"We'll sign as soon as you support SSO."

If you're building B2B SaaS, you'll hear this sooner or later. Usually at the worst possible moment: just as the deal is almost closed, your prospect's IT department demands enterprise-grade authentication. SAML, OIDC, SCIM provisioning. Your team has never worked with it.

I've done 4 SSO implementations, from ABN AMRO to SaaS scale-ups. I'm Microsoft Certified: Identity and Access Administrator Associate (SC-300). Here's what I tell founders.

It's more complex than you think

SSO sounds simple: "login via the customer's Azure AD." In reality, you need to account for:

  • Multiple identity providers: one customer runs Entra ID, another runs Okta
  • User provisioning and deprovisioning (SCIM): when someone leaves the company, access must stop immediately
  • Tenant isolation: each customer gets their own configuration, without seeing each other's data
  • Migrating existing users to SSO without forcing them to re-register

What it costs you to postpone

Without SSO, enterprise customers simply block the deal in their security review. Your sales cycle slows down, your pipeline stalls, and you lose momentum with prospects who actually want to use your product.

Meanwhile, your competitor is building it.

Build it yourself or use a platform?

Platforms like Auth0 or WorkOS can be a good start. But as soon as you hit edge cases (ADFS, custom claims, non-standard SCIM implementations) you still need to understand how the protocols themselves work.

At that point, you need someone who understands the protocol, not just the SDK.

How I approach it

For a typical SaaS client, I work in phases towards a complete SSO integration:

  • Week 1-3: Assessment, architecture and tenant model. First IdP connection (Entra ID or Okta) working in a test environment.
  • Week 4-6: SCIM provisioning, migration strategy for existing users, first production connection with a pilot customer.
  • Week 7-9: Second IdP, hardening, edge cases, testing together with the customer.
  • Week 10-12: Documentation, handover to your team, guidance during the first independent onboarding of a new customer IdP.

The exact pace depends on your product and the complexity of your user model. But after completion, your team can independently onboard new customer IdPs.

The result

Your prospect gets enterprise-grade security. Your sales cycle speeds up. And your team doesn't have to spend months wrestling with a spec they don't know.