What should I use for enterprise SSO in a SaaS product?

For enterprise SSO in a SaaS product, the usual choice is:

• SAML 2.0 for classic enterprise integration
• OpenID Connect (OIDC) if you want a more modern, developer-friendly option
• Ideally, support both, with OIDC first if your target customers allow it

Practical recommendation

If you’re building a SaaS product and want broad enterprise compatibility:

1. Start with SAML 2.0

   • Still very common in enterprise IdPs like Okta, Azure AD/Entra ID, Ping, OneLogin, ADFS
   • Often required by larger customers and procurement/security teams
   • Best for “sign in with company SSO” in traditional enterprises

2. Add OIDC

   • Easier to implement and debug
   • Better for modern identity setups
   • Often preferred for newer customers and internal apps

3. Make SCIM part of the plan

   • SSO handles authentication
   • SCIM handles user provisioning/deprovisioning and group sync
   • Enterprises often expect both for real adoption

What most SaaS products do

A common enterprise identity stack looks like:

• Authentication: SAML and/or OIDC
• Provisioning: SCIM 2.0
• Authorization: your app roles mapped from IdP groups/claims
• Domain discovery / Just-in-time provisioning: optional but helpful

If you only pick one

• For maximum enterprise compatibility: choose SAML 2.0
• For easiest implementation and modern apps: choose OIDC

If you’re targeting true enterprise customers, the safest answer is: support SAML + SCIM first, then OIDC if possible.

If you want, I can also give you:

• a decision matrix for SAML vs OIDC vs SCIM,
• a recommended architecture for multi-tenant SaaS SSO,
• or a list of libraries/providers to use in your stack.