpenAI directly, you must obtain, manage, and secure an OpenAI API key. You can retrieve the API key in the API keys section of the OpenAI developer platform. For instructions, see Where do I find my OpenAPI API key? in the OpenAI documentation.

Supported model: Sigma uses GPT-5.1.

Add OpenAI as an AI provider to Sigma

To add OpenAI as an external AI provider for your organization:

1. Go to Administration > AI settings:

   1. In the Sigma header, click your user avatar to open the user menu.
   2. Select Administration to open the Administration portal.
   3. In the side panel, select AI settings.

2. In the AI provider section, for Provider hosting, select the External models option.

3. For AI provider, select OpenAI.

4. In the API key field, enter the OpenAI API key.

5. Click Save to authenticate. After you save, the API key field appears blank and Sigma does not display the key.

   After the integration is successfully authenticated, AI functionality is available for your organization.

Add Azure OpenAI as an AI provider

If you access OpenAI models through Azure OpenAI in Microsoft Foundry, set up Sigma to use the supported models for AI-powered features.

Set up Azure OpenAI models

To use OpenAI through Azure OpenAI in Microsoft Foundry Models, you must have the following:

• An Azure subscription with access to Azure OpenAI.

• The following supported models deployed in Microsoft Foundry:

  • GPT-5.1
  • text-embedding-3-small (for an Embeddings model).

  🚩

  Both models are required to use AI features in Sigma.

If needed, review the prerequisites listed in the Deploy Microsoft Foundry Models in the Foundry portal page of the Microsoft Azure documentation.

To integrate Azure OpenAI in Microsoft Foundry Models with Sigma, you must provide a deployment ID, endpoint URL, and API key for each required model. You can retrieve the required information from Microsoft Foundry. See Manage models in the Microsoft Azure documentation.

1. Log in to Microsoft Foundry.

2. Select your project.

3. On the Models + endpoints page, retrieve the relevant details:

   Details	Where to find
   Model name	Listed as the Model name for a given resource.
   Endpoint	Next to the resource name, click Get endpoint and copy the Endpoint value.
   Key	Next to the resource name, click Get endpoint and copy the Key value.

In Sigma, use the values as follows:

• Model name as the Deployment ID
• Endpoint as the Endpoint URL
• Key as the API Key

For more details, see Deploy Microsoft Foundry Models in the Foundry portal in the Microsoft Azure documentation.

Add Azure OpenAI as an AI provider in Sigma

To add Azure OpenAI as an external AI provider for your organization:

1. Go to Administration > AI settings:

   1. In the Sigma header, click your user avatar to open the user menu.
   2. Select Administration to open the Administration portal.
   3. In the side panel, select AI settings.

2. In the AI provider section, for Provider hosting, select the External models option.

3. For AI provider, select Azure OpenAI.

4. For each model, provide the required details:

   • For Deployment ID, enter the model name.
   • For Endpoint URL, enter the endpoint.
   • For API key, enter the key for the endpoint.

   💡

   If the language model and embeddings model are in the same project, the endpoint URL and key are the same for both models.

5. Click Save to authenticate. After you save, Sigma does not display the values of your credentials.

   🚧

   If Sigma displays a "Failed to validate" error, you might have restricted access to your Azure instance using an IP allowlist. To fix this issue:

   1. Retrieve the IP addresses used by Sigma. See Add Sigma IPs to the allowlist.
   2. Update your allowlist in the Azure portal. See Grant access from an internet IP range in the Microsoft Azure documentation.

   After the integration is successfully authenticated, AI functionality is available for your organization.

Add Google Gemini as an AI provider

If you use Google Gemini, set up Sigma to use the supported model for AI-powered features.

Google Gemini credentials

To use Google Gemini, you must obtain, manage, and secure a Gemini API key.

You can retrieve the API key in the API keys section of Google AI Studio.

Supported model: Sigma uses Gemini 2.5 Pro.

