Can you help me choose the right SSO approach for a B2B app that needs Okta and Azure AD support?

Yes — for a B2B app that must support both Okta and Azure AD (Microsoft Entra ID), the best choice is usually:

Recommended approach: SAML 2.0 + OIDC where possible, with a flexible identity layer

If you need maximum enterprise compatibility, make your app’s auth layer support:

• SAML 2.0 for broad enterprise IdP compatibility
• OIDC / OAuth 2.0 for modern integrations and better developer UX
• A tenant-based setup where each customer can configure their own IdP

If you want a single default recommendation:

• Use OIDC as the primary protocol for new enterprise customers
• Keep SAML support available for customers who require it

---

Why this is usually the right fit

Okta

• Supports both SAML and OIDC
• Many enterprise customers already use Okta as their IdP or via federation
• OIDC is simpler for token-based app flows
• SAML is still common in enterprise procurement and IT-managed SSO setups

Azure AD / Entra ID

• Supports both SAML and OIDC
• OIDC is often easiest for modern SaaS apps
• Microsoft ecosystems often prefer OIDC for application sign-in, but SAML is still widely used in enterprise SSO

---

How to decide between SAML and OIDC

Choose OIDC if:

• You’re building a modern SaaS app
• You want simpler implementation and token handling
• You need API access + SSO in the same model
• You want better mobile/browser/app support
• You expect most customers to be able to configure a standard enterprise app integration

Choose SAML if:

• You need to support older enterprise workflows
• Your target customers expect classic “enterprise SSO” integrations
• You’re integrating with many IdPs and want maximum compatibility
• Your customers’ IT teams are more comfortable with SAML app setups

---

Practical recommendation for a B2B SaaS product

Best architecture

1. Support both SAML and OIDC at the app boundary
2. Normalize identities internally to your own user model
3. Allow one IdP per tenant initially, then expand to multiple if needed
4. Support:
   • email domain discovery
   • IdP-initiated and SP-initiated flows (depending on protocol)
   • Just-In-Time (JIT) provisioning or SCIM for user lifecycle management

If you want to minimize implementation complexity

• Start with OIDC first
• Add SAML if enterprise demand requires it

If you want to maximize sales compatibility from day one

• Implement an identity broker / abstraction layer
• Use something like:
  • Auth0 / Okta Customer Identity
  • Azure AD B2C if Microsoft-heavy, though this is less IdP-agnostic
  • Keycloak
  • Custom federation layer if you have strong IAM expertise

---

What to ask your customers

To choose the right integration mode per tenant, ask:

1. Which IdP do you use?

   • Okta
   • Azure AD / Entra ID
   • Other

2. Which protocols do you allow?

   • SAML
   • OIDC
   • Both

3. Do you require SCIM provisioning?

   • Important for enterprise user lifecycle management

4. Do you need MFA / conditional access enforced by the IdP?

   • Usually yes

5. Do you need group/role claims?

   • If yes, plan claim mapping carefully

---

My default recommendation

For most B2B apps:

• Primary: OIDC
• Enterprise fallback/support: SAML
• Provisioning: SCIM
• Tenant-level IdP configuration: yes
• Internal auth abstraction: yes

---

If you want, I can also help you with one of these next:

1. a decision matrix for SAML vs OIDC vs brokered auth,
2. a reference architecture for Okta + Azure AD,
3. or a recommended implementation stack for your backend/frontend.