Ask any security vendor four things about single sign-on: which protocol it speaks (SAML or OpenID Connect), whether it provisions users automatically with SCIM, how identity groups map to roles, and whether SSO can be enforced so password logins are switched off. A yes to "supports SSO" alone tells you very little.
Definitions in one minute
Single sign-on (SSO) lets people log in to a tool with the account your company already manages. SAML and OpenID Connect (OIDC) are two standard ways to do that handshake. SCIM is a separate standard that creates, updates and removes user accounts automatically from your identity provider. SSO handles login. SCIM handles the account lifecycle.
The questions
| Question | What a good answer includes |
|---|---|
| Which protocols are supported? | Named protocols, with setup documentation |
| Is SSO enforceable per organisation? | Option to disable local passwords |
| Is SCIM available? | Create, update and deactivate users and groups |
| How are roles assigned? | Map identity provider groups to tool roles |
| Is there a break-glass account? | A documented, logged, protected local admin |
| Which identity providers have been tested? | Named list, not "all standard providers" |
| Is SSO gated behind a higher plan? | Ask early, it affects total cost |
The last row is a procurement question, not a technical one. Ask it in the first call so it does not surprise you at renewal.
Why deprovisioning matters most
Most buyers focus on login. Auditors tend to focus on leavers. When someone departs, their access should end the same day. If the tool only supports SSO without SCIM, a former employee's account may remain active inside the tool until someone remembers to delete it, and API tokens they created may outlive their login. Ask what happens to tokens and personal access keys when a user is deactivated.
Steps to verify in a trial
- Configure SSO against a test group in your identity provider.
- Log in as a user in that group and confirm the expected role.
- Remove the user from the group and confirm access ends, and how quickly.
- Try to log in with a local password and check that enforcement blocks it.
- Check the audit log shows each of these events.
Write down the time between step 3 and loss of access. That number belongs in your evidence file.
Plan for the day the identity provider is down
Any SSO dependency is a single point of failure. Ask how the vendor expects you to recover and read our note on break-glass access when SSO is down. The break-glass path should be rare, alarmed and tested.
Quick check
Is SAML or OIDC better?
Either works. Pick the one your identity provider and team handle best, and make sure the vendor documents it clearly.
Do we need SCIM if we have SSO?
If you care about prompt leaver removal and role changes, yes. SSO alone does not remove accounts.
Can service accounts use SSO?
Usually not. Ask how machine access is issued, scoped and expired instead.
Safeguard includes agent identity and compliance evidence automation among its GA capabilities, and a free scan is at gold.safeguard.sh/scan. Ask us directly about identity provider setup details.
Last reviewed: 19 October 2026.
