{ "name": "Identity Integration and Compatibility Matrix", "publisher": "Start with Identity", "url": "https://startwithidentity.com/tools/integration-matrix/", "license": "CC BY 4.0", "count": 20, "statuses": [ "yes", "partial", "no", "unknown" ], "columns": { "workforce": [ { "id": "aws", "label": "AWS (IAM Identity Center or IAM SAML)", "section": "Clouds" }, { "id": "azure", "label": "Microsoft Azure / Entra ID as a target", "section": "Clouds" }, { "id": "gcp", "label": "Google Cloud (Workforce Identity Federation)", "section": "Clouds" }, { "id": "workday", "label": "Workday", "section": "HR sources" }, { "id": "successfactors", "label": "SAP SuccessFactors", "section": "HR sources" }, { "id": "bamboohr", "label": "BambooHR", "section": "HR sources" }, { "id": "rippling", "label": "Rippling", "section": "HR sources" }, { "id": "ukg", "label": "UKG", "section": "HR sources" }, { "id": "m365", "label": "Microsoft 365", "section": "SaaS targets" }, { "id": "google_workspace", "label": "Google Workspace", "section": "SaaS targets" }, { "id": "salesforce", "label": "Salesforce", "section": "SaaS targets" }, { "id": "slack", "label": "Slack", "section": "SaaS targets" }, { "id": "github", "label": "GitHub", "section": "SaaS targets" }, { "id": "atlassian", "label": "Atlassian Cloud", "section": "SaaS targets" }, { "id": "servicenow", "label": "ServiceNow", "section": "SaaS targets" }, { "id": "zoom", "label": "Zoom", "section": "SaaS targets" }, { "id": "active_directory", "label": "Active Directory (agent or sync)", "section": "Legacy and on-prem" }, { "id": "ldap", "label": "LDAP", "section": "Legacy and on-prem" }, { "id": "kerberos_iwa", "label": "Kerberos / IWA desktop SSO", "section": "Legacy and on-prem" }, { "id": "radius", "label": "RADIUS (VPN, network)", "section": "Legacy and on-prem" }, { "id": "header_based", "label": "Header-based apps", "section": "Legacy and on-prem" }, { "id": "onprem_saml_wsfed", "label": "On-prem SAML / WS-Fed apps (AD FS replacement)", "section": "Legacy and on-prem" }, { "id": "saml", "label": "SAML 2.0", "section": "Protocols as IdP" }, { "id": "oidc", "label": "OpenID Connect", "section": "Protocols as IdP" }, { "id": "ws_fed", "label": "WS-Federation", "section": "Protocols as IdP" }, { "id": "scim_outbound", "label": "SCIM 2.0 outbound provisioning", "section": "Protocols as IdP" }, { "id": "scim_inbound", "label": "Inbound SCIM (SCIM server)", "section": "Protocols as IdP" }, { "id": "ssf_caep", "label": "Shared Signals / CAEP", "section": "Protocols as IdP" } ], "itdr-iga": [ { "id": "src_okta", "label": "Okta", "section": "Identity sources" }, { "id": "src_entra", "label": "Microsoft Entra ID", "section": "Identity sources" }, { "id": "src_ad", "label": "Active Directory", "section": "Identity sources" }, { "id": "src_ping", "label": "Ping Identity", "section": "Identity sources" }, { "id": "src_google", "label": "Google Workspace", "section": "Identity sources" }, { "id": "src_aws_iam", "label": "AWS IAM", "section": "Identity sources" }, { "id": "src_azure_rbac", "label": "Azure RBAC", "section": "Identity sources" }, { "id": "src_gcp_iam", "label": "Google Cloud IAM", "section": "Identity sources" }, { "id": "workday", "label": "Workday", "section": "HR sources" }, { "id": "successfactors", "label": "SAP SuccessFactors", "section": "HR sources" }, { "id": "bamboohr", "label": "BambooHR", "section": "HR sources" }, { "id": "rippling", "label": "Rippling", "section": "HR sources" }, { "id": "ukg", "label": "UKG", "section": "HR sources" } ] }, "platforms": [ { "slug": "c1", "name": "C1 (formerly ConductorOne)", "vendor": "C1", "group": "itdr-iga", "type": "iga", "swi_vendor": "iga/conductorone", "summary": "C1 is an identity governance platform that syncs accounts and entitlements through cloud-hosted or self-hosted Baton connectors. One or more IdP or HRIS connectors can be set as the directory that creates C1 users.", "catalog_url": "https://www.c1.ai/docs/baton/capabilities", "cells": { "src_okta": { "status": "yes", "note": "users, groups, apps, admin roles; provisioning", "url": "https://www.c1.ai/docs/baton/okta", "checked_on": "2026-11-05" }, "src_entra": { "status": "yes", "note": "users, groups, enterprise apps, directory roles; provisioning", "url": "https://www.c1.ai/docs/baton/microsoft-entra", "checked_on": "2026-11-05" }, "src_ad": { "status": "yes", "note": "self-hosted Windows service; users, groups, gMSAs", "url": "https://www.c1.ai/docs/baton/active-directory", "checked_on": "2026-11-05" }, "src_ping": { "status": "yes", "note": "PingOne accounts, groups, populations, roles; separate PingFederate connector", "url": "https://www.c1.ai/docs/baton/ping-one", "checked_on": "2026-11-05" }, "src_google": { "status": "yes", "note": "Google Workspace users, groups, roles; provisioning", "url": "https://www.c1.ai/docs/baton/google-workspace", "checked_on": "2026-11-05" }, "src_aws_iam": { "status": "yes", "note": "IAM users, roles, policies and Identity Center permission sets", "url": "https://www.c1.ai/docs/baton/aws", "checked_on": "2026-11-05" }, "src_azure_rbac": { "status": "yes", "note": "Azure roles on management groups, subscriptions, resource groups", "url": "https://www.c1.ai/docs/baton/azure", "checked_on": "2026-11-05" }, "src_gcp_iam": { "status": "yes", "note": "IAM policy bindings on org, folders, projects", "url": "https://www.c1.ai/docs/baton/google-cloud-platform", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "Workday connector; docs name Workday as an HRIS directory", "url": "https://www.c1.ai/docs/product/admin/directory", "checked_on": "2026-11-05" }, "successfactors": { "status": "partial", "note": "OData connector syncs users and profile fields; directory use not documented", "url": "https://www.c1.ai/docs/baton/successfactors-odata", "checked_on": "2026-11-05" }, "bamboohr": { "status": "yes", "note": "syncs employees, status, manager; docs name BambooHR as an HRIS directory", "url": "https://www.c1.ai/docs/product/admin/directory", "checked_on": "2026-11-05" }, "rippling": { "status": "partial", "note": "syncs accounts and worker fields; directory use not documented", "url": "https://www.c1.ai/docs/baton/rippling", "checked_on": "2026-11-05" }, "ukg": { "status": "partial", "note": "UKG Pro accounts and roles; directory use not documented", "url": "https://www.c1.ai/docs/baton/ukg", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "crowdstrike-falcon-identity-protection", "name": "CrowdStrike Falcon Identity Protection", "vendor": "CrowdStrike", "group": "itdr-iga", "type": "itdr", "swi_vendor": "itdr/crowdstrike-falcon-identity", "summary": "Identity threat detection and response module of the CrowdStrike Falcon platform. It monitors on-prem Active Directory through domain controller sensors and connects to cloud identity providers such as Entra ID, Okta and Ping; SaaS coverage comes from the separate Falcon Shield module.", "catalog_url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "cells": { "src_okta": { "status": "yes", "note": "Okta listed as a protected cloud identity provider", "url": "https://www.crowdstrike.com/en-us/platform/next-gen-identity-security/identity-protection/", "checked_on": "2026-11-05" }, "src_entra": { "status": "yes", "note": "Entra ID listed as a protected cloud identity provider", "url": "https://www.crowdstrike.com/en-us/platform/next-gen-identity-security/identity-protection/", "checked_on": "2026-11-05" }, "src_ad": { "status": "yes", "note": "on-prem Active Directory via Falcon sensor on domain controllers", "url": "https://www.crowdstrike.com/en-us/platform/next-gen-identity-security/identity-protection/", "checked_on": "2026-11-05" }, "src_ping": { "status": "yes", "note": "Ping in identity provider risk assessment; PingFederate and PingID integrations in 2024 data sheet", "url": "https://www.crowdstrike.com/content/dam/crowdstrike/marketing/en-us/documents/pdfs/data-sheets/falcon-next-gen-identity-security-data-sheet.pdf", "checked_on": "2026-11-05" }, "src_google": { "status": "partial", "note": "Google Workspace listed only as a Falcon Shield (SaaS security) integration, separate module", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "src_aws_iam": { "status": "yes", "note": "AWS IAM Identity Center via Falcon cloud connector", "url": "https://www.crowdstrike.com/en-us/blog/announcing-protection-aws-iam-identity-center/", "checked_on": "2026-11-05" }, "src_azure_rbac": { "status": "unknown", "note": "not documented for Identity Protection; Azure coverage sits in Falcon Cloud Security", "url": null, "checked_on": "2026-11-05" }, "src_gcp_iam": { "status": "partial", "note": "GCP listed only as a Falcon Shield (SaaS security) integration; IAM policy ingestion not documented", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "workday": { "status": "partial", "note": "Falcon Shield posture integration only, not an HR identity source", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "successfactors": { "status": "partial", "note": "Falcon Shield posture integration only, not an HR identity source", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "bamboohr": { "status": "partial", "note": "Falcon Shield posture integration only, not an HR identity source", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "not in Falcon Shield integration list", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "not in Falcon Shield integration list", "url": "https://www.crowdstrike.com/platform/falcon-shield/integrations/", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "microsoft-defender-for-identity", "name": "Microsoft Defender for Identity", "vendor": "Microsoft", "group": "itdr-iga", "type": "itdr", "swi_vendor": "itdr/microsoft-defender-identity", "summary": "Microsoft identity threat detection and response product in the Defender portal. Sensors on domain controllers, AD FS, AD CS and Entra Connect servers watch on-prem AD; API connectors bring in Entra ID and Okta, and Defender for Cloud Apps feeds SaaS accounts into the shared identity inventory.", "catalog_url": null, "cells": { "src_okta": { "status": "yes", "note": "Okta connector: users in identity inventory, Okta alerts, posture recommendations, remediation (revoke sessions, deactivate)", "url": "https://learn.microsoft.com/en-us/defender-for-identity/okta-defender-for-identity-overview", "checked_on": "2026-11-05" }, "src_entra": { "status": "yes", "note": "Native Entra ID connector: cloud and hybrid identities, sign-in hunting, risk insights; Entra ID Protection is a separate product", "url": "https://learn.microsoft.com/en-us/defender-for-identity/what-is", "checked_on": "2026-11-05" }, "src_ad": { "status": "yes", "note": "Sensors on domain controllers, AD FS, AD CS and Entra Connect servers", "url": "https://learn.microsoft.com/en-us/defender-for-identity/what-is", "checked_on": "2026-11-05" }, "src_ping": { "status": "partial", "note": "PingOne posture recommendations (ISPM) only; no ingestion connector page found", "url": "https://learn.microsoft.com/en-us/defender-xdr/identity-security/identity-security-recommendations", "checked_on": "2026-11-05" }, "src_google": { "status": "partial", "note": "Google Workspace OAuth apps in identity inventory (preview) via Defender for Cloud Apps connector, not an MDI connector", "url": "https://learn.microsoft.com/en-us/defender-for-identity/identity-inventory", "checked_on": "2026-11-05" }, "src_aws_iam": { "status": "unknown", "note": "MDI docs silent on