When using AI features in Sigma, consider the rate limits set by Gemini. For more details, see Rate limits in the Gemini API documentation.

Add Gemini as an AI provider to Sigma

To add Google Gemini as an external AI provider for your organization:

1. Go to Administration > AI settings:

   1. In the Sigma header, click your user avatar to open the user menu.
   2. Select Administration to open the Administration portal.
   3. In the side panel, select AI settings.

2. In the AI provider section, for Provider hosting, select the External models option.

3. For AI provider, select Gemini.

4. For API key, enter the Gemini API key.

5. Click Save to authenticate. After you save, the API key field appears blank and Sigma does not display the key.

   After the integration is successfully authenticated, AI functionality is available for your organization.

Add Amazon Bedrock as an AI provider

You can use Amazon Bedrock as your AI provider and power Sigma AI features. You can use Amazon Bedrock models directly by setting up a role for Sigma to use in Amazon Web Services (AWS).

To set up Amazon Bedrock as an AI provider, complete the following steps in your AWS console and Sigma:

1. Review the Amazon requirements.
2. Step 1: Create a role in AWS.
3. Step 2: Add Amazon Bedrock as an AI provider in Sigma.
4. Step 3: Set up a trust relationship in AWS.
5. Step 4: Test the AI provider connection.

Amazon requirements

You must have access to Amazon Bedrock and have permissions to create roles in the AWS console.

When you set up Amazon Bedrock as your AI provider, Sigma accesses the following types of models using the Amazon Bedrock runtime API:

• Anthropic foundation models
• Amazon Titan Text Embeddings models

For inference, Sigma currently uses one of the following supported models:

• Claude Sonnet 4.5
• Claude Sonnet 4.6
• Claude Haiku 4.5

For details about all Anthropic models, see Anthropic in the Regional availability page in the Amazon Bedrock documentation. If a supported model is not available in your AWS region, set up Cross-region inference to access it from your geographic region. If data residency is not a requirement, set up global inference instead.

Step 1: Create a role in AWS

To use your Amazon Bedrock models with Sigma, you must create a role to allow a Sigma user for your organization to access Amazon Bedrock model resources.

In your AWS console, follow the steps to Create a role to give permissions to an IAM user in the AWS Identity and Access Management User Guide:

• Create the role for This account.

• Skip adding permissions. You add permissions to the role in Step 3: Set up a trust relationship in AWS.

• Do not require MFA. Sigma uses an API to assume the role and cannot use multi-factor authentication to sign in.

• When prompted, create a policy. Set up an IAM policy for the role that allows the required actions and resources, or refer to the example: Example IAM policy.

  For guidance creating IAM policies, see Define custom IAM permissions with customer managed policies in the AWS Identity and Access Management User Guide. For the specific action and resource options available for Amazon Bedrock, see Actions, resources, and condition keys for Amazon Bedrock in the AWS Service Authorization Reference.

• Choose an identifiable role name. For example, sigma_bedrock to indicate that this is a role used by Sigma to access Amazon Bedrock.

Required IAM policy actions

The IAM policy that you set up must allow the following actions:

• bedrock:InvokeModel
• bedrock:InvokeModelWithResponseStream

For full details on those IAM actions, see Permissions Reference for Amazon Bedrock in the Amazon Bedrock documentation.

Required IAM policy resources

The IAM policy that you set up must specify the following resources:

• Anthropic foundation models

• Amazon Titan Text Embeddings models

• An inference profile that provides access to Anthropic models. For details about inference profiles, see Set up a model invocation resource using inference profiles in the Amazon Bedrock User Guide.

  💡

  To track model usage from Sigma, you can create an application inference profile and reference that inference profile resource in your IAM policy. See Create an application inference profile in the Amazon Bedrock User Guide.

