{ "name": "Phishing-Resistant MFA Support Matrix", "publisher": "Start with Identity", "url": "https://startwithidentity.com/tools/mfa-matrix/", "license": "CC BY 4.0", "count": 95, "apps": [ { "slug": "1password", "app": "1Password Business", "vendor": "1Password", "category": "security-it", "swi_vendor": "password-management/1password", "passkeys": "no", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": false, "oidc": true, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "Security keys work as a second factor in place of a six-digit code. The team 2FA policy allows or enforces 2FA with an authenticator app, security key, or Duo, but no setting restricts it to security keys. Passkey sign-in is documented only for new Individual accounts. SSO sign-in is OIDC only, is documented for 1Password Business, and Owners still sign in with account password and Secret Key.", "sources": [ { "title": "1Password: Use a security key for 2FA", "url": "https://support.1password.com/security-key/" }, { "title": "1Password: Manage team policies", "url": "https://support.1password.com/team-policies/" }, { "title": "1Password: Configure SSO sign-in using OpenID Connect", "url": "https://support.1password.com/sso-configure-generic/" }, { "title": "1Password: Automated provisioning", "url": "https://support.1password.com/provisioning/" }, { "title": "1Password Business pricing", "url": "https://1password.com/pricing/business" } ], "verified_on": "2026-10-31" }, { "slug": "adobe-creative-cloud", "app": "Adobe Creative Cloud for business (Admin Console)", "vendor": "Adobe", "category": "design-marketing", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Creative Cloud for enterprise", "sso_tax": "enterprise-only", "scim": "unknown", "notes": "Adobe accounts can add passkeys stored on the device, a phone or a FIDO2 USB security key, and use them to sign in without a password. Admins can enforce 2-step verification org-wide for Enterprise ID and Adobe ID users, but its methods are email, SMS and the Adobe Account Access app. The passkey help articles are written for Adobe accounts in general and do not say whether Enterprise ID users can add passkeys. SSO uses Federated ID, which works with SAML 2.0 or with Microsoft Entra ID over OIDC. Federated ID is not supported on Creative Cloud for teams. Sync is through Entra ID Sync, Google Sync or the User Sync Tool, and the docs never mention SCIM.", "sources": [ { "title": "Passkeys overview | Adobe Account", "url": "https://helpx.adobe.com/account/individual/sign-in-and-security/sign-in-methods/passkeys-overview.html" }, { "title": "Use passkeys for your Adobe account", "url": "https://helpx.adobe.com/account/individual/sign-in-and-security/sign-in-methods/use-passkeys-signing-in-to-adobe-account.html" }, { "title": "Set up two-step verification for Adobe account", "url": "https://helpx.adobe.com/account/individual/sign-in-and-security/security-and-recovery/set-up-two-step-verification.html" }, { "title": "Manage authentication settings", "url": "https://helpx.adobe.com/business/enterprise/identity-sso/set-up-identity/manage-authentication-settings.html" }, { "title": "Identity types in Adobe Admin Console", "url": "https://helpx.adobe.com/business/enterprise/identity-sso/set-up-identity/identity-types.html" }, { "title": "Authenticate your users with Microsoft Entra ID", "url": "https://helpx.adobe.com/business/enterprise/identity-sso/integrate-with-microsoft-entra/sso-setup-azure.html" } ], "verified_on": "2026-10-31" }, { "slug": "adp-workforce-now", "app": "ADP Workforce Now", "vendor": "ADP", "category": "hr-finance", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "All plans (ADP Federated Single Sign-On, free Marketplace edition)", "sso_tax": "none", "scim": "unknown", "notes": "ADP Federated Single Sign-On uses SAML 2.0, covers ADP Workforce Now among other ADP platforms, and is listed at $0 per month on ADP Marketplace (a guided implementation option also exists); clients with 1,000+ employees request it through the Support Center. ADP's public pages do not describe native passkey or security key sign-in, and Workforce Now pricing is quote-based.", "sources": [ { "title": "ADP Federated Single Sign On | ADP Marketplace", "url": "https://apps.adp.com/en-US/apps/370695/adp-federated-single-sign-on" } ], "verified_on": "2026-10-31" }, { "slug": "airtable", "app": "Airtable", "vendor": "Airtable", "category": "productivity", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "Airtable 2FA uses an authenticator app only and needs an Airtable password, so accounts that sign in with Google cannot set it up. Requiring 2FA is an Enterprise Scale admin setting. SAML 2.0 SSO is available on Business and Enterprise Scale. The same SSO article, marked for Business and Enterprise Scale, describes SCIM through Okta, Entra ID or a custom integration, but it does not give a separate plan line for SCIM.", "sources": [ { "title": "Enabling two-factor authentication in Airtable", "url": "https://support.airtable.com/docs/enabling-two-factor-authentication" }, { "title": "Configuring SSO in the admin panel", "url": "https://support.airtable.com/docs/configuring-sso-in-the-admin-panel" }, { "title": "Settings in the Airtable admin panel", "url": "https://support.airtable.com/docs/settings-airtable-admin-panel" } ], "verified_on": "2026-10-31" }, { "slug": "asana", "app": "Asana", "vendor": "Asana", "category": "productivity", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "yes", "notes": "Asana's admin and security page confirms admins can enforce 2FA and SAML, and the pricing page lists SAML authentication and SCIM on Enterprise (the SCIM row is tagged with a permissions management add-on). Asana's help center renders client-side and could not be read, so 2FA methods are unconfirmed.", "sources": [ { "title": "Asana admin and security features", "url": "https://asana.com/features/admin-security" }, { "title": "Asana pricing", "url": "https://asana.