I want to support SSO, MFA, and session management in a B2B app, what should I look at?

For a B2B app, the main things to look at are identity protocols, MFA support, and session controls that work well for enterprise customers.

1) SSO / enterprise identity

Support the standards your customers already use:

• SAML 2.0
  Most common for enterprise SSO with older/legacy IdPs.
• OpenID Connect (OIDC) / OAuth 2.0
  Preferred for modern apps and increasingly common for enterprise SSO.

Also look for:

• SCIM 2.0 for automated user provisioning/deprovisioning
• Just-in-time (JIT) provisioning for first-login account creation
• Support for multiple identity providers per tenant
• Domain discovery / IdP routing by email domain
• Role/attribute mapping from IdP claims to app roles

2) MFA

Even if you delegate login to the customer’s IdP, you may still want app-level MFA options.

Common MFA methods:

• TOTP authenticator apps (Google Authenticator, Authy, etc.)
• WebAuthn / passkeys / security keys
  Best security and increasingly enterprise-friendly
• Push-based MFA
• SMS is usually less preferred due to security weaknesses

Things to consider:

• Whether MFA is enforced by the customer’s IdP vs your app
• Step-up authentication for sensitive actions
• Recovery codes
• Device trust / remember-this-device support
• Support for phishing-resistant MFA, especially WebAuthn

3) Session management

Enterprise customers care a lot about control and visibility.

Look for:

• Configurable session timeout
  • idle timeout
  • absolute session lifetime
• Refresh token rotation
• Single logout / session revocation where applicable
• Ability to invalidate all sessions for a user
• Admin session termination
• Support for device/session inventory
• Clear handling of token revocation and logout across browser + API sessions
• Secure cookie settings:
  • HttpOnly
  • Secure
  • SameSite
• Support for short-lived access tokens

4) Admin / compliance features enterprises expect

• Audit logs for logins, MFA events, session activity, role changes
• Fine-grained RBAC
• Tenant isolation
• Org-level security policy enforcement
• IP allowlisting or conditional access
• SAML/OIDC metadata management
• User lifecycle management: disable user, deactivate tenant, offboard access

5) Build vs buy

If you don’t want to build all this yourself, look at identity platforms such as:

• Auth0 / Okta Customer Identity
• Microsoft Entra ID (Azure AD) integrations
• WorkOS (popular for B2B SSO + SCIM)
• Clerk, FusionAuth, Keycloak (depending on your needs)
• Firebase Auth is usually weaker for enterprise SSO/SCIM scenarios

6) A practical B2B checklist

If you’re deciding what to implement first, a strong baseline is:

• SAML + OIDC SSO
• SCIM provisioning
• TOTP + WebAuthn MFA
• Session timeout controls
• Refresh token rotation
• Audit logs
• Admin-controlled session revocation
• Multi-tenant IdP support

If you want, I can also give you:

1. a recommended architecture for B2B auth,
2. a build vs buy comparison, or
3. a feature checklist by priority for MVP vs enterprise-ready.