Rolling out enterprise SSO for a B2B SaaS

Starting state

• Flat user model with no Organization concept
• SSO handled manually and painfully, one customer at a time
• No SCIM; enterprise offboarding is a manual risk

Trigger for change

• Repeated enterprise deals stalling on SSO and SCIM requirements
• Security reviews demanding per-tenant audit logs

Constraints

• Existing users and data must migrate into the org model cleanly
• SSO must be self-serve; a manual per-customer process will not scale

Architecture choice

• Introduce the Organization as the configuration boundary
• Self-serve SAML and OIDC connections routed by verified domain
• SCIM for automated provisioning and deprovisioning

Rollout plan

1. 1

   Model

   Add Organizations and migrate users into memberships.

2. 2

   SSO

   Ship self-serve SAML/OIDC connection setup with domain verification.

3. 3

   Provisioning

   Add SCIM for joiner/mover/leaver automation.

4. 4

   Audit

   Expose per-tenant audit logs and export for security reviews.

Typical outcomes

• SSO becomes a self-serve feature instead of a sales blocker
• Automated deprovisioning closes an offboarding security gap
• Per-tenant audit logs clear enterprise security reviews faster

Lessons learned

• Model the Organization first; retrofitting tenancy is the expensive path
• Self-serve SSO setup is what actually unblocks sales, not one-off connections
• SCIM deprovisioning is a security control, not just a convenience

FAQ

What unblocks enterprise deals faster, SSO or SCIM?

SSO usually comes first as the hard gate, with SCIM close behind for automated deprovisioning. Both must be self-serve and per-organization; manual per-customer setup does not scale.

Do I need to migrate existing users into an org model?

Yes. Introduce Organizations and move existing users into memberships cleanly before shipping SSO, since SSO, roles, and audit all attach to the Organization.