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "atlassian-cloud", "app": "Atlassian Cloud (Jira, Confluence)", "vendor": "Atlassian", "category": "collaboration", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Atlassian Guard Standard", "sso_tax": "add-on", "scim": "yes", "notes": "Atlassian accounts support security keys (such as YubiKey) as a 2SV method and passkeys for passwordless sign-in; for managed users admins can allow or block passkeys per authentication policy (blocked by default), but no setting requires passkeys or security keys, and enforced 2SV still allows authenticator apps. SAML SSO and SCIM need the Atlassian Guard Standard subscription, which the Cloud Enterprise plan includes at no extra cost. The user-facing passkey article still says managed accounts cannot use passkeys; the newer admin article is treated as current.", "sources": [ { "title": "Manage two-step verification for your Atlassian account", "url": "https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/" }, { "title": "Manage passkey authentication", "url": "https://support.atlassian.com/security-and-access-policies/docs/manage-passkey-authentication/" }, { "title": "Enforce two-step verification", "url": "https://support.atlassian.com/security-and-access-policies/docs/enforce-two-step-verification/" }, { "title": "Configure SAML single sign-on with an identity provider", "url": "https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/" }, { "title": "Atlassian Guard pricing", "url": "https://www.atlassian.com/software/guard/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "auth0-dashboard", "app": "Auth0 Dashboard", "vendor": "Okta (Auth0)", "category": "security-it", "swi_vendor": "ciam/auth0", "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": true, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "unknown", "notes": "Dashboard users can self-enroll in MFA with WebAuthn FIDO security keys, WebAuthn device biometrics, Guardian push, OTP, or SMS. Auth0 Teams SSO connections and SSO enforcement are for Enterprise tenants only (Early Access on Public Cloud, beta on Private Cloud); team-member accounts are created by JIT. The Teams security policies page says it can enforce MFA but does not describe limiting factors to WebAuthn.", "sources": [ { "title": "Auth0: Add, change, remove MFA for Dashboard users", "url": "https://auth0.com/docs/get-started/manage-dashboard-access/add-change-remove-mfa.md" }, { "title": "Auth0: Teams configure security policies", "url": "https://auth0.com/docs/get-started/auth0-teams/configure-security-policies" }, { "title": "Auth0: Auth0 Teams", "url": "https://auth0.com/docs/get-started/auth0-teams.md" } ], "verified_on": "2026-10-31" }, { "slug": "aws-console", "app": "AWS Management Console", "vendor": "Amazon Web Services", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Root and IAM users can register synced passkeys or FIDO security keys as MFA, up to eight MFA devices per user. IAM policy conditions only test whether MFA is present (aws:MultiFactorAuthPresent, aws:MultiFactorAuthAge) and cannot test the MFA type, so IAM users cannot be held to phishing-resistant methods; IAM Identity Center (no additional charge, SAML 2.0 plus SCIM) does let admins allow only security keys and built-in authenticators.", "sources": [ { "title": "Assign a passkey or security key in the AWS Management Console", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_mfa_enable_fido.html" }, { "title": "AWS global condition context keys", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html" }, { "title": "Available MFA types for IAM Identity Center", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/mfa-types.html" }, { "title": "Choose MFA types for user authentication (IAM Identity Center)", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/how-to-configure-mfa-types.html" }, { "title": "Manage an external identity provider (IAM Identity Center)", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html" }, { "title": "Provision users and groups from an external identity provider using SCIM", "url": "https://docs.aws.amazon.com/singlesignon/latest/userguide/provision-automatically.html" }, { "title": "AWS IAM and IAM Identity Center comparison (pricing: no additional charge)", "url": "https://aws.amazon.com/compare/iam-and-iam-identity-center/" } ], "verified_on": "2026-10-31" }, { "slug": "bamboohr", "app": "BambooHR", "vendor": "BambooHR", "category": "hr-finance", "swi_vendor": null, "passkeys": "yes", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Not stated on pricing page", "sso_tax": "unknown", "scim": "unknown", "notes": "Passkeys work on desktop and in the mobile app for companies using BambooHR's own sign-in; the option is hidden when a company signs in only through SSO. 2-Step Login (authenticator app) is available on all packages; passkey docs mention only device biometrics or PIN, not hardware keys, and do not say admins can require passkeys. SAML works with Okta, OneLogin, Microsoft, or any SAML 2.0 IdP; the pricing page (Core, Pro, Elite) does not list SSO. No plan that includes SSO is documented on the pricing page.", "sources": [ { "title": "BambooHR Passkeys | Product Updates | BambooHR", "url": "https://www.bamboohr.com/product-updates/bamboohr-passkeys" }, { "title": "BambooHR Mobile App Passkeys | Product Updates | BambooHR", "url": "https://www.bamboohr.com/product-updates/mobile-app-passkeys" }, { "title": "2-Step Login | Product Updates | BambooHR", "url": "https://www.bamboohr.com/product-updates/2-step-login" }, { "title": "SAML Optional Email & Password Login | Product Updates | BambooHR", "url": "https://www.bamboohr.com/product-updates/samloptional-email-and-password-login" }, { "title": "BambooHR Plans and Pricing", "url": "https://www.bamboohr.