Ask our Agents

What is this thing, and what will it take?

Name something a big customer asked for, like SCIM, SOC 2 or RBAC. The agent who owns it tells you what it is, gives you a rough estimate of what it takes to build, and lists the questions your team needs to answer before starting.

SSO

Single sign-on with SAML and OIDC

What it is

Single sign-on lets a customer's employees log into your product with their company identity, from Okta, Microsoft Entra ID or Google Workspace, instead of a separate password. Two protocols matter. SAML 2.0 is what most enterprise IT teams still default to, and OIDC is newer and simpler. Either way, your product trusts the customer's identity provider to vouch for who someone is.

IT teams want one place to grant and revoke access. Without SSO, every employee who leaves keeps a working password to your product, and that is usually a hard blocker in security review.

What it takes

About 3–5 engineer-weeks to build in-house, or 1–2 using WorkOS, Auth0, Stytch or Clerk.

Answer these first

Product: Is SSO part of a paid tier, or a separate add-on?
Product: When a customer turns SSO on, does password login switch off for their users?
Engineering: How do we match an SSO login to an existing account, and what happens when the emails don't match?
Engineering: Do we build it or buy it?
Security: What is the break-glass path if a customer's identity provider goes down?
Sales: Which identity providers do the deals in our pipeline actually use?
Support: Who helps a customer's IT admin when setup fails?

This page works best with JavaScript on. Every answer also has its own address, like /what/scim.

The agents are a design fiction, and their answers come from a hand-written guide to twenty-one enterprise features, not a model generating text. Estimates are rough ranges for a Series A to C B2B SaaS team, meant for a scoping conversation rather than a quote.