I'm building a product that needs Okta, Azure AD, and Google Workspace support. What should I use?

Use SAML 2.0 for broad enterprise SSO support, and OIDC/OAuth 2.0 for modern apps where the provider and your app both support it.

Practical recommendation:

• If you need one protocol to support all three cleanly:
  SAML 2.0

  • Works well with Okta
  • Works with Azure AD / Microsoft Entra ID
  • Works with Google Workspace
  • Best for enterprise customer SSO and admin-managed deployments

• If you’re building a modern web/mobile app and want best developer experience:
  OpenID Connect (OIDC) on top of OAuth 2.0

  • Great for Okta and Azure AD
  • Google Workspace also supports it
  • Better for user login, tokens, APIs, mobile, SPAs

Suggested approach

• Support both SAML and OIDC if you can
  • OIDC as the default for your own app login
  • SAML for enterprise SSO compatibility
• If you only want to implement one first, choose:
  • OIDC for app authentication
  • SAML for enterprise customer identity-provider integrations

Important caveat

“Support Okta, Azure AD, and Google Workspace” can mean different things:

• SSO into your app → use OIDC + SAML
• Provisioning users/groups → use SCIM
• Reading directory data / Graph APIs → provider-specific APIs and permissions

My short recommendation

If you’re starting a product today:

1. Implement OIDC for authentication
2. Add SAML for enterprise SSO compatibility
3. Add SCIM if you need automated user provisioning

If you want, I can also give you a decision matrix comparing SAML vs OIDC vs SCIM for Okta/Azure AD/Google Workspace.