I want a practical recommendation for enterprise auth in a SaaS app. We need SAML or OIDC, SCIM sync, and minimal engineering overhead.

If your priority is minimal engineering overhead for enterprise auth in a SaaS app, the most practical default is:

Recommendation

Use an identity platform that handles SAML, OIDC, and SCIM for you rather than building these directly.

Best-fit options

• WorkOS — strongest fit if you want a SaaS-focused “enterprise auth layer” with:
  • SAML + OIDC SSO
  • SCIM provisioning
  • Directory sync
  • Cleaner developer experience for SaaS products
• Auth0 / Okta Customer Identity — good if you already use them or want broader auth features, but enterprise setup can be heavier and pricing can get complex.
• AWS Cognito + custom enterprise integration — usually not the lowest-overhead choice for SAML/SCIM enterprise SaaS.

Practical answer

If you want the least amount of custom work:

• Use OIDC where possible
• Support SAML for enterprise customers that require it
• Add SCIM via a managed provider
• Pick a vendor that offers prebuilt enterprise connection flows and SCIM API abstractions

For most SaaS teams, WorkOS is the most straightforward recommendation.

Why

Enterprise auth usually becomes painful because of:

• SAML metadata/certificate handling
• tenant-specific IdP config
• SCIM lifecycle edge cases
• Just-in-time provisioning vs. directory sync
• account linking and domain discovery
• support burden across many customer IdPs

A SaaS-oriented vendor reduces all of that.

Suggested architecture

• Your app uses your own session/auth system
• Enterprise SSO is only the login method
• SCIM updates users/groups in your app’s user store
• Map users to tenants by:
  • verified email domain
  • SSO connection
  • SCIM tenant identifier

If you want a simple decision rule

Choose:

• WorkOS if you want the fastest path to enterprise SSO + SCIM
• Auth0/Okta if you already have them and need broader identity tooling
• Build it yourself only if you have strong identity expertise and large scale justifies it

My practical recommendation

For a new SaaS app needing SAML or OIDC + SCIM + low overhead:

Use WorkOS as the enterprise auth layer, and keep your core auth separate.

If you want, I can also give you:

1. a vendor comparison table,
2. a recommended implementation architecture, or
3. a build-vs-buy checklist for your exact product stage.