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "bill", "app": "BILL (Bill.com)", "vendor": "BILL Holdings", "category": "hr-finance", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": false, "oidc": false, "sso_plan": "Corporate", "sso_tax": "upper-tier", "scim": "unknown", "notes": "BILL's pricing comparison table lists 'Single sign-on' on Corporate ($89 per user per month) and Enterprise but not Essentials or Team, although the Enterprise plan card also lists SSO as an addition over Corporate. The SSO protocol is not named publicly (saml set false pending confirmation), and the help center renders only with JavaScript, so MFA methods could not be verified; BILL's security page says only that it applies 2-factor authentication.", "sources": [ { "title": "Pricing & Plans | BILL", "url": "https://www.bill.com/product/pricing" }, { "title": "Security and Data Protection | BILL", "url": "https://www.bill.com/product/security" } ], "verified_on": "2026-10-31" }, { "slug": "bitbucket", "app": "Bitbucket Cloud", "vendor": "Atlassian", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Atlassian Guard Standard (add-on)", "sso_tax": "add-on", "scim": "yes", "notes": "Sign-in uses the Atlassian account. Passkeys are blocked by default for managed users, and admins can allow or block them per authentication policy. Policies can require two-step verification but have no setting that limits it to passkeys or security keys. SAML SSO and SCIM need Atlassian Guard Standard ($4.35/user/month); Guard Standard is included with Atlassian Cloud Enterprise.", "sources": [ { "title": "Access your Atlassian account with a passkey", "url": "https://support.atlassian.com/atlassian-account/docs/access-your-atlassian-account-with-a-passkey/" }, { "title": "Manage passkey authentication", "url": "https://support.atlassian.com/security-and-access-policies/docs/manage-passkey-authentication/" }, { "title": "Introducing passkeys and multiple 2-step verification factors", "url": "https://www.atlassian.com/blog/announcements/introducing-passkeys-and-multiple-2-step-verification-factors" }, { "title": "Authentication policy settings for your organizations", "url": "https://support.atlassian.com/security-and-access-policies/docs/authentication-policy-settings-for-your-organizations/" }, { "title": "Atlassian Guard pricing", "url": "https://www.atlassian.com/software/guard/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "bitwarden", "app": "Bitwarden (Teams/Enterprise)", "vendor": "Bitwarden", "category": "security-it", "swi_vendor": "password-management/bitwarden", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "yes", "notes": "FIDO2 WebAuthn two-step login is free for all users, and passkey login works in the web app and Chromium extensions, but not for members of orgs using the Require SSO policy. The Require two-step login policy accepts any method. Login with SSO (SAML 2.0 and OIDC) is for Enterprise organizations; SCIM is available to Teams and Enterprise.", "sources": [ { "title": "Bitwarden: FIDO2 WebAuthn two-step login", "url": "https://bitwarden.com/help/setup-two-step-login-fido/" }, { "title": "Bitwarden: Log in with passkeys", "url": "https://bitwarden.com/help/login-with-passkeys/" }, { "title": "Bitwarden: Enterprise policies", "url": "https://bitwarden.com/help/policies/" }, { "title": "Bitwarden: About SSO", "url": "https://bitwarden.com/help/about-sso/" }, { "title": "Bitwarden: About SCIM", "url": "https://bitwarden.com/help/about-scim/" } ], "verified_on": "2026-10-31" }, { "slug": "box", "app": "Box", "vendor": "Box", "category": "collaboration", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "unknown", "notes": "Box added FIDO2/WebAuthn security keys as an MFA method alongside TOTP apps, SMS and email; local MFA options are not available when the org requires SSO. The admin 'Limit to selected methods' setting lists Security Key and Authenticator app as '(Required)', so it is unclear whether admins can allow security keys only. The docs mention passkeys only in the Box mobile app MFA flow and describe no separate passkey enrollment. SSO (SAML 2.0) is for Business and Enterprise accounts. IdP provisioning is described as Box API based, with no SCIM mention.", "sources": [ { "title": "Multi-Factor Authentication Set Up for Your Account", "url": "https://support.box.com/hc/en-us/articles/360043697154-Multi-Factor-Authentication-Set-Up-for-Your-Account" }, { "title": "Enterprise Settings: Security Tab", "url": "https://support.box.com/hc/en-us/articles/4402040225427-Enterprise-Settings-Security-Tab" }, { "title": "Box introduces support for physical security keys for multi-factor authentication", "url": "https://support.box.com/hc/en-us/articles/48552195714835-Box-introduces-support-for-physical-security-keys-for-multi-factor-authentication" }, { "title": "Setting Up Single-Sign-On (SSO) for Your Organization", "url": "https://support.box.com/hc/en-us/articles/360043696514-Setting-Up-Single-Sign-On-SSO-for-your-Enterprise" } ], "verified_on": "2026-10-31" }, { "slug": "brex", "app": "Brex", "vendor": "Brex (Capital One)", "category": "hr-finance", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": true, "sso_plan": "Premium", "sso_tax": "upper-tier", "scim": "yes", "notes": "Brex added passkey sign-in in July 2026 (admins enable it under Settings > Early Access); a passkey can use Face ID, Touch ID, a device PIN, or a security key and replaces the password and MFA, but it is unavailable for users on SSO. All password sign-ins require MFA; docs do not say admins can require passkeys. SAML or OIDC SSO (OIDC not supported with Entra ID) and SCIM are tagged Premium, Enterprise, and Smart card.", "sources": [ { "title": "Signing into Brex", "url": "https://www.brex.com/support/signing-into-brex" }, { "title": "Sign in with passkey | Brex Product Announcements", "url": "https://www.brex.com/product-announcements/sign-in-with-passkey" }, { "title": "SCIM integration | Brex", "url": "https://www.brex.com/support/scim-integration" }, { "title": "Brex Pricing Plans", "url": "https://www.brex.