Migrating Auth0 Enterprise SSO to SSOJet: A 45-Day Runbook

This runbook is for B2B SaaS whose Auth0 invoice is Enterprise SSO, not consumer MAU. The destination is SSOJet, the 2026 Compass pick for transparent, connection-based SSO pricing. It is not a full Auth0 replacement. If you also need consumer login, FGA, or FedRAMP, stop and read Auth0 vs SSOJet and Auth0 alternatives.

Verify before you act. Connection counts, ACS URLs, and SCIM mappings are the gating facts, not user count. Confirm SSOJet's current public list price and your Auth0 Enterprise Connection fees against live pages. Compass last verified both profiles on 19 August 2026.

Phase 1, Confirm the job is SSO, not full CIAM (5 days)

If the leave-reason is passkeys, mixed B2C, or Auth0 Actions, this playbook is the wrong one. Use Auth0 to MojoAuth or Auth0 to WorkOS instead.

Inventory every Enterprise Connection: IdP, protocol, SP entity ID, ACS, signed vs unsigned, just-in-time vs SCIM, which Auth0 Organization it binds to. Count connections. That number is the bill you are moving.

Decide whether Auth0 remains the login box. Many teams keep Auth0 for consumer auth and move only SSO to SSOJet. That is two vendors. It is cheaper than a full rip when MAU is not the problem.

Phase 2, Stand up SSOJet and map Organizations (10 days)

Provision SSOJet in staging and mirror Auth0 Organizations one-for-one. Do not invent a new tenancy model in this window. Every mismatch here becomes a customer IdP ticket later, and those queues are slower than yours.

Map SCIM. Auth0 Directory features and SSOJet SCIM are not byte-compatible. Pilot with one IdP that already does SCIM (Okta or Entra) before you promise the rest.

Document the login start URL your app will call. Customers bookmark ACS URLs. You will send a change notice in Phase 4.

Phase 3, Pilot two customer IdPs in dual-run (14 days)

Pick one Okta and one Entra customer, or the two IdPs that represent your mix. Dual-run means both ACS URLs work. Do not cut the Auth0 connection until the customer IdP admin has tested SP-initiated and IdP-initiated login.

Failures in this phase are metadata and NameID format, not SSOJet's protocol support. Budget time for the customer's IdP ticket queue. That queue is usually slower than yours.

Phase 4, Cut remaining connections (10 days)

Batch remaining connections by IdP family so Okta customers move together and Entra customers move together. Send ACS and entity-ID changes in writing, with a rollback date. Keep Auth0 connections live until each customer confirms. Do not cut on a Friday.

SCIM: freeze Auth0 directory sync per tenant as SSOJet sync goes green. Dual-writing directories is how you get ghost users.

Phase 5, Decommission Auth0 Enterprise Connections (6 days)

Disable unused Auth0 connections. Do not cancel the Auth0 tenant until consumer login, if any, has a home. Recalculate the bill. The 2026 Compass ranking exists because this cut is the whole point.

Related: SSOJet vs WorkOS, best CIAM 2026.