diff --git a/plugins/auth-backend/src/authPlugin.ts b/plugins/auth-backend/src/authPlugin.ts
index f531ffabc6..f8e1f011b3 100644
--- a/plugins/auth-backend/src/authPlugin.ts
+++ b/plugins/auth-backend/src/authPlugin.ts
@@ -19,12 +19,39 @@ import {
   createBackendPlugin,
 } from '@backstage/backend-plugin-api';
 import {
+  AuthOwnershipResolver,
   AuthProviderFactory,
+  AuthProviderRegistrationOptions,
+  AuthProvidersExtensionPoint,
   authProvidersExtensionPoint,
 } from '@backstage/plugin-auth-node';
 import { catalogServiceRef } from '@backstage/plugin-catalog-node/alpha';
 import { createRouter } from './service/router';
 
+class AuthProvidersExtensionPointImpl implements AuthProvidersExtensionPoint {
+  #providers = new Map<string, AuthProviderFactory>();
+  #ownershipResolver?: AuthOwnershipResolver;
+  registerProvider(options: AuthProviderRegistrationOptions): void {
+    const { providerId, factory } = options;
+    if (this.#providers.has(providerId)) {
+      throw new Error(`Auth provider '${providerId}' was already registered`);
+    }
+    this.#providers.set(providerId, factory);
+  }
+
+  setAuthOwnershipResolver(ownershipResolver: AuthOwnershipResolver): void {
+    this.#ownershipResolver = ownershipResolver;
+  }
+
+  get providers() {
+    return this.#providers;
+  }
+
+  get ownershipResolver() {
+    return this.#ownershipResolver;
+  }
+}
+
 /**
  * Auth plugin
  *
@@ -33,18 +60,8 @@ import { createRouter } from './service/router';
 export const authPlugin = createBackendPlugin({
   pluginId: 'auth',
   register(reg) {
-    const providers = new Map<string, AuthProviderFactory>();
-
-    reg.registerExtensionPoint(authProvidersExtensionPoint, {
-      registerProvider({ providerId, factory }) {
-        if (providers.has(providerId)) {
-          throw new Error(
-            `Auth provider '${providerId}' was already registered`,
-          );
-        }
-        providers.set(providerId, factory);
-      },
-    });
+    const extensionPoint = new AuthProvidersExtensionPointImpl();
+    reg.registerExtensionPoint(authProvidersExtensionPoint, extensionPoint);
 
     reg.registerInit({
       deps: {
@@ -78,8 +95,9 @@ export const authPlugin = createBackendPlugin({
           auth,
           httpAuth,
           catalogApi,
-          providerFactories: Object.fromEntries(providers),
+          providerFactories: Object.fromEntries(extensionPoint.providers),
           disableDefaultProviderFactories: true,
+          ownershipResolver: extensionPoint.ownershipResolver,
         });
         httpRouter.addAuthPolicy({
           path: '/',
diff --git a/plugins/auth-node/api-report.md b/plugins/auth-node/api-report.md
index da3166d3f2..6a2e653d93 100644
--- a/plugins/auth-node/api-report.md
+++ b/plugins/auth-node/api-report.md
@@ -68,6 +68,8 @@ export interface AuthProviderRouteHandlers {
 export interface AuthProvidersExtensionPoint {
   // (undocumented)
   registerProvider(options: AuthProviderRegistrationOptions): void;
+  // (undocumented)
+  setAuthOwnershipResolver(ownershipResolver: AuthOwnershipResolver): void;
 }
 
 // @public (undocumented)
diff --git a/plugins/auth-node/src/extensions/AuthProvidersExtensionPoint.ts b/plugins/auth-node/src/extensions/AuthProvidersExtensionPoint.ts
index b67d5be017..e3396db4e0 100644
--- a/plugins/auth-node/src/extensions/AuthProvidersExtensionPoint.ts
+++ b/plugins/auth-node/src/extensions/AuthProvidersExtensionPoint.ts
@@ -15,7 +15,7 @@
  */
 
 import { createExtensionPoint } from '@backstage/backend-plugin-api';
-import { AuthProviderFactory } from '../types';
+import { AuthOwnershipResolver, AuthProviderFactory } from '../types';
 
 /** @public */
 export interface AuthProviderRegistrationOptions {
@@ -26,6 +26,7 @@ export interface AuthProviderRegistrationOptions {
 /** @public */
 export interface AuthProvidersExtensionPoint {
   registerProvider(options: AuthProviderRegistrationOptions): void;
+  setAuthOwnershipResolver(ownershipResolver: AuthOwnershipResolver): void;
 }
 
 /** @public */