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "calendly", "app": "Calendly", "vendor": "Calendly", "category": "productivity", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Teams (with SSO add-on)", "sso_tax": "add-on", "scim": "enterprise-only", "notes": "Calendly 2FA supports TOTP authenticator apps only. It may also email a login code when a sign-in looks unusual. The docs do not describe admins requiring 2FA. SAML 2.0 SSO requires the Teams plan with the SSO add-on or the Enterprise plan, and SCIM 2.0 requires Enterprise.", "sources": [ { "title": "How to set up two-factor authentication (2FA)", "url": "https://calendly.com/help/how-to-set-up-two-factor-authentication-2fa" }, { "title": "SAML single sign-on (SSO) overview", "url": "https://calendly.com/help/saml-single-sign-on-sso-overview" }, { "title": "SCIM user provisioning overview", "url": "https://calendly.com/help/scim-user-provisioning-overview" }, { "title": "Calendly pricing", "url": "https://calendly.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "circleci", "app": "CircleCI", "vendor": "CircleCI", "category": "devops-engineering", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Scale", "sso_tax": "enterprise-only", "scim": "unknown", "notes": "Docs state CircleCI supports MFA through authenticator apps only. Users who sign in with GitHub or Bitbucket rely on that provider's MFA. SAML SSO is on the Scale plan, which is contact-sales.", "sources": [ { "title": "Multi-factor authentication", "url": "https://circleci.com/docs/guides/permissions-authentication/mfa/" }, { "title": "SSO overview", "url": "https://circleci.com/docs/guides/permissions-authentication/sso-overview/" }, { "title": "CircleCI pricing", "url": "https://circleci.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "clickup", "app": "ClickUp", "vendor": "ClickUp", "category": "productivity", "swi_vendor": null, "passkeys": "unknown", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "yes", "notes": "ClickUp's pricing comparison lists 2FA via authentication app and via SMS, with Optionally Require 2FA on Business and up, and no security key option. SAML SSO, Microsoft SSO, Okta SSO, and SCIM are Enterprise only. ClickUp's help center blocked automated access, so passkey sign-in could not be confirmed.", "sources": [ { "title": "ClickUp pricing", "url": "https://clickup.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "cloudflare-dashboard", "app": "Cloudflare dashboard", "vendor": "Cloudflare", "category": "cloud-infrastructure", "swi_vendor": "zero-trust/cloudflare", "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "enterprise-only", "notes": "2FA factors are security keys (hardware or built-in WebAuthn authenticators), TOTP, and email codes. Super Administrators can require 2FA but cannot limit it to security keys. Dashboard SSO is free on all plans through a Zero Trust organization on any tier, including Free; any Zero Trust IdP can be used, generic OIDC included. SCIM is Enterprise-only and works with Okta and Entra.", "sources": [ { "title": "Two-factor authentication (Cloudflare docs)", "url": "https://developers.cloudflare.com/fundamentals/user-profiles/2fa/" }, { "title": "Log in to Cloudflare", "url": "https://developers.cloudflare.com/fundamentals/user-profiles/login/" }, { "title": "Dashboard SSO", "url": "https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/" }, { "title": "Generic OIDC identity provider (Cloudflare One)", "url": "https://developers.cloudflare.com/cloudflare-one/integrations/identity-providers/generic-oidc/" }, { "title": "SCIM provisioning", "url": "https://developers.cloudflare.com/fundamentals/account/account-security/scim-setup/" } ], "verified_on": "2026-10-31" }, { "slug": "coda", "app": "Coda", "vendor": "Superhuman", "category": "productivity", "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Optional 2FA is TOTP authenticator app only and applies only to email and password logins; Google, Microsoft, Apple and magic-link sign-in are also offered. SAML SSO and SCIM are Enterprise only, and Enterprise admins can turn off other sign-in options. coda.io/pricing now redirects to Superhuman Docs pricing.", "sources": [ { "title": "Coda Help: Protect your Coda account using 2FA", "url": "https://help.coda.io/hc/en-us/articles/39555860984845-Protect-your-Coda-account-using-2FA" }, { "title": "Coda Help: Manage sign-in options for your org", "url": "https://help.coda.io/hc/en-us/articles/39555741801101-Manage-sign-in-options-for-your-org" }, { "title": "Coda Help: Set up SSO for your org", "url": "https://help.coda.io/hc/en-us/articles/39629608416013-Set-up-SSO-for-your-org" }, { "title": "Coda Help: Configure SCIM for provisioning", "url": "https://help.coda.io/hc/en-us/articles/39555902374797-Configure-SCIM-for-provisioning" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "confluent-cloud", "app": "Confluent