AD FS
Microsoft Entra ID
OneLogin
Auth0
JumpCloud
Okta
PingFederate
Primary research — in the users' own words
Hard to get an access to the enterprise customers. Was on presales and support channel calls to get the insights. Below are the quotes from the calls. Including some interviews with internal customer engineers.
🚧 Theme 1 — "We'll just give them a different environment"
The absence of multi-tenant SSO wasn't costing us features. It was costing us infrastructure, margin and credibility — because the field had invented a workaround and normalised it.
"It has been agreed internally that we will provide them ST instance despite them being a MT customer as a temporary measure to bypass SSO requirement."
What it told me: we were provisioning an entire dedicated environment as a substitute for one settings screen. The cost of the missing feature was being paid in infrastructure, not in the backlog.
"Is SSO available for Commercial (MT) customers or only Enterprise? What security tools exist without SSO — IP whitelisting, password requirements?"
What it told me: our own sellers couldn't state our security posture. Entitlement clarity is a design deliverable, not a pricing-page footnote.
👥 Theme 2 — Nobody could explain how access actually syncs
Group mapping questions were never "how do I create one?". They were always about the invisible rules: is it required, when does it apply, what happens to people already in the group.
Whether group mapping was required, whether groups auto-created themselves, and when membership actually synced were all left to guesswork — the documentation described the mechanism but never the defaults.
What it told me: three reasonable assumptions, all wrong at once. Mapping is optional, groups are not auto-created, and sync is not immediate — none of it said out loud.
Whether SAML group mapping was even supported wasn't something the team could always confirm without checking with engineering first.
What it told me: when internal teams have to ask engineering whether a shipped feature exists, the capability story is broken before it ever reaches a customer.
🤖 Theme 3 — Machines have no identity
The most commercially expensive theme in the log. Every quote here is attached to an enterprise account with a signed contract or an active go-live date.
"[The customer] cannot use long-lived opaque tokens due to internal security policy. Their IdP issues the token, or they don't integrate."
What it told me: this is not a feature request, it's a policy wall. No amount of UX makes a forbidden credential acceptable. Design response: validate JWTs issued by their IdP — we stop being the issuer.
"[They] would not go live without a service account feature. The workaround — create an account with a group email ID — was rejected, since their login is via SSO only."
What it told me: we kept conflating login with API access. The answer was never "let a faceless account log in" — it was a non-human identity that never logs in at all.
"As an admin, [we need to] programmatically CREATE / UPDATE / DELETE API tokens to automate provisioning."
What it told me: at enterprise scale, credential management is itself automated. A UI-only token screen isn't a smaller version of the feature — it's the wrong shape entirely.
