[SOLAR_FIELDS]

Most SaaS companies will tell you that they would rather not lock this important security feature behind enterprise. But the reality is that it is one of the few things enterprise will pay for and gate on and as such it’s become very effective as a differentiator. The edict to gate everything behind SSO is powerful in large enterprises and as such they will absolutely pay to be able to do that, making it a very easy internal sales tactic. The market has spoken, for better or worse.

[mlhpdx]

I read your comment as saying that SSO is denied to “regular” (non-enterprise) customers because enterprise customers would buy the regular product if it was included there, thus pointing out that all the other “enterprise” needs (terms, etc) aren’t real?

[wongarsu]

Most enterprise features are nice-to-haves. SSO is a must-have for companies with enough security or compliance ceremony, which includes most enterprises.

[coding123]

Small companies don't need sso because when an employee leaves, they just go into all their sass and remove the user or change the password. A large company can't work without SSO because in an org with hundreds of users they can't login to each SASS and disable and enable everyone coming and going at the company, which is many per month in some cases.

[fullspectrumdev]

If smaller/early stage shops adopt SSO and other sensible practices early on, it makes scaling easier and cheaper in the long run.

I’ve gone through a few “migrations to SSO” after years of non-SSO with customers in the past and it’s a fucking expensive nightmare.

[nlitened]

> I’ve gone through a few “migrations to SSO” after years of non-SSO with customers in the past and it’s a fucking expensive nightmare.

Yet the customers still paid, so it was worth for them.

[Terretta]

> Small companies don't need SSO

This is incorrect.

[TeMPOraL]

This is very much correct, and quite self-evident: they live without, therefore they don't need it. Wanting something != needing it. Companies that actually need SSO are the ones that have internal or external compliance requirements, and/or for which managing users without SSO becomes prohibitively expensive. Turns out, at that point, they're willing to pay through the roof for it.

[Terretta]

> quite self-evident: they live without, therefore they don't need it

Lots of people live without things others observe they need. Doesn't make going without a good idea.

> Companies that actually need SSO are the ones that have internal or external compliance requirements...

This logic is backwards.

Why do you think SSO is a "requirement" that security certifications or compliance policies look for? Why did that come to be? Who does SSO benefit? Are those personas relevant for only large companies or small ones too?

Do beginning drivers not “need” seatbelts or brakes? Or are these devices only needed to avoid tickets and pass inspection?

[SOLAR_FIELDS]

One thing worth pointing out. If you don’t mind using GitHub or Google you can get “SSO at home” for a lot of things, since most SaaS provide Google/Github login in their lower priced tiers. It will usually be OIDC based and not SAML, but it’s definitely possible to use these providers up to a quite significant scale.

[0x457]

Why? You use SSO in your personal life all the time. Why would you not want to continue doing so in your business?

If anything, small companies need SSO more than any others - those companies usually outsource a lot (SaaS vs a dedicated hire), managing credentials is annoying.

[Terretta]

So we agree that small companies do need it.

[mlhpdx]

Yep, just like people don’t need healthcare.

[kccqzy]

Depends on the definition of "small" which I take to mean early stage startups.

[Too]

SSO has lots of other benefits. MFA primarily. This is non negotiable these days, even for the smallest company. I’ve not seen many services supporting this without SSO.

Don’t get me started on the services that have their own smart ideas on what constitutes a safe password. Max 8 characters with no repeated letters and of which 4 must be an emoji, with automatic logout every 12 minutes. Yes those still exist.

Password policies are things you want control over in your IdP to avoid all this BS. SSO really should be standard.

[TeMPOraL]

> This is non negotiable these days, even for the smallest company.

Says who?

In reality, users don't care. Regulators, however, sometimes do, which leads to certifications and compliance requirements - and only then SSO and MFA become non-negotiable.

[cjcampbell]

I work with a variety of small companies (5-25 FTEs) that are increasingly facing strict MFA requirements in order to maintain insurance. SSO isn’t an explicit requirement, but there are a myriad of general access requirements that they struggle to follow without some level of centralization via federated identity/SSO.

[Terretta]

So add a cost to regular pricing as a checkbox, and let people not talk to you.

[OptionOfT]

As a company, I much rather not deal with passwords, MFA, and password/MFA-reset procedures. That costs money to develop and maintain.

Storing ClientID and ClientSecret for OpenID, or some keys for SAML per customer is much easier, and a lot less risky.

After all, I'm in the business of solving (insert SaaS problem), not in the business of solving authentication.