Cloud", "vendor": "Confluent", "category": "data-analytics", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Local-account MFA is FIDO2 only (security key, biometric authenticator or passkey), so when an OrganizationAdmin requires MFA every local user must use a phishing-resistant factor; Sign-in with Google or GitHub accounts and SSO users are outside this MFA. SAML SSO is listed on Basic and higher clusters, OIDC SSO is limited to Azure Marketplace, and SCIM needs the paid Advanced Security add-on.", "sources": [ { "title": "Manage Multi-Factor Authentication with FIDO2 for Local User Accounts on Confluent Cloud", "url": "https://docs.confluent.io/cloud/current/security/authenticate/user-identities/user-accounts/multi-factor-auth.html" }, { "title": "Use Single Sign-On (SSO) for Authentication on Confluent Cloud", "url": "https://docs.confluent.io/cloud/current/security/authenticate/user-identities/user-idps/sso/overview.html" }, { "title": "SCIM User Provisioning on Confluent Cloud", "url": "https://docs.confluent.io/cloud/current/security/authenticate/user-identities/user-idps/sso/scim.html" }, { "title": "Confluent Cloud Pricing", "url": "https://www.confluent.io/confluent-cloud/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "databricks", "app": "Databricks", "vendor": "Databricks", "category": "data-analytics", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Premium", "sso_tax": "none", "scim": "yes", "notes": "Databricks-managed MFA (passkeys, security keys, authenticator apps) can be set to Required, Recommended or Disabled in the account console, but there is no documented way to exclude authenticator apps. It is only available when SSO is not configured; with unified-login SSO (SAML 2.0 or OIDC), MFA moves to the IdP, and Premium is now the lowest platform tier.", "sources": [ { "title": "Configure multi-factor authentication | Databricks on AWS", "url": "https://docs.databricks.com/aws/en/security/auth/mfa" }, { "title": "Configure SSO in Databricks | Databricks on AWS", "url": "https://docs.databricks.com/aws/en/security/auth/single-sign-on/" }, { "title": "Manage your subscription (platform tiers) | Databricks on AWS", "url": "https://docs.databricks.com/aws/en/admin/account-settings/account" } ], "verified_on": "2026-10-31" }, { "slug": "datadog", "app": "Datadog", "vendor": "Datadog", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "MFA docs describe only TOTP authenticator apps, one per account. Admins can require MFA for email and password logins but have no documented method restriction. The pricing table lists SAML SSO on Free, Pro and Enterprise infrastructure tiers (enabled through support); SCIM is on Infrastructure Pro and Enterprise.", "sources": [ { "title": "Multi-factor authentication", "url": "https://docs.datadoghq.com/account_management/multi-factor_authentication/" }, { "title": "Single sign-on with SAML", "url": "https://docs.datadoghq.com/account_management/saml/" }, { "title": "SCIM", "url": "https://docs.datadoghq.com/account_management/scim/" }, { "title": "Datadog pricing", "url": "https://www.datadoghq.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "dbt-cloud", "app": "dbt Cloud (dbt platform)", "vendor": "dbt Labs", "category": "data-analytics", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "dbt enforces MFA for every username/password user on all plans; methods are SMS (+1 numbers only), authenticator app or a WebAuthn security key, chosen per user, so admins cannot restrict methods. SSO (SAML 2.0, Okta, Entra ID, Google Workspace) and SCIM need the contact-sales Enterprise or Enterprise+ plan, and the docs do not label any connector as OIDC.", "sources": [ { "title": "Multi-factor authentication | dbt Developer Hub", "url": "https://docs.getdbt.com/docs/platform/manage-access/mfa" }, { "title": "Single sign-on (SSO) overview | dbt Developer Hub", "url": "https://docs.getdbt.com/docs/platform/manage-access/sso-overview" }, { "title": "Set up SCIM | dbt Developer Hub", "url": "https://docs.getdbt.com/docs/platform/manage-access/scim" }, { "title": "dbt Pricing", "url": "https://www.getdbt.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "deel", "app": "Deel", "vendor": "Deel", "category": "hr-finance", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Not stated on pricing page", "sso_tax": "unknown", "scim": "unknown", "notes": "Deel's SAML 2.0 Connect app lets members sign in through Okta, Ping Identity, JumpCloud, OneLogin, or Azure and makes SSO mandatory for every member, replacing password and Google login. The Deel help center (help.letsdeel.com) returned HTTP 403 to automated fetches, so native MFA methods, the SSO plan, and SCIM could not be verified; OIDC is not mentioned. No plan that includes SSO is documented on the pricing page.", "sources": [ { "title": "SAML 2.0 Connect | Deel Marketplace", "url": "https://marketplace.deel.com/apps/saml2_connect" } ], "verified_on": "2026-10-31" }, { "slug": "digitalocean", "app": "DigitalOcean Control Panel", "vendor": "DigitalOcean", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": false, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "unknown", "notes": "Account 2FA is an authenticator app or SMS only. Team owners can 'require secure sign-in', which accepts 2FA, Google sign-in, or GitHub sign-in. Team SSO is OIDC only, with no SAML. DigitalOcean's September 2025 launch release says SSO is included in every plan.", "sources": [ { "title": "How to Manage Two-Factor Authentication for DigitalOcean Accounts", "url": "https://docs.digitalocean.com/platform/accounts/2fa/" }, { "title": "Team