AWS IAM; Defender for Cloud Apps and Defender for Cloud cover AWS separately (not verified)", "url": "https://learn.microsoft.com/en-us/defender-for-identity/identity-inventory", "checked_on": "2026-11-05" }, "src_azure_rbac": { "status": "unknown", "note": "MDI docs silent on Azure role assignments", "url": "https://learn.microsoft.com/en-us/defender-for-identity/identity-inventory", "checked_on": "2026-11-05" }, "src_gcp_iam": { "status": "unknown", "note": "MDI docs silent on Google Cloud IAM", "url": "https://learn.microsoft.com/en-us/defender-for-identity/identity-inventory", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "No HR connector found in MDI docs", "url": "https://learn.microsoft.com/en-us/defender-for-identity/whats-new", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "No HR connector found in MDI docs", "url": "https://learn.microsoft.com/en-us/defender-for-identity/whats-new", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "No HR connector found in MDI docs", "url": "https://learn.microsoft.com/en-us/defender-for-identity/whats-new", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "No HR connector found in MDI docs", "url": "https://learn.microsoft.com/en-us/defender-for-identity/whats-new", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "No HR connector found in MDI docs", "url": "https://learn.microsoft.com/en-us/defender-for-identity/whats-new", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "sailpoint", "name": "SailPoint Identity Security Cloud", "vendor": "SailPoint", "group": "itdr-iga", "type": "iga", "swi_vendor": "iga/sailpoint", "summary": "SailPoint Identity Security Cloud is a SaaS identity governance platform. It aggregates identities and entitlements from directories, cloud platforms and HR systems through SaaS and virtual appliance (VA) connectors.", "catalog_url": "https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/isc_landing.html", "cells": { "src_okta": { "status": "yes", "note": "Okta SaaS and VA connectors; Okta CIEM settings", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/okta/help/saas_connectivity/okta/integrating_sailpoint_with_okta_saas.html" }, "src_entra": { "status": "yes", "note": "Microsoft Entra SaaS connector, users and groups via Graph", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/msentraid/help/saas_connectivity/microsoft_entra_id/integrating_sailpoint_microsoft_entra_id.html" }, "src_ad": { "status": "yes", "note": "VA connector, multi-domain and forest", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/active_directory/help/integrating_active_directory/intro.html" }, "src_ping": { "status": "yes", "note": "PingOne SaaS connector with aggregation and provisioning; PingFederate not listed", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/pingone/help/saas_connectivity/pingone/integrating_sailpoint_pingone.html" }, "src_google": { "status": "yes", "note": "Google Workspace SaaS connector, accounts, groups and roles", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/googleworkspace/help/saas_connectivity/google_workspace/introduction.html" }, "src_aws_iam": { "status": "yes", "note": "AWS connector, policy discovery across organization accounts; CIEM license for effective access", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/aws/help/saas_connectivity/aws/introduction.html" }, "src_azure_rbac": { "status": "yes", "note": "Entra SaaS connector CIEM settings cover subscriptions and role assignments; CIEM license", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/msentraid/help/saas_connectivity/microsoft_entra_id/ciem_settings.html" }, "src_gcp_iam": { "status": "yes", "note": "Google Workspace connector manages GCP IAM; CIEM GCP source, CIEM license", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/saas/help/ciem/gcp/connect_gcp.html" }, "workday": { "status": "yes", "note": "Workday SaaS connector, joiner, mover and leaver", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/workday/help/saas_connectivity/workday/integrating_sailpoint_workday.html" }, "successfactors": { "status": "yes", "note": "SuccessFactors SaaS connector as identity source or managed resource", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/successfactors/help/saas_connectivity/successfactors/intro.html" }, "bamboohr": { "status": "yes", "note": "BambooHR SaaS connector, aggregates active and inactive employees, update only", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/bamboohr/help/saas_connectivity/bamboohr/supported_features.html" }, "rippling": { "status": "unknown", "note": "not in connector lists checked", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/isc/landingpages/help/landingpages/deep_governance.html" }, "ukg": { "status": "yes", "note": "UKG Pro Core HCM connector, future hires and terminations aggregation", "checked_on": "2026-11-05", "url": "https://documentation.sailpoint.com/connectors/saas/ukg_pro/help/saas_connectivity/ukg_pro_core_hcm/supported_features.html" } }, "verified_on": "2026-11-05" }, { "slug": "saviynt", "name": "Saviynt Identity Cloud", "vendor": "Saviynt", "group": "itdr-iga", "type": "iga", "swi_vendor": "iga/saviynt", "summary": "Saviynt Identity Cloud (Enterprise Identity Cloud) is a SaaS identity governance platform. Its Saviynt Exchange catalog lists Saviynt-developed and community-built connectors for directories, cloud platforms and HR systems.", "catalog_url": "https://exchange.saviynt.com/", "cells": { "src_okta": { "status": "yes", "note": "Saviynt-developed connector, import, provisioning and group lifecycle", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/okta" }, "src_entra": { "status": "yes", "note": "Saviynt-developed connector, groups, directory roles and app roles", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/entraid" }, "src_ad": { "status": "yes", "note": "Saviynt-developed connector, import and provisioning", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/ad" }, "src_ping": { "status": "partial", "note": "PingOne community-built connector; PingFederate listed for SSO only", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/pingone" }, "src_google": { "status": "yes", "note": "Saviynt-developed connector, users, groups and OUs", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/google-apps" }, "src_aws_iam": { "status": "yes", "note": "AWS connector imports IAM users, roles, groups and policies; IAM Identity Center connector early access", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/aws" }, "src_azure_rbac": { "status": "yes", "note": "Azure connector manages access to subscriptions and resource groups", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/azure" }, "src_gcp_iam": { "status": "yes", "note": "GCP connector imports projects, folders, roles and groups", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/gcp" }, "workday": { "status": "yes", "note": "Saviynt-developed connector, user import and provisioning", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/workday" }, "successfactors": { "status": "yes", "note": "HR source for user reconciliation with attribute writeback", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/successfactors" }, "bamboohr": { "status": "partial", "note": "community-built REST connector, full user import only", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/bamboohr" }, "rippling": { "status": "partial", "note": "community-built REST connector, full user import only", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/rippling" }, "ukg": { "status": "partial", "note": "UltiPro connector, full user import only, no provisioning", "checked_on": "2026-11-05", "url": "https://exchange.saviynt.com/products/ultipro" } }, "verified_on": "2026-11-05" }, { "slug": "silverfort", "name": "Silverfort Identity Security Platform", "vendor": "Silverfort", "group": "itdr-iga", "type": "itdr", "swi_vendor": "itdr/silverfort", "summary": "Identity security platform that sits inline in authentication flows, with native Active Directory integration and API integrations with cloud identity providers such as Entra ID, Okta and Ping for risk analysis and MFA. It also discovers non-human identities and AI agents in AWS, Azure and GCP through read-only APIs.", "catalog_url": null, "cells": { "src_okta": { "status": "yes", "note": "API integration; Okta forwards access requests for risk analysis and MFA", "url": "https://www.silverfort.com/wp-content/uploads/2025/07/Silverfort-and-Okta-integration.pdf", "checked_on": "2026-11-05" }, "src_entra": { "status": "yes", "note": "native Entra ID integration extending MFA and Conditional Access", "url": "https://www.silverfort.com/resources/silverfort-microsoft-azure-ad-extending-azure-mfa-to-unprotected-systems/", "checked_on": "2026-11-05" }, "src_ad": { "status": "yes", "note": "native inline AD integration (Kerberos, NTLM, LDAP)", "url": "https://www.silverfort.com/wp-content/uploads/2025/07/Silverfort-and-Okta-integration.pdf", "checked_on": "2026-11-05" }, "src_ping": { "status": "yes", "note": "Ping forwards federated and cloud app requests to Silverfort; PingID MFA", "url": "https://go.silverfort.com/hubfs/Solution%20Briefs/silverfort-and-ping-one-pager.pdf", "checked_on": "2026-11-05" }, "src_google": { "status": "unknown", "note": "Google Workspace not documented on public pages", "url": null, "checked_on": "2026-11-05" }, "src_aws_iam": { "status": "partial", "note": "AWS NHI and AI agent discovery via read-only API, incl. IAM roles", "url": "https://www.silverfort.com/press-news/silverfort-expands-its-non-human-identity-nhi-security-offering/", "checked_on": "2026-11-05" }, "src_azure_rbac": { "status": "partial", "note": "Azure AI agent discovery via read-only API; role assignment ingestion not documented", "url": "https://www.silverfort.com/platform/ai-agent-security/", "checked_on": "2026-11-05" }, "src_gcp_iam": { "status": "partial", "note": "GCP AI agent discovery via read-only API; IAM policy ingestion not documented", "url": "https://www.silverfort.com/platform/ai-agent-security/", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "no HR connector on public pages; docs.silverfort.com is login-walled", "url": null, "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "no HR connector on public pages; docs.silverfort.com is login-walled", "url": null, "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "no HR connector on public pages; docs.silverfort.com is login-walled", "url": null, "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "no HR connector on public pages; docs.silverfort.com is login-walled", "url": null, "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "no HR connector on public pages; docs.silverfort.com is login-walled", "url": null, "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "veza", "name": "Veza Access Platform", "vendor": "Veza", "group": "itdr-iga", "type": "iga", "swi_vendor": "iga/veza", "summary": "Veza is an identity security and governance platform that builds an access graph from read-only API connectors to identity providers, cloud IAM, HR systems and SaaS apps. Its Lifecycle Management module uses HR and IdP sources to drive provisioning.", "catalog_url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations", "cells": { "src_okta": { "status": "yes", "note": "users, groups, apps, admin roles; system log for activity", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/okta", "checked_on": "2026-11-05" }, "src_entra": { "status": "yes", "note": "Entra