I’m building an internal tool and need access control plus SSO, what should I use?

If you need access control + SSO for an internal tool, the usual best choice is:

Recommended approach

Use an identity provider (IdP) for authentication/SSO, and add application-level authorization for access control.

Common IdP options

• Okta – strong enterprise SSO, groups, SCIM, good admin controls
• Microsoft Entra ID (Azure AD) – best if your org is on Microsoft 365 / Azure
• Google Workspace / Cloud Identity – simple if you’re Google-heavy
• Auth0 – good developer experience, flexible, more app-focused
• Keycloak – open source, self-hosted, good if you want control/cost savings

What to use for each part

1) SSO / authentication

Use OIDC (OpenID Connect) if possible.
It’s the modern default for web apps.

2) Access control / authorization

Implement one of these:

• RBAC (role-based access control): admin, manager, viewer
• Group-based access: map IdP groups to app permissions
• ABAC if you need more dynamic rules later

Best practical choices by scenario

If you want fastest enterprise-ready setup

• Okta + OIDC + group-based RBAC

If your company uses Microsoft

• Entra ID + OIDC/SAML + app roles/groups

If you want open source and self-hosted

• Keycloak + OIDC + realm roles/groups

If you’re building a SaaS-like internal platform or want developer-friendly auth

• Auth0 + OIDC + RBAC

My general recommendation

For most internal tools:

• Authenticate with OIDC via your company IdP
• Authorize inside the app using roles/groups from the IdP
• Don’t build passwords yourself unless you absolutely must

Things to avoid

• Building your own login system from scratch
• Using only SAML unless your environment forces it
• Putting all authorization in the IdP if your app has fine-grained permissions needs

If you tell me:

1. your stack,
2. whether you’re on Google/Microsoft/Okta,
3. whether you want self-hosted or managed,

I can recommend a specific setup and implementation path.