Settings (secure sign-in)", "url": "https://docs.digitalocean.com/platform/teams/settings/" }, { "title": "Single Sign-On for DigitalOcean Teams", "url": "https://docs.digitalocean.com/platform/teams/settings/single-sign-on/" }, { "title": "DigitalOcean Launches Single Sign-On (press release)", "url": "https://investors.digitalocean.com/news/news-details/2025/DigitalOcean-Launches-Single-Sign-On-to-Streamline-Cloud-Security-and-Access/default.aspx" } ], "verified_on": "2026-10-31" }, { "slug": "docker-hub", "app": "Docker Hub", "vendor": "Docker", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Docker Business", "sso_tax": "upper-tier", "scim": "enterprise-only", "notes": "The 2FA docs describe only TOTP authenticator apps, one per account, and say organization settings do not include 2FA, so admins can only enforce sign-in through SSO. SSO (SAML 2.0 or OIDC, including Entra ID OIDC) and SCIM need Docker Business ($24/user/month, self-serve).", "sources": [ { "title": "Enable two-factor authentication for your Docker account", "url": "https://docs.docker.com/security/authentication/2fa/" }, { "title": "Single sign-on overview", "url": "https://docs.docker.com/enterprise/security/single-sign-on/" }, { "title": "Connect single sign-on", "url": "https://docs.docker.com/enterprise/security/single-sign-on/connect/" }, { "title": "SCIM provisioning", "url": "https://docs.docker.com/enterprise/security/provisioning/scim/" }, { "title": "Docker pricing", "url": "https://www.docker.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "docusign-esignature", "app": "Docusign eSignature", "vendor": "Docusign", "category": "productivity", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Enhanced plans", "sso_tax": "enterprise-only", "scim": "unknown", "notes": "Users can register a passkey (device biometrics) or a FIDO2 physical security key, either for two-step verification or for passwordless login. Docusign calls passwordless login a new feature that may not be on every account, and it cannot be used where SSO is required. SSO is only on the contact-sales Enhanced plans. Docusign's support center renders only with JavaScript, so admin enforcement, OIDC and SCIM could not be confirmed; SAML is recorded from Docusign's SSO documentation but the protocol page could not be machine-read.", "sources": [ { "title": "Passwordless Login With Security Keys or Passkeys", "url": "https://support.docusign.com/s/document-item?language=en_US&bundleId=jux1643235969954&topicId=niw1651694673085.html" }, { "title": "Register a Passkey or Security Key for Two-Step Verification", "url": "https://support.docusign.com/s/document-item?language=en_US&bundleId=jux1643235969954&topicId=hji1646260776161.html" }, { "title": "eSignature Plans and Pricing | Docusign", "url": "https://ecom.docusign.com/plans-and-pricing/esignature" } ], "verified_on": "2026-10-31" }, { "slug": "dropbox", "app": "Dropbox", "vendor": "Dropbox", "category": "collaboration", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Advanced", "sso_tax": "upper-tier", "scim": "unknown", "notes": "Security keys (FIDO U2F or WebAuthn) work as a 2FA method only on dropbox.com in Chrome or Firefox, not in desktop or mobile apps, and SMS or app codes must be set up first. On team accounts, passkey sign-in stays off until an admin turns it on, and it is unavailable when SSO is required. Admins can require 2FA but cannot require a particular method. SSO is on Advanced, Business Plus and Enterprise team plans. Dropbox help documents Entra ID provisioning but never says SCIM.", "sources": [ { "title": "How to turn 2-factor authentication on and off - Dropbox Help", "url": "https://help.dropbox.com/account-access/enable-2-factor-authentication" }, { "title": "How to use a passkey to log in to your account - Dropbox Help", "url": "https://help.dropbox.com/account-access/passkey-log-in" }, { "title": "How to require two-factor authentication for teams - Dropbox Help", "url": "https://help.dropbox.com/security/two-step-verification" }, { "title": "How to enable single sign-on (SSO) for your team - Dropbox Help", "url": "https://help.dropbox.com/security/sso-admin" }, { "title": "Dropbox plans", "url": "https://www.dropbox.com/plans" } ], "verified_on": "2026-10-31" }, { "slug": "duo-admin-panel", "app": "Duo Admin Panel", "vendor": "Cisco (Duo)", "category": "security-it", "swi_vendor": "mfa/duo", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": false, "sso_plan": "Essentials", "sso_tax": "none", "scim": "unknown", "notes": "Admin login methods include passkeys (security keys and biometrics), Yubikey AES, Duo Push with optional Verified Push, passcodes, SMS and phone; Owners can limit admins to chosen methods under Admin Authentication Methods, so passkeys-only is possible. Administrator SAML SSO is on Duo Essentials, Advantage and Premier (all paid plans, not Duo Free) and is unavailable to Security Cloud Sign-On customers.", "sources": [ { "title": "Duo: Administrators, roles and Admin Login Settings", "url": "https://duo.com/docs/administration-admins" }, { "title": "Duo editions and pricing", "url": "https://duo.com/editions-and-pricing" } ], "verified_on": "2026-10-31" }, { "slug": "elastic-cloud", "app": "Elastic Cloud", "vendor": "Elastic", "category": "data-analytics", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "upper-tier", "scim": "unknown", "notes": "MFA is mandatory for email/password logins and cannot be turned off; methods are authenticator app, security key or biometrics, and email code, and no admin control over methods is documented. Organization-level SSO is SAML only and needs an Enterprise subscription on Elastic