ID users, groups, roles via Microsoft Graph", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/azure", "checked_on": "2026-11-05" }, "src_ad": { "status": "yes", "note": "users, groups, OUs, GPOs over LDAPS via Insight Point", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/active-directory", "checked_on": "2026-11-05" }, "src_ping": { "status": "yes", "note": "PingOne users, groups, roles, apps; PingFederate not listed", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/ping-identity", "checked_on": "2026-11-05" }, "src_google": { "status": "yes", "note": "Google Workspace users and groups", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/google", "checked_on": "2026-11-05" }, "src_aws_iam": { "status": "yes", "note": "IAM users, roles, policies, SCPs and IAM Identity Center", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/aws", "checked_on": "2026-11-05" }, "src_azure_rbac": { "status": "yes", "note": "Azure Role Assignment entities; Reader on each subscription", "url": "https://veza.com/blog/veza-product-updates-february-2024/", "checked_on": "2026-11-05" }, "src_gcp_iam": { "status": "yes", "note": "IAM policies on org, folders, projects", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/google", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "Workday workers as Lifecycle Management source, email write-back", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/workday", "checked_on": "2026-11-05" }, "successfactors": { "status": "yes", "note": "HRIS template syncs employees for Lifecycle Management", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/success-factors", "checked_on": "2026-11-05" }, "bamboohr": { "status": "partial", "note": "discovers employees and attributes; not listed as Lifecycle Management source", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/bamboohr", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "not listed in integrations catalog", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations", "checked_on": "2026-11-05" }, "ukg": { "status": "yes", "note": "UKG Pro employees as Lifecycle Management source", "url": "https://docs.veza.com/4yItIzMvkpAvMVFAamTf/integrations/integrations/ukgpro", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "authentik", "name": "authentik", "vendor": "Authentik Security", "group": "workforce", "type": "open-source-idp", "swi_vendor": "open-source/authentik", "summary": "Open-source identity provider with SAML, OIDC, WS-Fed, SCIM and SSF providers. LDAP, RADIUS and proxy outposts cover legacy apps, and a public catalog documents hundreds of app integrations.", "catalog_url": "https://integrations.goauthentik.io/", "cells": { "aws": { "status": "yes", "note": "SAML + SCIM to IAM Identity Center", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/cloud-providers/aws/" }, "azure": { "status": "yes", "note": "Entra ID provider syncs users and groups (Enterprise); WS-Fed or SAML domain federation", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/entra/" }, "gcp": { "status": "yes", "note": "Workforce Identity Federation via SAML", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/cloud-providers/google-cloud-workforce-identity-federation/" }, "workday": { "status": "unknown", "note": "no Workday connector found in docs or catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "successfactors": { "status": "unknown", "note": "no SuccessFactors connector found in docs or catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "bamboohr": { "status": "unknown", "note": "no BambooHR connector found in docs or catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "rippling": { "status": "unknown", "note": "no Rippling connector found in docs or catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "ukg": { "status": "unknown", "note": "no UKG connector found in docs or catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "m365": { "status": "yes", "note": "WS-Fed domain federation; provisioning via Entra ID provider (Enterprise)", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/platforms/microsoft-ws-federation/" }, "google_workspace": { "status": "yes", "note": "SAML SSO + Google Workspace provider sync (Enterprise)", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/cloud-providers/google/" }, "salesforce": { "status": "yes", "note": "SAML + JIT; optional SCIM (Enterprise)", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/platforms/salesforce/" }, "slack": { "status": "yes", "note": "SAML + optional SCIM", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/chat-communication-collaboration/slack/" }, "github": { "status": "yes", "note": "SAML + SCIM for GitHub Enterprise Cloud EMU", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/development/ghec-emu/" }, "atlassian": { "status": "partial", "note": "SAML only, no provisioning", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/platforms/atlassian/" }, "servicenow": { "status": "unknown", "note": "no ServiceNow guide in catalog", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/" }, "zoom": { "status": "partial", "note": "SAML only, JIT at sign-in, no SCIM", "checked_on": "2026-11-05", "url": "https://integrations.goauthentik.io/chat-communication-collaboration/zoom/" }, "active_directory": { "status": "yes", "note": "LDAP source sync with optional password writeback, no agent", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/users-sources/sources/directory-sync/active-directory/" }, "ldap": { "status": "yes", "note": "LDAP source sync plus LDAP provider via outpost for legacy apps", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/ldap/" }, "kerberos_iwa": { "status": "yes", "note": "Kerberos source with browser SPNEGO", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/users-sources/sources/protocols/kerberos/browser/" }, "radius": { "status": "yes", "note": "RADIUS provider via outpost, PAP and EAP-TLS, authentication only", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/radius/" }, "header_based": { "status": "yes", "note": "proxy provider outpost sets X-authentik headers", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/proxy/" }, "onprem_saml_wsfed": { "status": "yes", "note": "WS-Fed relying parties, passive only (Enterprise)", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/wsfed/" }, "saml": { "status": "yes", "note": "SAML 2.0 provider with SLO", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/saml/" }, "oidc": { "status": "yes", "note": "OAuth 2.0 and OIDC provider", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/oauth2/" }, "ws_fed": { "status": "yes", "note": "passive WS-Fed, no WS-Trust or MEX (Enterprise)", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/wsfed/" }, "scim_outbound": { "status": "yes", "note": "generic SCIM 2.0 provider for users and groups", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/scim/" }, "scim_inbound": { "status": "yes", "note": "SCIM source accepts users and groups from Entra, Google, Okta", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/users-sources/sources/protocols/scim/" }, "ssf_caep": { "status": "yes", "note": "SSF transmitter (Enterprise)", "checked_on": "2026-11-05", "url": "https://docs.goauthentik.io/add-secure-apps/providers/ssf/" } }, "verified_on": "2026-11-05" }, { "slug": "aws-iam-identity-center", "name": "AWS IAM Identity Center", "vendor": "Amazon Web Services", "group": "workforce", "type": "cloud-native-idp", "swi_vendor": "iam/aws-iam-identity-center", "summary": "AWS's workforce sign-in service for AWS accounts and applications. It takes identities from its own directory, Active Directory via AWS Directory Service, or an external IdP over SAML and SCIM, and acts as a SAML 2.0 IdP for catalog and custom apps.", "catalog_url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "cells": { "aws": { "status": "yes", "note": "native: AWS account access via permission sets", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "azure": { "status": "unknown", "note": "no documented federation of Entra ID to Identity Center as IdP", "checked_on": "2026-11-05" }, "gcp": { "status": "unknown", "note": "no Google Cloud doc listing Identity Center as IdP", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "no HR connector documented", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "no HR connector documented", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "no HR connector documented", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "no HR connector documented", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "no HR connector documented", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "m365": { "status": "partial", "note": "catalog SAML app, no provisioning documented", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "google_workspace": { "status": "unknown", "note": "not named in public catalog docs", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "salesforce": { "status": "partial", "note": "catalog SAML app, no provisioning documented", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "slack": { "status": "unknown", "note": "not named in public catalog docs; full list only in console", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "github": { "status": "unknown", "note": "not named in public catalog docs; full list only in console", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "atlassian": { "status": "unknown", "note": "not named in public catalog docs; full list only in console", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "servicenow": { "status": "unknown", "note": "not named in public catalog docs; full list only in console", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "zoom": { "status": "unknown", "note": "not named in public catalog docs; full list only in console", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/saasapps.html", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "AD Connector or AWS Managed Microsoft AD; user and group sync", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-ad.html", "checked_on": "2026-11-05" }, "ldap": { "status": "unknown", "note": "no LDAP interface or generic LDAP source documented", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-ad.html", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "no desktop SSO documented", "checked_on": "2026-11-05" }, "radius": { "status": "partial", "note": "RADIUS client to existing MFA server via AWS Managed Microsoft AD; not a RADIUS server", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/mfa-types.html", "checked_on": "2026-11-05" }, "header_based": { "status": "partial", "note": "via AWS Verified Access (separate service) signed identity header", "url": "https://docs.aws.amazon.com/verified-access/latest/ug/user-claims-passing.html", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "partial", "note": "SAML 2.0 apps only, no WS-Fed", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML 2.0 IdP for catalog and customer managed apps", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/customermanagedapps.html", "checked_on": "2026-11-05" }, "oidc": { "status": "no", "note": "supports only SAML 2.0 apps; OAuth 2.0 flows only for AWS managed apps", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "ws_fed": { "status": "no", "note": "supports only SAML 2.0-based applications", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "unknown", "note": "docs describe SCIM inbound only; no outbound provisioning to apps found", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "SCIM 2.0 endpoint for users and groups from external IdP", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "no Shared Signals support found", "url": "https://aws.amazon.com/iam/identity-center/faqs/", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "duo", "name": "Cisco Duo (Duo SSO and Duo Directory)", "vendor": "Cisco", "group": "workforce", "type": "mfa-sso", "swi_vendor": "mfa/duo", "summary": "Cisco Duo adds MFA and device trust, with Duo SSO as a cloud SAML 2.0 and OIDC identity provider and Duo Directory as a cloud user store. It syncs users from AD, OpenLDAP, Entra ID, Google and SCIM sources, and the on-prem Authentication Proxy covers RADIUS and LDAP apps.", "catalog_url": "https://duo.com/solutions/features/supported-applications", "cells": { "aws": { "status": "yes", "note": "SAML + SCIM to IAM Identity Center; IAM SAML roles also supported", "url": "https://duo.com/docs/sso-aws-cli", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "Entra tenant domain federated to Duo SSO (SAML + WS-Trust) with user and group provisioning", "url": "https://duo.com/docs/sso-m365", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Cloud Identity / Google Workspace SAML SSO plus user and group provisioning", "url": "https://duo.com/docs/sso-gsuite", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "Duo SSO for Workday covers sign-in to Workday only, not Workday as HR source", "url": "https://duo.com/docs/sso-workday", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "no HR connector documented; inbound SCIM from any SCIM-compliant directory", "url": "https://duo.com/docs/duo-directory", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "no HR connector documented", "url": "https://duo.com/docs/duo-directory", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "no HR connector documented; Rippling app page not machine-readable", "url": "https://duo.com/docs/duo-directory", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "no HR connector documented", "url": "https://duo.com/docs/duo-directory", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "SAML 2.0 + optional WS-Trust, automated provisioning of users and groups", "url": "https://duo.com/docs/sso-m365", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "SAML + automated provisioning of users and groups", "url": "https://duo.com/docs/sso-gsuite", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "SAML + SCIM provisioning (provisioning is beta)", "url": "https://duo.com/docs/sso-salesforce", "checked_on": "2026-11-05" }, "slack": { "status": "partial", "note": "SAML app; SCIM may work via generic provisioning, not Duo Verified", "url": "https://duo.com/docs/sso-slack", "checked_on": "2026-11-05" }, "github": { "status": "partial", "note": "SAML only, no provisioning", "url": "https://duo.com/docs/sso-github-enterprise", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "SAML + SCIM provisioning", "url": "https://duo.com/docs/sso-atlassian-cloud", "checked_on": "2026-11-05" }, "servicenow": { "status": "partial", "note": "SAML only, no provisioning", "url": "https://duo.com/docs/sso-servicenow", "checked_on": "2026-11-05" }, "zoom": { "status": "partial", "note": "SAML app; SCIM may work via generic provisioning, not Duo Verified", "url": "https://duo.com/docs/sso-zoom", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "directory sync and SSO auth source via Duo Authentication Proxy", "url": "https://duo.com/docs/directorysync", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "OpenLDAP sync, plus Authentication Proxy as LDAP proxy for apps", "url": "https://duo.com/docs/ldap", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "Duo Passport shares Windows logon session with SSO apps, not Kerberos/IWA", "url": "https://duo.com/docs/passport", "checked_on": "2026-11-05" }, "radius": { "status": "yes", "note": "Authentication Proxy acts as RADIUS server for VPN and network devices", "url": "https://duo.com/docs/radius", "checked_on": "2026-11-05" }, "header_based": { "status": "unknown", "note": "Duo Network Gateway proxies on-prem web apps; no identity header SSO documented", "url": "https://duo.com/docs/dng", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "partial", "note": "SAML apps via generic SAML SP, no WS-Fed relying parties documented", "url": "https://duo.com/docs/sso-generic", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "cloud-hosted SAML 2.0 IdP (Essentials, Advantage, Premier)", "url": "https://duo.com/docs/sso", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OIDC provider, authorization code flow only", "url": "https://duo.com/docs/sso-oidc-generic", "checked_on": "2026-11-05" }, "ws_fed": { "status": "unknown", "note": "not documented; Microsoft 365 app uses SAML 2.0 plus WS-Trust", "url": "https://duo.com/docs/sso-m365", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "SCIM 2.0 to Duo Verified apps, generic SCIM for other SSO apps", "url": "https://duo.com/docs/automated-provisioning", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "inbound SCIM from Okta or any SCIM-compliant directory", "url": "https://duo.com/docs/directorysync", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "only an SSF interop demo on vendor blog, no product doc", "url": "https://duo.com/blog/defending-against-identity-based-threats-using-the-shared-signals-framework", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "google-cloud-identity", "name": "Google Cloud Identity and Google Workspace", "vendor": "Google", "group": "workforce", "type": "cloud-native-idp", "swi_vendor": null, "summary": "Google's directory and IdP for Workspace and Google Cloud. It acts as a SAML IdP for a catalog of pre-integrated apps, provisions users to a fixed list of apps, and syncs from Active Directory or LDAP with Google Cloud Directory Sync.", "catalog_url": "https://support.google.com/a/topic/10018788", "cells": { "aws": { "status": "yes", "note": "SAML + auto-provisioning to IAM Identity Center; no SCIM group sync", "url": "https://knowledge.workspace.google.com/admin/users/advanced/configure-amazon-web-services-user-provisioning", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "via Office 365 app: SAML federation plus user provisioning to the tenant", "url": "https://knowledge.workspace.google.com/admin/users/advanced/configure-office-365-user-provisioning", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "native: Google Cloud organizations use Cloud Identity or Workspace accounts", "url": "https://docs.cloud.google.com/architecture/identity/overview-google-authentication", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "SAML SSO into Workday only; no HR-driven inbound provisioning found", "url": "https://knowledge.workspace.google.com/admin/apps/integrations/workday-cloud-app", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "no inbound HR connector found", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "no inbound HR connector found", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "no inbound HR connector found", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "no inbound HR connector found", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "SAML SSO + automated provisioning (Office 365 app)", "url": "https://knowledge.workspace.google.com/admin/users/advanced/configure-office-365-user-provisioning", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "native", "url": "https://docs.cloud.google.com/architecture/identity/overview-google-authentication", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "pre-integrated SAML app + auto-provisioning", "url": "https://support.google.com/a/topic/10018788", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "pre-integrated SAML app + auto-provisioning", "url": "https://support.google.com/a/topic/10018788", "checked_on": "2026-11-05" }, "github": { "status": "partial", "note": "custom SAML app only; not in Google catalog or GitHub tested IdP list", "url": "https://knowledge.workspace.google.com/admin/apps/set-up-your-own-custom-saml-app", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "Atlassian Cloud SAML app + auto-provisioning", "url": "https://support.google.com/a/topic/10018788", "checked_on": "2026-11-05" }, "servicenow": { "status": "partial", "note": "pre-integrated SAML app, no provisioning", "url": "https://knowledge.workspace.google.com/admin/apps/integrations/servicenow-cloud-app", "checked_on": "2026-11-05" }, "zoom": { "status": "partial", "note": "pre-integrated SAML app, no provisioning", "url": "https://knowledge.workspace.google.com/admin/apps/integrations/zoom-cloud-app", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "one-way user and group sync with Google Cloud Directory Sync", "url": "https://knowledge.workspace.google.com/admin/users/about-google-cloud-directory-sync", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "GCDS sync from LDAP servers plus Secure LDAP interface for apps (higher editions)", "url": "https://knowledge.workspace.google.com/admin/apps/about-the-secure-ldap-service", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "no Kerberos or IWA desktop SSO found", "checked_on": "2026-11-05" }, "radius": { "status": "partial", "note": "FreeRADIUS backed by Secure LDAP; no built-in RADIUS server", "url": "https://knowledge.workspace.google.com/admin/apps/connect-ldap-clients-to-the-secure-ldap-service", "checked_on": "2026-11-05" }, "header_based": { "status": "partial", "note": "via Google Cloud IAP (separate product) identity headers", "url": "https://docs.cloud.google.com/iap/docs/identity-howto", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "partial", "note": "custom SAML apps only, no WS-Fed documented", "url": "https://knowledge.workspace.google.com/admin/apps/set-up-your-own-custom-saml-app", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML 2.0 IdP for catalog and custom apps", "url": "https://knowledge.workspace.google.com/admin/apps/set-up-your-own-custom-saml-app", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OpenID Certified provider (Sign in with Google)", "url": "https://developers.google.com/identity/openid-connect/openid-connect", "checked_on": "2026-11-05" }, "ws_fed": { "status": "unknown", "note": "SSO docs describe SAML 2.0 only", "url": "https://knowledge.workspace.google.com/admin/apps/integrations/office-365-cloud-app", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "partial", "note": "pre-built app list; custom SCIM profiles in limited beta", "url": "https://knowledge.workspace.google.com/admin/users/advanced/automated-user-provisioning-with-custom-scim-profiles", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "unknown", "note": "no SCIM server endpoint found", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "no", "note": "Cross-Account Protection (RISC) does not send events for Workspace users", "url": "https://developers.google.com/identity/protocols/risc", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "idira-workforce-identity", "name": "Idira Workforce Identity (formerly CyberArk Identity)", "vendor": "Palo Alto Networks (Idira, formerly CyberArk)", "group": "workforce", "type": "commercial-idp", "swi_vendor": "pam/cyberark", "summary": "Idira Workforce Identity, formerly CyberArk Identity, is a SaaS workforce SSO, MFA and lifecycle service now sold by Palo Alto Networks under the Idira brand. It federates to apps over SAML and provisions over SCIM, with an on-prem