B2B multi-tenancy: the edge cases bolted-on models miss.
Who feels it
engineeringproductsecurity
What triggers the evaluation
moving upmarket to enterprise customers · the first customer demanding their own IdP · a B2B2C launch
For B2B and B2B2C companies, multi-tenancy is a category of pain in its own right. The requirements stack up fast: organization modeling, per-tenant SSO with each customer's own identity provider, SCIM provisioning, delegated administration so tenant admins manage their own users, and invitation flows for onboarding. None of these is exotic, and all of them are load-bearing once you sell to enterprises.
The problem is that many CIAM platforms bolted multi-tenancy on after being built B2C-first, and it shows in the edge cases. A user who belongs to more than one organization breaks models that assumed one user, one tenant. Enterprise customers demand their own MFA policy and their own session lifetime, which a global policy engine cannot express. Delegated administration leaks if tenant isolation was retrofitted rather than designed in.
The evaluation should probe whether the Organizations model is a primitive or a patch. Check the multi-org user, per-tenant policy, SCIM, and delegated admin directly, because these are exactly where retrofitted tenancy fails. The inbound vs outbound SSO and Organizations and tenants guides cover the mechanics, and the B2B SaaS vertical scores vendors on this axis.
How teams recognize it
- A user belongs to more than one organization and the model cannot express it
- Each enterprise customer wants its own SSO, MFA policy, and session lifetime
- SCIM provisioning and delegated admin are missing or partial
- Invitation and onboarding flows for tenant admins are an afterthought
How to evaluate vendors for this
The exact questions to put to vendors. Match each answer against the capabilities in the comparison below.
- 01Is the Organizations model first-class, or bolted onto a B2C core?
- 02Can each tenant configure its own SSO, MFA policy, and session lifetime?
- 03Do you support SCIM provisioning and delegated tenant administration?
- 04How do you handle a user who belongs to multiple organizations?
Capabilities that solve this
The vendors that cover the capabilities this pain maps to, scored on just those axes. See the full matrix on each vendor profile.
| Capability | Auth0100% covered | Authentik100% covered | Beyond Identity100% covered | Casdoor100% covered | Curity100% covered | CyberArk Identity100% covered | Descope100% covered | ForgeRock100% covered |
|---|---|---|---|---|---|---|---|---|
| Organizations / tenants | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |
| Multi-tenancy | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |
| SAML SSO | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |
| Enterprise federation | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes | ✓ Yes |