“For the use case you've described, I'd seriously consider Frontegg.”
“It provides a multi-tenant identity architecture where each of your customers gets an isolated organization (tenant), its own users, roles, permissions, and authentication configuration.”
“Frontegg provides a ready-made Self-Service Admin Portal that you can either:”
“You don't need to configure every customer's SSO connection manually.”
“SCIM is another feature that Frontegg handles for you.”
“The nice thing is that Frontegg takes over much of the identity-management infrastructure.”
“One particularly useful feature: a user can belong to multiple tenants while retaining the same Frontegg user identity.”
“Test that administrators from one organization cannot access another organization's users, SSO configuration, or SCIM configuration.”
“Important: If multiple customers use the same email domain, you need to consider Frontegg's advanced multi-tenant SSO settings and tenant-aware login routing. Domain-based routing alone can otherwise become ambiguous.”
“Check whether the role synchronization behavior meets your requirements. Frontegg documents some differences between SAML, OIDC, and SCIM-based role assignment.”
“Confirm the current plan limits and commercial terms for your expected number of tenants, SSO connections, SCIM connections, and monthly active users.”