Idira Identity Connector for directory and HR sync.", "catalog_url": null, "cells": { "aws": { "status": "yes", "note": "SAML + SCIM 2.0 to IAM Identity Center, roles mapped to groups (AWS guide)", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/cyberark-idp.html", "checked_on": "2026-11-05" }, "azure": { "status": "unknown", "note": "Microsoft federation compatibility page silent; vendor docs not machine-readable", "checked_on": "2026-11-05", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-compatibility" }, "gcp": { "status": "unknown", "note": "no CyberArk guide in Google Workforce Identity Federation docs; vendor docs not machine-readable", "checked_on": "2026-11-05", "url": "https://docs.cloud.google.com/iam/docs/configuring-workforce-identity-federation" }, "workday": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "m365": { "status": "unknown", "note": "Microsoft federation compatibility page silent; vendor docs not machine-readable", "checked_on": "2026-11-05", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-compatibility" }, "google_workspace": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "salesforce": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "slack": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "github": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "atlassian": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "servicenow": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "zoom": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "active_directory": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "ldap": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "radius": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "header_based": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "acts as SAML IdP for IAM Identity Center (AWS guide)", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/cyberark-idp.html", "checked_on": "2026-11-05" }, "oidc": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "ws_fed": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "unknown", "note": "SCIM 2.0 to AWS shown in AWS guide; generic SCIM outbound not verified, vendor docs not machine-readable", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/cyberark-idp.html", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "jumpcloud", "name": "JumpCloud", "vendor": "JumpCloud", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/jumpcloud", "summary": "JumpCloud is a cloud directory and SSO platform that combines SAML and OIDC SSO, SCIM provisioning, hosted LDAP and RADIUS, and agent-based Active Directory sync. HR systems feed it through Custom API import connectors or HR-side SCIM.", "catalog_url": "https://jumpcloud.com/integrations", "cells": { "aws": { "status": "yes", "note": "SAML SSO + SCIM to IAM Identity Center", "url": "https://jumpcloud.com/support/integrate-with-aws-iam-identity-center", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "Entra ID domain federation (SAML or WS-Fed) + M365 Cloud Directory Integration provisioning", "url": "https://jumpcloud.com/support/sso-with-m365", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Google Workspace/Cloud Identity SAML SSO + Google Workspace Cloud Directory Integration provisioning", "url": "https://jumpcloud.com/support/sso-with-google-workspace", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "Workday Custom API Import via RaaS report; create, update, deprovision; legacy connector deprecated May 2026", "url": "https://jumpcloud.com/support/integrate-with-workday", "checked_on": "2026-11-05" }, "successfactors": { "status": "yes", "note": "Custom API import; users created, updated and suspended", "url": "https://jumpcloud.com/support/integrate-with-successfactors", "checked_on": "2026-11-05" }, "bamboohr": { "status": "partial", "note": "BambooHR pushes via SCIM (one-way, managed by BambooHR); Custom API connector for extra attributes", "url": "https://jumpcloud.com/support/integrate-with-bamboohr", "checked_on": "2026-11-05" }, "rippling": { "status": "yes", "note": "Custom API import from Rippling workers endpoint; inactive status suspends users", "url": "https://jumpcloud.com/support/integrate-with-rippling", "checked_on": "2026-11-05" }, "ukg": { "status": "no", "note": "Docs say custom API integration cannot be used with UKG; no pre-built connector", "url": "https://jumpcloud.com/support/troubleshoot-custom-api-integrations", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "SAML or WS-Fed SSO + M365 Cloud Directory Integration provisioning", "url": "https://jumpcloud.com/support/sso-with-m365", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "SAML SSO + Google Workspace Cloud Directory Integration (bi-directional sync)", "url": "https://jumpcloud.com/support/sso-with-google-workspace", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "SAML + SCIM (users and groups)", "url": "https://jumpcloud.com/support/integrate-with-salesforce", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "SAML + SCIM; Business+ or Enterprise Grid", "url": "https://jumpcloud.com/support/integrate-with-slack", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "SAML + SCIM for GitHub Enterprise Cloud (EMU and organization)", "url": "https://jumpcloud.com/support/integrate-with-github-enterprise-cloud-enterprise-accounts", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "SAML + SCIM for Atlassian Cloud; sync capped at 5,000 users", "url": "https://jumpcloud.com/support/integrate-with-atlassian-cloud", "checked_on": "2026-11-05" }, "servicenow": { "status": "partial", "note": "SAML only, no provisioning", "url": "https://jumpcloud.com/support/integrate-with-servicenow", "checked_on": "2026-11-05" }, "zoom": { "status": "yes", "note": "SAML + SCIM", "url": "https://jumpcloud.com/support/integrate-with-zoom", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "Active Directory Integration agents on DCs or member servers; two-way sync of users, groups, passwords", "url": "https://jumpcloud.com/support/configure-adi-two-way-sync", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "Hosted Cloud LDAP interface (ldap.jumpcloud.com), read-only, LDAPS or STARTTLS", "url": "https://jumpcloud.com/support/use-cloud-ldap", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "no Kerberos or IWA desktop SSO docs found", "checked_on": "2026-11-05" }, "radius": { "status": "yes", "note": "Hosted Cloud RADIUS for WiFi and VPN", "url": "https://jumpcloud.com/support/get-started-radius", "checked_on": "2026-11-05" }, "header_based": { "status": "unknown", "note": "no header-based SSO docs found", "url": "https://jumpcloud.com/support/get-started-applications", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "unknown", "note": "no AD FS migration or WS-Fed relying party docs found", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML 2.0 catalog connectors and custom SAML apps", "url": "https://jumpcloud.com/support/get-started-applications", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "Custom OIDC app connector", "url": "https://jumpcloud.com/support/get-started-applications", "checked_on": "2026-11-05" }, "ws_fed": { "status": "partial", "note": "WS-Fed documented for Microsoft 365/Entra ID only", "url": "https://jumpcloud.com/support/enable-microsoft-365-entra-id-ws-federation", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "Custom SCIM 2.0 connector plus pre-built SCIM connectors", "url": "https://jumpcloud.com/support/provision-and-manage-users-and-groups-in-apps-using-custom-scim-identity-management-integration", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "JumpCloud SCIM API server (api.jumpcloud.com/scim/v2); no real-time group import", "url": "https://jumpcloud.com/support/integrate-with-the-jumpcloud-scim-server", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "no SSF or CAEP docs found", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "keycloak", "name": "Keycloak", "vendor": "Keycloak project (CNCF)", "group": "workforce", "type": "open-source-idp", "swi_vendor": "open-source/keycloak", "summary": "Keycloak is an open-source identity provider for OIDC and SAML 2.0 that federates users from LDAP and Active Directory and supports Kerberos desktop SSO. It has no app catalog, so SaaS apps connect as generic SAML or OIDC clients.", "catalog_url": null, "cells": { "aws": { "status": "partial", "note": "generic SAML client only; not in AWS IdP tutorials, no outbound SCIM", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "azure": { "status": "partial", "note": "generic SAML federation only; not on Microsoft tested IdP list", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Workforce Identity Federation lists keycloak as a provider vendor type", "url": "https://docs.cloud.google.com/sdk/gcloud/reference/beta/iam/workforce-pools/providers/update-oidc", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "no HR connector documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "no HR connector documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "no HR connector documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "no HR connector documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "no HR connector documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "m365": { "status": "partial", "note": "generic SAML only; not on Microsoft tested IdP list", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "google_workspace": { "status": "partial", "note": "SAML SSO documented by Google; no built-in provisioning, needs GCDS", "url": "https://docs.cloud.google.com/architecture/identity/keycloak-single-sign-on", "checked_on": "2026-11-05" }, "salesforce": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "slack": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "github": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "atlassian": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "servicenow": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "zoom": { "status": "partial", "note": "generic SAML/OIDC client, no catalog or provisioning", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "LDAP/AD user federation with sync; read-only, writable or unsynced modes", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "LDAP user federation (connects to LDAP); no LDAP interface for apps", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "yes", "note": "Kerberos/SPNEGO browser desktop SSO", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "radius": { "status": "unknown", "note": "not documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "header_based": { "status": "unknown", "note": "not documented", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "partial", "note": "SAML apps only, no WS-Fed", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML 2.0 IdP", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OpenID Connect provider", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "ws_fed": { "status": "no", "note": "core SSO protocols are OIDC and SAML; WS-Fed not included", "url": "https://www.keycloak.org/docs/latest/server_admin/index.html", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "no", "note": "Google docs: no built-in user and group provisioning", "url": "https://docs.cloud.google.com/architecture/identity/keycloak-single-sign-on", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "SCIM API supported and on by default since 26.8; no bulk or password