Cloud Hosted (it is included on any Serverless tier); OIDC exists only at deployment level, not for the Cloud console.", "sources": [ { "title": "Multifactor authentication | Elastic Docs", "url": "https://www.elastic.co/docs/cloud-account/multifactor-authentication" }, { "title": "Configure Elastic Cloud SAML SSO | Elastic Docs", "url": "https://www.elastic.co/docs/deploy-manage/users-roles/cloud-organization/configure-saml-authentication" } ], "verified_on": "2026-10-31" }, { "slug": "expensify", "app": "Expensify", "vendor": "Expensify", "category": "hr-finance", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Control", "sso_tax": "upper-tier", "scim": "yes", "notes": "Expensify 2FA is TOTP from an authenticator app, on top of an emailed magic code; Domain Admins can require 2FA for all domain members but cannot require a specific method. SAML SSO is a Control plan feature, Domain Admins can turn on 'Require SAML login', and Okta SCIM provisioning is available on request from Concierge.", "sources": [ { "title": "Two Factor Authentication | Expensify Help", "url": "https://help.expensify.com/articles/new-expensify/settings/Two-Factor-Authentication" }, { "title": "Set Up SAML SSO | Expensify Help", "url": "https://help.expensify.com/articles/new-expensify/domains/Set-Up-SAML-SSO" }, { "title": "Compare Collect and Control Plans | Expensify Help", "url": "https://help.expensify.com/articles/new-expensify/billing-and-subscriptions/explore-plans-subscriptions-and-pricing/Compare-Collect-and-Control-Plans" } ], "verified_on": "2026-10-31" }, { "slug": "figma", "app": "Figma", "vendor": "Figma", "category": "design-marketing", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Organization", "sso_tax": "upper-tier", "scim": "yes", "notes": "Figma's own 2FA lists only SMS and authenticator apps (Google Authenticator, Duo Mobile, Authy); no security key or passkey option is documented. Org-wide 2FA requirement needs the Governance+ add-on, which is Enterprise-only, and SSO users must set MFA at their IdP. SAML SSO and SCIM setup are documented for Organization and Enterprise; setting seat types via SCIM is Enterprise-only. The only non-SAML SSO is Google sign-in, so OIDC is recorded as false.", "sources": [ { "title": "Enable two-factor authentication (2FA)", "url": "https://help.figma.com/hc/en-us/articles/360039817634-Enable-two-factor-authentication-2FA" }, { "title": "Set login and authentication method", "url": "https://help.figma.com/hc/en-us/articles/360052497994-Set-login-and-authentication-method" }, { "title": "SAML SSO with OneLogin", "url": "https://help.figma.com/hc/en-us/articles/360040533373-Configure-and-Provision-SAML-SSO-with-OneLogin" }, { "title": "Plans & Pricing | Figma", "url": "https://www.figma.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "freshworks", "app": "Freshworks (Freshdesk, Freshservice)", "vendor": "Freshworks", "category": "support-service", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": true, "sso_plan": "Growth (Freshdesk); Starter (Freshservice)", "sso_tax": "none", "scim": "unknown", "notes": "The Freshworks account supports passwordless passkey sign-in (biometrics, PIN or hardware security key) once an admin turns on Passkey under Default Login Methods; native 2FA uses an authenticator app. Docs do not say whether passkeys can be made mandatory, so enforcement is unknown. SAML, OIDC, OAuth 2.0 and JWT SSO are listed on every paid Freshdesk and Freshservice plan; no SCIM documentation was found.", "sources": [ { "title": "Log in using passkey", "url": "https://support.freshworks.com/support/solutions/articles/50000012801-log-in-using-passkey" }, { "title": "How Can I Enable/Disable Two-Factor Authentication?", "url": "https://support.freshworks.com/support/solutions/articles/50000001025-how-can-i-enable-disable-two-factor-authentication-" }, { "title": "How to Implement Single Sign-On (SSO) for Freshworks?", "url": "https://support.freshworks.com/support/solutions/articles/50000000669-how-to-implement-single-sign-on-sso-for-freshworks-" }, { "title": "Organization Feature - Release Notes", "url": "https://support.freshworks.com/support/solutions/articles/50000000007-organization-feature-release-notes" }, { "title": "Freshdesk pricing", "url": "https://www.freshworks.com/freshdesk/pricing/" }, { "title": "Freshservice pricing", "url": "https://www.freshworks.com/freshservice/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "github", "app": "GitHub", "vendor": "GitHub (Microsoft)", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Org owners can require 2FA and turn on 'Only allow secure two-factor methods', but GitHub counts authenticator apps and GitHub Mobile as secure alongside passkeys and security keys, so admins cannot require phishing-resistant methods only. OIDC is offered only for Enterprise Managed Users with Microsoft Entra ID; SAML and SCIM are on GitHub Enterprise ($21/user/month).", "sources": [ { "title": "About passkeys", "url": "https://docs.github.com/en/authentication/authenticating-with-a-passkey/about-passkeys" }, { "title": "Configuring two-factor authentication", "url": "https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication" }, { "title": "Requiring two-factor authentication in your organization", "url": "https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" }, { "title": "About SAML for enterprise IAM", "url": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/understanding-iam-for-enterprises/about-saml-for-enterprise-iam" }, { "title": "Configuring OIDC for Enterprise Managed Users", "url": "https://docs.github.com/en/enterprise-cloud@latest/admin/managing-iam/configuring-authentication-for-enterprise-managed-users/configuring-oidc-for-enterprise-managed-users" }, { "title": "GitHub pricing", "url": "https://github.