“The user enters their company email and is redirected to the customer's identity provider, such as Okta or Microsoft Entra ID.”
“The user enters their company email and is redirected to the customer's identity provider, such as Okta or Microsoft Entra ID.”
“For an enterprise SaaS application, I'd recommend this setup:”
+ SCIM provisioning
“SCIM (Directory Sync): Proactively creates, updates, and deactivates users based on changes in the customer's identity provider (IdP).”
+ JIT provisioning
“JIT provisioning: Creates a user and adds them to the organization automatically when they successfully log in through SAML for the first time.”
+ Directory Sync webhook events
“WorkOS Directory Sync also provides webhook events so your application can react to directory changes.”
+ JIT enabled by default in AuthKit
“JIT is enabled by default in WorkOS AuthKit, but can be disabled in the WorkOS Dashboard.”
− JIT does not deprovision users
“Deprovisioning: Don't rely on JIT to revoke access. Use SCIM and handle directory deprovisioning events in your application.”
Google Workspace
“Okta / Microsoft Entra ID / Google Workspace”