changes", "url": "https://www.keycloak.org/2026/10/keycloak-2680-released", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "partial", "note": "experimental SSF transmitter, CAEP and RISC events, not for production", "url": "https://www.keycloak.org/securing-apps/ssf-support", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "microsoft-entra-id", "name": "Microsoft Entra ID", "vendor": "Microsoft", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/microsoft-entra", "summary": "Microsoft cloud identity provider behind Microsoft 365 and Azure. Connects to apps through the Entra app gallery (SAML, OIDC, WS-Fed plus SCIM provisioning), to on-prem AD through Connect Sync or Cloud Sync, and to legacy apps through Application Proxy.", "catalog_url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/tutorial-list", "cells": { "aws": { "status": "yes", "note": "Gallery app: SAML SSO + SCIM users and groups to IAM Identity Center", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/aws-single-sign-on-provisioning-tutorial", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "Native: Azure subscriptions use Entra ID tenants", "url": "https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Google documents Workforce Identity Federation with Entra ID (OIDC or SAML); Entra gallery also provisions Google Cloud / Workspace", "url": "https://docs.cloud.google.com/iam/docs/workforce-sign-in-microsoft-entra-id", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "Workday inbound provisioning to AD and Entra ID: hire, update, terminate", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/workday-inbound-tutorial", "checked_on": "2026-11-05" }, "successfactors": { "status": "yes", "note": "SuccessFactors inbound provisioning to AD and Entra ID: hire, update, terminate, rehire", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/sap-successfactors-inbound-provisioning-tutorial", "checked_on": "2026-11-05" }, "bamboohr": { "status": "partial", "note": "No Microsoft connector; listed under partner Aquera HR Sync connectors, or build on API-driven inbound provisioning", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/partner-driven-integrations", "checked_on": "2026-11-05" }, "rippling": { "status": "partial", "note": "Rippling-built integration pushes users via API-driven inbound provisioning to AD", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/rippling-hcm-microsoft-entra-id-integration-tutorial", "checked_on": "2026-11-05" }, "ukg": { "status": "partial", "note": "No Microsoft connector; UKG Pro/Ready listed under partner Aquera HR Sync connectors", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/partner-driven-integrations", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "Native: Microsoft 365 uses Entra ID for identity and authentication", "url": "https://learn.microsoft.com/en-us/microsoft-365/enterprise/deploy-identity-solution-identity-model", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "Gallery app: SAML SSO + users and groups provisioning", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/g-suite-provisioning-tutorial", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "Gallery app: SAML SSO + user provisioning via Salesforce API", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/salesforce-provisioning-tutorial", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "Gallery app: SSO + SCIM users and groups (Business+; Enterprise Grid per Slack docs)", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/slack-provisioning-tutorial", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "GitHub Enterprise Managed Users: SAML SSO + SCIM users and groups", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/github-enterprise-managed-user-provisioning-tutorial", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "Atlassian Cloud: SSO + SCIM users and groups (Atlassian Guard/Access required)", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/atlassian-cloud-provisioning-tutorial", "checked_on": "2026-11-05" }, "servicenow": { "status": "yes", "note": "Gallery app: SSO + users and groups provisioning; self-hosted instances not supported", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/servicenow-provisioning-tutorial", "checked_on": "2026-11-05" }, "zoom": { "status": "yes", "note": "Gallery app: SSO + SCIM user provisioning (no groups)", "url": "https://learn.microsoft.com/en-us/entra/identity/saas-apps/zoom-provisioning-tutorial", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "Cloud Sync agent (or Connect Sync) syncs AD users, groups, contacts", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/cloud-sync/what-is-cloud-sync", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "LDAP interface via Entra Domain Services managed domain; provisioning agent can also write to LDAP directories", "url": "https://learn.microsoft.com/en-us/entra/fundamentals/what-is-entra", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "yes", "note": "Desktop SSO via Kerberos tickets on domain-joined devices (Entra Connect feature); PRT SSO on Entra joined devices", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso", "checked_on": "2026-11-05" }, "radius": { "status": "partial", "note": "NPS extension on Windows NPS adds Entra MFA to RADIUS; primary auth stays in AD, no native RADIUS server", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension", "checked_on": "2026-11-05" }, "header_based": { "status": "yes", "note": "Application Proxy native header-based SSO for on-prem apps", "url": "https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-configure-single-sign-on-with-headers", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "yes", "note": "Documented AD FS app migration; SAML and WS-Fed apps as enterprise apps or app registrations", "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/migrate-adfs-apps-stages", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML SSO for gallery and non-gallery apps", "url": "https://learn.microsoft.com/en-us/entra/identity-platform/authentication-vs-authorization", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OpenID Connect provider (Microsoft identity platform)", "url": "https://learn.microsoft.com/en-us/entra/identity-platform/authentication-vs-authorization", "checked_on": "2026-11-05" }, "ws_fed": { "status": "yes", "note": "WS-Federation apps supported as non-gallery apps or app registrations", "url": "https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/migrate-adfs-apps-stages", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "SCIM 2.0 client to any compliant non-gallery app endpoint", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/use-scim-to-provision-users-and-groups", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "partial", "note": "API-driven inbound provisioning: Graph /bulkUpload accepts SCIM bulk payloads, not a full SCIM server; P1/P2", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "partial", "note": "Continuous access evaluation based on CAEP, but for Microsoft resources (Exchange, SharePoint, Teams, Graph); no documented SSF stream for third parties", "url": "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-continuous-access-evaluation", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "miniorange", "name": "miniOrange Workforce IAM", "vendor": "miniOrange", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/miniorange", "summary": "miniOrange Workforce IAM is a cloud and on-prem identity platform offering SAML, OIDC and WS-Fed SSO, SCIM provisioning, RADIUS, and an on-prem LDAP Gateway and Access Gateway for AD and legacy apps. Its catalog lists more than 6,000 pre-built SSO, MFA and provisioning integrations.", "catalog_url": "https://www.miniorange.com/iam/integrations/", "cells": { "aws": { "status": "yes", "note": "SAML to IAM Identity Center as external IdP + SCIM provisioning; IAM SAML roles also documented", "url": "https://www.miniorange.com/iam/integrations/aws-scim-provisioning", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "Microsoft 365/Entra ID federation via SAML or WS-Fed + users, groups and license provisioning", "url": "https://miniorange.com/iam/integrations/microsoft-365-sso", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "SAML SSO via Google Admin third-party IdP + Google Workspace provisioning app; no Workforce Identity Federation guide found", "url": "https://www.miniorange.com/iam/integrations/google-cloud-platform-single-sign-on-sso", "checked_on": "2026-11-05" }, "workday": { "status": "partial", "note": "Manual Import Users from Workday; scheduled inbound sync not documented", "url": "https://www.miniorange.com/workday-provisioning", "checked_on": "2026-11-05" }, "successfactors": { "status": "partial", "note": "Manual Import Users from SuccessFactors; inbound updates and deletes not documented", "url": "https://www.miniorange.com/iam/integrations/sap-successfactors-scim-provisioning", "checked_on": "2026-11-05" }, "bamboohr": { "status": "yes", "note": "BambooHR webhook creates, updates and deletes users in miniOrange", "url": "https://www.miniorange.com/iam/integrations/bamboohr-provisioning", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "not listed in integration catalog; Rippling documented only as external IdP", "url": "https://www.miniorange.com/iam/integrations/", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "not listed in integration catalog", "url": "https://www.miniorange.com/iam/integrations/", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "SAML or WS-Fed SSO + users, groups and license provisioning", "url": "https://miniorange.com/iam/integrations/microsoft-365-sso", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "SSO + provisioning app (create, update, delete users and groups)", "url": "https://www.miniorange.com/iam/integrations/google-workspace-provisioning", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "SAML + SCIM provisioning (create, update, delete)", "url": "https://www.miniorange.com/iam/integrations/salesforce-scim-provisioning", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "SSO + SCIM provisioning (create, update, delete)", "url": "https://www.miniorange.com/iam/integrations/slack-scim-provisioning", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "SAML SSO + SCIM provisioning (create, update, delete)", "url": "https://www.miniorange.com/iam/integrations/github-scim-provisioning", "checked_on": "2026-11-05" }, "atlassian": { "status": "partial", "note": "SAML SSO to Jira Cloud via Atlassian Access; no Atlassian Cloud provisioning guide found", "url": "https://miniorange.com/atlassian-jira-cloud-single-sign-on-sso", "checked_on": "2026-11-05" }, "servicenow": { "status": "yes", "note": "SSO + provisioning (create, update, delete, sync)", "url": "https://www.miniorange.com/iam/integrations/servicenow-sso", "checked_on": "2026-11-05" }, "zoom": { "status": "yes", "note": "SSO + SCIM provisioning (create, update, delete)", "url": "https://miniorange.com/iam/integrations/zoom-sso", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "On-prem LDAP Gateway syncs AD users and groups and authenticates against AD", "url": "https://www.miniorange.com/iam/ldap-gateway/", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "LDAP directory integration via LDAP Gateway (sync and authentication); no LDAP interface for apps documented", "url": "https://www.miniorange.com/iam/ldap-gateway/", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "yes", "note": "Kerberos and NTLM via IWA module hosted on