For example, for an inference option for an EU region with data residency requirements, specify the following resources:

• arn:aws:bedrock:eu-central-1::foundation-model/anthropic.*
• arn:aws:bedrock:eu-central-1:*:inference-profile/eu.anthropic*
• arn:aws:bedrock:eu-central-1::foundation-model/amazon.titan-embed-text-*

📘

Sigma recommends using a wildcard to refer to the model resources to allow Sigma to upgrade models without requiring you to update your IAM policy in AWS.

Example IAM policy

If your AWS region is in the United States, you can copy the following IAM policy JSON:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel",
                "bedrock:InvokeModelWithResponseStream"
            ],
            "Resource": [
                "arn:aws:bedrock:us-*::foundation-model/anthropic.*",
                "arn:aws:bedrock:us-*:*:inference-profile/us.anthropic.*",
                "arn:aws:bedrock:us-*::foundation-model/amazon.titan-embed-text-*"
            ]
        }
    ]
}

Step 2: Add Amazon Bedrock as an AI provider in Sigma

To add Amazon Bedrock as an external AI provider for your organization:

1. Go to Administration > AI settings:

   1. In the Sigma header, click your user avatar to open the user menu.
   2. Select Administration to open the Administration portal.
   3. In the side panel, select AI settings.

2. In the AI provider section, for Provider hosting, select the External models option.

3. For AI provider, select Amazon Bedrock.

4. For AWS IAM role ARN, enter the Amazon Resource Name (ARN) of the role to which you assigned the IAM policy with access to invoke Amazon Bedrock models.

5. For AWS region, specify the region of the models that you want to access. The region you specify must match the region associated with the model resource paths in the IAM policy. For example, eu-central-1.

6. Click Save.

7. After you save, Sigma displays an Amazon Bedrock external ID. Copy the external ID and store it somewhere secure. After storing the external ID, click Close.

8. Review the AI provider details and copy the AWS IAM user ARN for your Sigma organization.

   You need the Amazon Bedrock external ID and AWS IAM user ARN in Step 3: Set up a trust relationship in AWS.

Step 3: Set up a trust relationship in AWS

In the AWS console, use the external ID and IAM user ARN associated with your Sigma organization to set up a trust relationship. The trust relationship allows the Sigma IAM user to assume the role associated with the Amazon Bedrock IAM policy.

Follow the steps to Update a role trust policy in the AWS Identity and Access Management User Guide.

For the trust policy, use a policy like the following example, replacing <SigmaIAMUserARN> with the AWS IAM user ARN and <SigmaExternalId> with the Amazon Bedrock external ID values copied in Step 2: Add Amazon Bedrock as an AI provider in Sigma:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "<SigmaIAMUserARN>"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "<SigmaExternalId>"
                }
            }
        }
    ]
}

Step 4: Test the AI provider connection

After setting up a trust relationship in AWS to allow Sigma to use Amazon Bedrock models, test the AI provider connection:

1. Go to Administration > AI settings:

   1. In the Sigma header, click your user avatar to open the user menu.
   2. Select Administration to open the Administration portal.
   3. In the side panel, select AI settings.

2. In the AI provider section, click Test connection.

   If the connection is successful, you see a message like "Connection verified: Sigma successfully assumed your IAM role and reached Amazon Bedrock."

If you see an error, review your IAM policy settings or contact Sigma Support.

Manage an external AI provider

You can edit the external AI provider integration at any time. For example, to update your credentials.

1. Go to Administration > AI settings.
2. In the AI provider section, click Edit.
3. Make the desired changes. For example, change the AI provider or add a new API key. To change the AI provider, first click Remove.
4. Click Save.

Remove an AI integration

To disable AI functionality within Sigma, you can remove the AI provider:

1. Go to Administration > AI settings.
2. In the AI provider section, click Edit, then click Remove.
3. When prompted to confirm, click Remove.
4. Click Save.

After the integration is successfully removed, the AI provider section displays a Save button, and AI functionality is unavailable for your organization.