IIS", "url": "https://www.miniorange.com/iam/solutions/integrated-windows-authentication-iwa", "checked_on": "2026-11-05" }, "radius": { "status": "yes", "note": "miniOrange RADIUS server for VPN authentication and MFA", "url": "https://www.miniorange.com/iam/integrations/open-vpn-multi-factor-authentication-mfa", "checked_on": "2026-11-05" }, "header_based": { "status": "yes", "note": "Access Gateway (on-prem reverse proxy) for header and cookie-based apps", "url": "https://miniorange.com/products/access-gateway", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "yes", "note": "Custom WS-Fed relying party apps plus on-prem Exchange OWA via WS-Fed", "url": "https://miniorange.com/iam/content-library/admin-docs/how-to-add-ws-fed-app", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "Custom SAML App, miniOrange as IdP", "url": "https://miniorange.com/iam/content-library/admin-docs/how-to-add-saml-app", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OAuth2/OpenID Connect app with id_token", "url": "https://miniorange.com/iam/content-library/admin-docs/how-to-add-oauth-app", "checked_on": "2026-11-05" }, "ws_fed": { "status": "yes", "note": "Custom WS-Fed app (realm, reply URL)", "url": "https://miniorange.com/iam/content-library/admin-docs/how-to-add-ws-fed-app", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "SCIM Server (Destination) app for any SCIM-supported app", "url": "https://miniorange.com/iam/content-library/admin-docs/how-to-add-scim-server-app", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "SCIM base URL and bearer token accept provisioning from Entra ID", "url": "https://www.miniorange.com/iam/integrations/microsoft-entra-id-scim-provisioning", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "no SSF or CAEP docs found", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "okta", "name": "Okta Workforce Identity", "vendor": "Okta", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/okta", "summary": "Cloud workforce identity provider with SSO, MFA and Lifecycle Management. Connects to apps through the Okta Integration Network (SAML, OIDC, WS-Fed, SCIM) and to on-prem directories and legacy apps through AD, LDAP and RADIUS agents and Okta Access Gateway.", "catalog_url": "https://www.okta.com/integrations/", "cells": { "aws": { "status": "yes", "note": "SAML + SCIM to IAM Identity Center (create, update, deactivate, group push)", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/gs-okta.html", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "Entra tenant domain federation (WS-Fed) plus user and group provisioning via Microsoft Office 365 app", "url": "https://www.okta.com/integrations/microsoft-office-365/", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Workforce Identity Federation with Okta (OIDC or SAML)", "url": "https://docs.cloud.google.com/iam/docs/workforce-sign-in-okta", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "HR-driven provisioning: hires, updates and terminations flow to Okta", "url": "https://help.okta.com/en-us/content/topics/provisioning/workday/workday-provisioning.htm", "checked_on": "2026-11-05" }, "successfactors": { "status": "yes", "note": "SuccessFactors Employee Central import and deactivation on termination", "url": "https://help.okta.com/en-us/content/topics/provisioning/sfec/sfec-data-provisioning.htm", "checked_on": "2026-11-05" }, "bamboohr": { "status": "yes", "note": "Catalog app: create, update, attribute sourcing; listed under HR-driven IT", "url": "https://www.okta.com/integrations/bamboohr/", "checked_on": "2026-11-05" }, "rippling": { "status": "yes", "note": "Catalog app makes Rippling the profile source: create, update, attribute sourcing", "url": "https://www.okta.com/integrations/rippling/", "checked_on": "2026-11-05" }, "ukg": { "status": "yes", "note": "UKG Pro (UltiPro) catalog app: create, update, attribute sourcing, writeback", "url": "https://www.okta.com/integrations/ukg-pro/", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "WS-Fed + provisioning (create, update, deactivate, group push)", "url": "https://www.okta.com/integrations/microsoft-office-365/", "checked_on": "2026-11-05" }, "google_workspace": { "status": "yes", "note": "SAML + provisioning (create, update, deactivate, group push)", "url": "https://www.okta.com/integrations/google-workspace/", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "SAML + provisioning (create, update, deactivate)", "url": "https://www.okta.com/integrations/salesforce-com/", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "SAML + SCIM (create, update, deactivate, group push)", "url": "https://www.okta.com/integrations/slack/", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "SAML + SCIM for Enterprise Cloud orgs and Enterprise Managed Users", "url": "https://www.okta.com/integrations/github-enterprise-managed-user/", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "SAML + SCIM (create, update, deactivate, group push)", "url": "https://www.okta.com/integrations/atlassian-cloud/", "checked_on": "2026-11-05" }, "servicenow": { "status": "yes", "note": "SAML + provisioning via ServiceNow UD app", "url": "https://www.okta.com/integrations/servicenow-ud/", "checked_on": "2026-11-05" }, "zoom": { "status": "yes", "note": "SAML/OIDC + SCIM (create, update, deactivate, group push)", "url": "https://www.okta.com/integrations/zoom/", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "Okta AD agent imports AD users and groups", "url": "https://help.okta.com/en-us/content/topics/directory/ad-agent-main.htm", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "LDAP agent for directory integration plus cloud LDAP Interface for legacy apps", "url": "https://help.okta.com/en-us/content/topics/directory/ldap-interface-main.htm", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "yes", "note": "Agentless Desktop SSO (Kerberos) or IWA web agent", "url": "https://help.okta.com/en-us/content/topics/directory/ad-desktop-sso-main.htm", "checked_on": "2026-11-05" }, "radius": { "status": "yes", "note": "Okta RADIUS server agent for VPNs, PAP only, no WiFi", "url": "https://help.okta.com/en-us/content/topics/integrations/okta_radius_app.htm", "checked_on": "2026-11-05" }, "header_based": { "status": "yes", "note": "Okta Access Gateway reverse proxy for header-based and Kerberos apps", "url": "https://help.okta.com/oag/en-us/content/topics/access-gateway/about-oag.htm", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "yes", "note": "Template WS-Fed app for WS-Fed relying parties", "url": "https://help.okta.com/en-us/content/topics/apps/apps_configure_okta_template_ws_federation.htm", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML 2.0 custom app integrations", "url": "https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard.htm", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OIDC custom app integrations", "url": "https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard.htm", "checked_on": "2026-11-05" }, "ws_fed": { "status": "yes", "note": "Template WS-Fed app, SP-initiated; also Microsoft 365", "url": "https://help.okta.com/en-us/content/topics/apps/apps_configure_okta_template_ws_federation.htm", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "SCIM provisioning on custom app integrations; provisioning feature must be enabled", "url": "https://help.okta.com/en-us/content/topics/apps/apps_app_integration_wizard_scim.htm", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "Inbound SCIM 2.0 API: external HR or IdP provisions into Okta", "url": "https://developer.okta.com/docs/api/openapi/okta-scim/inbound/overview", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "yes", "note": "SSF transmitter (Session Revoked, Credential Change) and receiver (CAEP, RISC); Identity Threat Protection", "url": "https://help.okta.com/oie/en-us/content/topics/apps/configure-shared-signal-transmitter.htm", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "onelogin", "name": "OneLogin Workforce Identity", "vendor": "One Identity", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/onelogin", "summary": "Cloud workforce identity provider with SSO, MFA and a cloud directory. Connects to apps through its app catalog using SAML, OIDC and SCIM connectors.", "catalog_url": "https://www.onelogin.com/connector", "cells": { "aws": { "status": "yes", "note": "SAML + SCIM to IAM Identity Center; no group delete, single ACS URL", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/onelogin-idp.html", "checked_on": "2026-11-05" }, "azure": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "gcp": { "status": "unknown", "note": "no OneLogin-specific Workforce Identity Federation guide found", "checked_on": "2026-11-05" }, "workday": { "status": "unknown", "note": "OneLogin docs not machine-readable", "url": "https://www.onelogin.com/connector/workday/", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "m365": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "google_workspace": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "salesforce": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "listed by Slack for SCIM provisioning (requires SAML SSO)", "url": "https://slack.com/help/articles/212572638-Manage-members-with-SCIM-provisioning", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "SAML + SCIM for GitHub organizations", "url": "https://docs.github.com/en/enterprise-cloud@latest/organizations/managing-saml-single-sign-on-for-your-organization/about-scim-for-organizations", "checked_on": "2026-11-05" }, "atlassian": { "status": "yes", "note": "listed by Atlassian for SAML SSO and SCIM provisioning", "url": "https://support.atlassian.com/provisioning-users/docs/supported-identity-providers/", "checked_on": "2026-11-05" }, "servicenow": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "zoom": { "status": "partial", "note": "listed by Zoom as SAML IdP; provisioning with OneLogin not documented", "url": "https://support.zoom.com/hc/en/article?id=zm_kb&sysparm_article=KB0060673", "checked_on": "2026-11-05" }, "active_directory": { "status": "unknown", "note": "OneLogin docs not machine-readable", "url": "https://support.onelogin.com/kb/4250579/install-configure-active-directory-connector-6-1-5", "checked_on": "2026-11-05" }, "ldap": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "radius": { "status": "unknown", "note": "OneLogin docs not machine-readable", "url": "https://support.onelogin.com/onelogin/kb/4271380/configure-the-radius-server-interface", "checked_on": "2026-11-05" }, "header_based": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "SAML SSO, OneLogin as identity provider", "url": "https://developers.onelogin.com/docs/saml/", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "OpenID Connect provider", "url": "https://developers.onelogin.com/docs/openid-connect/", "checked_on": "2026-11-05" }, "ws_fed": { "status": "unknown", "note": "OneLogin docs not machine-readable", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "SCIM 1.1 and 2.0 via SCIM Provisioner connector", "url": "https://developers.onelogin.com/docs/scim/", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "unknown", "note": "developer SCIM docs cover outbound only", "url": "https://developers.onelogin.com/docs/scim/", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "no OneLogin SSF or CAEP documentation found", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "ping-identity", "name": "Ping Identity (PingOne and PingFederate)", "vendor": "Ping Identity", "group": "workforce", "type": "commercial-idp", "swi_vendor": "iam/ping-identity", "summary": "Ping Identity pairs PingOne, a SaaS identity platform, with PingFederate, self-hosted federation software. PingOne handles app SSO, provisioning connectors and gateways for LDAP, Kerberos and RADIUS, while PingFederate covers SAML, WS-Fed, OIDC and SCIM for on-prem and hybrid estates.", "catalog_url": "https://marketplace.pingone.com", "cells": { "aws": { "status": "yes", "note": "PingOne SAML + SCIM to IAM Identity Center (users only, no group SCIM); PingFederate SCIM guide also exists", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/pingone-idp.html", "checked_on": "2026-11-05" }, "azure": { "status": "yes", "note": "PingOne WS-Fed/WS-Trust federation of Entra ID domain + Microsoft Azure (Office 365) provisioning connector", "url": "https://docs.pingidentity.com/pingone/applications/p1_adding_microsoft_365.html", "checked_on": "2026-11-05" }, "gcp": { "status": "yes", "note": "Workforce Identity Federation with PingFederate (SAML), Google Cloud guide", "url": "https://docs.cloud.google.com/iam/docs/workforce-sign-in-pingfederate", "checked_on": "2026-11-05" }, "workday": { "status": "yes", "note": "PingOne inbound and outbound Workday connector; full-time employees only, no contingent workers", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_workday_connection.html", "checked_on": "2026-11-05" }, "successfactors": { "status": "unknown", "note": "not in PingOne provisioning connector list; documented only for PingOne Advanced Identity Cloud", "url": "https://docs.pingidentity.com/pingone/integrations/p1_provisioning.html", "checked_on": "2026-11-05" }, "bamboohr": { "status": "unknown", "note": "not in PingOne provisioning connector list", "url": "https://docs.pingidentity.com/pingone/integrations/p1_provisioning.html", "checked_on": "2026-11-05" }, "rippling": { "status": "unknown", "note": "not in PingOne provisioning connector list", "url": "https://docs.pingidentity.com/pingone/integrations/p1_provisioning.html", "checked_on": "2026-11-05" }, "ukg": { "status": "unknown", "note": "not in PingOne provisioning connector list", "url": "https://docs.pingidentity.com/pingone/integrations/p1_provisioning.html", "checked_on": "2026-11-05" }, "m365": { "status": "yes", "note": "PingOne WS-Fed (passive) and WS-Trust (active) for Microsoft 365 + Microsoft Azure (Office 365) provisioning connector", "url": "https://docs.pingidentity.com/pingone/applications/p1_adding_microsoft_365.html", "checked_on": "2026-11-05" }, "google_workspace": { "status": "partial", "note": "PingOne outbound provisioning connector; SSO setup page not found", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_google_workspace_connection.html", "checked_on": "2026-11-05" }, "salesforce": { "status": "yes", "note": "PingOne Salesforce provisioning connector; SAML SSO guides for PingFederate and PingOne for Enterprise", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_salesforce_workforce_connection.html", "checked_on": "2026-11-05" }, "slack": { "status": "yes", "note": "PingOne Slack provisioning connector (users and groups); SAML SSO guide for PingFederate", "url": "https://docs.pingidentity.com/pingone/integrations/p1_creating_slack_connection.html", "checked_on": "2026-11-05" }, "github": { "status": "yes", "note": "PingOne GitHub EMU provisioning connector (users and groups); SAML SSO guides for PingFederate", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_github_emu_connection.html", "checked_on": "2026-11-05" }, "atlassian": { "status": "partial", "note": "SAML SSO guides (PingFederate, PingOne for Enterprise); no PingOne Atlassian provisioning connector listed", "url": "https://docs.pingidentity.com/configuration_guides/atlassian_cloud/config_saml_atlassiancloud_p1.html", "checked_on": "2026-11-05" }, "servicenow": { "status": "yes", "note": "PingOne ServiceNow provisioning connector; SAML SSO guide for PingOne for Enterprise", "url": "https://docs.pingidentity.com/pingone/integrations/p1_creating_a_servicenow_connection.html", "checked_on": "2026-11-05" }, "zoom": { "status": "partial", "note": "PingOne Zoom provisioning connector; SSO setup page not found", "url": "https://docs.pingidentity.com/pingone/integrations/p1_creating_zoom_connection.html", "checked_on": "2026-11-05" }, "active_directory": { "status": "yes", "note": "PingOne LDAP Gateway agent, inbound and outbound with AD", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_provisioning_connection_gateway.html", "checked_on": "2026-11-05" }, "ldap": { "status": "yes", "note": "PingOne LDAP Gateway supports AD and PingDirectory only; PingFederate LDAP data stores", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_provisioning_connection_gateway.html", "checked_on": "2026-11-05" }, "kerberos_iwa": { "status": "yes", "note": "PingOne Kerberos via LDAP Gateway with AD; PingFederate Kerberos Adapter", "url": "https://docs.pingidentity.com/pingone/integrations/p1_kerberos_authentication.html", "checked_on": "2026-11-05" }, "radius": { "status": "yes", "note": "PingOne RADIUS gateway (PAP, MS-CHAP v2, EAP-MSCHAPv2); PingFederate RADIUS server", "url": "https://docs.pingidentity.com/pingone/integrations/p1_radius_gateways_intro.html", "checked_on": "2026-11-05" }, "header_based": { "status": "yes", "note": "via PingAccess header identity mappings", "url": "https://docs.pingidentity.com/pingaccess/9.1/pingaccess_user_interface_reference_guide/pa_creating_header_identity_mappings.html", "checked_on": "2026-11-05" }, "onprem_saml_wsfed": { "status": "yes", "note": "PingFederate WS-Fed SP connections (software)", "url": "https://docs.pingidentity.com/pingfederate/13.1/administrators_reference_guide/help_spprotocolsettingstasklet_wsfedserviceurlstate.html", "checked_on": "2026-11-05" }, "saml": { "status": "yes", "note": "PingOne SAML apps; PingFederate SAML 1.0 and 2.0", "url": "https://docs.pingidentity.com/pingone/applications/p1_application_types.html", "checked_on": "2026-11-05" }, "oidc": { "status": "yes", "note": "PingOne OIDC apps; PingFederate OIDC", "url": "https://docs.pingidentity.com/pingone/applications/p1_application_types.html", "checked_on": "2026-11-05" }, "ws_fed": { "status": "yes", "note": "PingFederate full WS-Fed; PingOne WS-Fed for Microsoft 365 only", "url": "https://docs.pingidentity.com/pingfederate/13.1/introduction_to_pingfederate/pf_supported_standards.html", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "yes", "note": "PingOne SCIM 1.1 and 2.0 outbound connection; PingFederate SCIM outbound", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_scim_connection.html", "checked_on": "2026-11-05" }, "scim_inbound": { "status": "yes", "note": "PingOne SCIM 2.0 Users API; PingFederate SCIM inbound provisioning", "url": "https://docs.pingidentity.com/pingone/integrations/p1_create_scim_connection.html", "checked_on": "2026-11-05" }, "ssf_caep": { "status": "unknown", "note": "no SSF or CAEP docs found for PingOne or PingFederate", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" }, { "slug": "zitadel", "name": "ZITADEL", "vendor": "ZITADEL", "group": "workforce", "type": "open-source-idp", "swi_vendor": "open-source/zitadel", "summary": "Open-source identity platform acting as an OIDC and SAML 2.0 IdP, with LDAP and social login as upstream IdPs and a preview SCIM 2.0 server for inbound user provisioning. Service guides cover a small set of targets such as AWS, Google Cloud, Google Workspace and Atlassian.", "catalog_url": "https://zitadel.com/docs/guides/integrate/services", "cells": { "aws": { "status": "partial", "note": "SAML to IAM Identity Center, no provisioning documented", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services/aws-saml" }, "azure": { "status": "unknown", "note": "Entra ID documented only as upstream IdP, not as target", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/identity-providers/azure-ad-oidc" }, "gcp": { "status": "yes", "note": "Workforce Identity Federation via OIDC", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services/google-cloud" }, "workday": { "status": "unknown", "note": "no HR connector in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "successfactors": { "status": "unknown", "note": "no HR connector in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "bamboohr": { "status": "unknown", "note": "no HR connector in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "rippling": { "status": "unknown", "note": "no HR connector in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "ukg": { "status": "unknown", "note": "no HR connector in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "m365": { "status": "unknown", "note": "no Microsoft 365 guide in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "google_workspace": { "status": "partial", "note": "SAML only, no provisioning", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services/google-workspace" }, "salesforce": { "status": "unknown", "note": "no Salesforce guide in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "slack": { "status": "unknown", "note": "no Slack guide in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "github": { "status": "unknown", "note": "GitHub documented only as upstream IdP", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "atlassian": { "status": "partial", "note": "SAML only, no provisioning", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services/atlassian-saml" }, "servicenow": { "status": "unknown", "note": "no ServiceNow guide in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "zoom": { "status": "unknown", "note": "no Zoom guide in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/services" }, "active_directory": { "status": "partial", "note": "via LDAP IdP only, login-time JIT, no sync agent", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/identity-providers/ldap" }, "ldap": { "status": "yes", "note": "LDAP as login IdP with JIT create and update; no LDAP interface", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/integrate/identity-providers/ldap" }, "kerberos_iwa": { "status": "unknown", "note": "not found in docs", "checked_on": "2026-11-05" }, "radius": { "status": "unknown", "note": "not found in docs", "checked_on": "2026-11-05" }, "header_based": { "status": "partial", "note": "via third-party OAuth2 Proxy example", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/examples/identity-proxy/oauth2-proxy" }, "onprem_saml_wsfed": { "status": "partial", "note": "SAML apps only, WS-Fed not in docs", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/apis/saml/endpoints" }, "saml": { "status": "yes", "note": "SAML 2.0 IdP, Redirect and POST bindings", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/apis/saml/endpoints" }, "oidc": { "status": "yes", "note": "OIDC provider with discovery", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/apis/openidoauth/endpoints" }, "ws_fed": { "status": "unknown", "note": "not found in docs", "checked_on": "2026-11-05" }, "scim_outbound": { "status": "unknown", "note": "no outbound SCIM documented", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/apis/scim2" }, "scim_inbound": { "status": "partial", "note": "SCIM 2.0 server, preview, users only, no groups", "checked_on": "2026-11-05", "url": "https://zitadel.com/docs/guides/manage/user/scim2" }, "ssf_caep": { "status": "unknown", "note": "not found in docs", "checked_on": "2026-11-05" } }, "verified_on": "2026-11-05" } ] }