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "gitlab", "app": "GitLab.com", "vendor": "GitLab", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Premium", "sso_tax": "none", "scim": "yes", "notes": "Passwordless passkey sign-in became generally available in GitLab 18.9 on all tiers. When a group enforces 2FA, either an authenticator app (TOTP) or WebAuthn satisfies it, so owners cannot require WebAuthn only. Group SAML SSO and SCIM on GitLab.com are on Premium and Ultimate, which are the only paid tiers.", "sources": [ { "title": "Passkeys", "url": "https://docs.gitlab.com/auth/passkeys/" }, { "title": "Two-factor authentication (user)", "url": "https://docs.gitlab.com/user/profile/account/two_factor_authentication/" }, { "title": "Enforce two-factor authentication", "url": "https://docs.gitlab.com/security/two_factor_authentication/" }, { "title": "SAML SSO for GitLab.com groups", "url": "https://docs.gitlab.com/user/group/saml_sso/" }, { "title": "Configure SCIM for GitLab.com groups", "url": "https://docs.gitlab.com/user/group/saml_sso/scim_setup/" } ], "verified_on": "2026-10-31" }, { "slug": "gong", "app": "Gong", "vendor": "Gong", "category": "crm-sales", "swi_vendor": null, "passkeys": "sso-only", "security_keys": "sso-only", "enforce_phishing_resistant": "sso-only", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Gong documents no MFA of its own: sign-in is email and password, Google, Microsoft, Salesforce, SAML SSO or OpenID Connect (Okta, OneLogin), and Gong recommends SSO so the IdP policy applies. Authentication settings and SCIM provisioning are marked \"Available on: Any Gong plan\"; Gong pricing is quote-based.", "sources": [ { "title": "Set sign in method", "url": "https://help.gong.io/docs/set-sign-in-method" }, { "title": "Authentication FAQs", "url": "https://help.gong.io/docs/authentication-faqs" }, { "title": "Gong security, privacy, and compliance controls", "url": "https://help.gong.io/docs/summary-of-security-features" }, { "title": "Provision team members from a custom source (SCIM)", "url": "https://help.gong.io/docs/provision-team-members-from-a-custom-source-scim" } ], "verified_on": "2026-10-31" }, { "slug": "google-cloud-console", "app": "Google Cloud console", "vendor": "Google", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "unknown", "notes": "Console sign-in is a Google account managed through Cloud Identity or Google Workspace. Admins can enforce 2SV with the 'Only security key' method, which now accepts passkeys as well as security keys. SSO from a third-party IdP (SAML or OIDC) is included in Cloud Identity Free, and Google Cloud customers can get Cloud Identity licenses at no cost.", "sources": [ { "title": "Deploy 2-Step Verification (Google Workspace Admin Help)", "url": "https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification" }, { "title": "Set up SSO with a third-party IdP (Google Workspace Admin Help)", "url": "https://knowledge.workspace.google.com/admin/apps/setting-up-sso" }, { "title": "Compare Cloud Identity features and editions", "url": "https://docs.cloud.google.com/identity/docs/editions" } ], "verified_on": "2026-10-31" }, { "slug": "google-workspace", "app": "Google Workspace", "vendor": "Google", "category": "productivity", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "no", "notes": "Workspace accounts can use passkeys to skip passwords and passkeys or security keys for 2-Step Verification; the 2SV enforcement option Only security key accepts both, and admins can limit passkeys to hardware security keys. Workspace can act as a SAML or OIDC service provider to a third-party IdP, and the help pages list no edition restriction for this (the pricing page does not list SSO). Google documents no inbound SCIM endpoint for Workspace itself; IdPs such as Okta provision users through Google's own APIs instead.", "sources": [ { "title": "Deploy 2-Step Verification", "url": "https://knowledge.workspace.google.com/admin/security/deploy-2-step-verification" }, { "title": "Allow users to skip passwords at sign-in", "url": "https://knowledge.workspace.google.com/admin/users/allow-users-to-skip-passwords-at-sign-in" }, { "title": "Setting up SSO", "url": "https://knowledge.workspace.google.com/admin/apps/setting-up-sso" }, { "title": "About SSO", "url": "https://knowledge.workspace.google.com/admin/apps/about-sso" }, { "title": "Okta user provisioning and single sign-on", "url": "https://docs.cloud.google.com/architecture/identity/okta-provisioning-and-single-sign-on" } ], "verified_on": "2026-10-31" }, { "slug": "grafana-cloud", "app": "Grafana Cloud", "vendor": "Grafana Labs", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Pro", "sso_tax": "none", "scim": "yes", "notes": "Cloud Portal MFA is TOTP only; docs state hardware security keys are not supported. Admins can enforce MFA, but social-login users are exempt. SAML on stacks needs Pro or Advanced; stacks also support OAuth/OIDC and SCIM (Okta, Entra ID), while Cloud Portal SAML is in private preview.", "sources": [ { "title": "Set up multi-factor authentication", "url": "https://grafana.com/docs/grafana-cloud/platform/security-and-account-management/security-and-access/authentication-and-permissions/mfa/" }, { "title": "Authentication and permissions", "url": "https://grafana.com/docs/grafana-cloud/platform/security-and-account-management/security-and-access/authentication-and-permissions/" }, { "title": "SAML authentication in Grafana Cloud", "url": "https://grafana.com/blog/saml-authentication-in-grafana-cloud-a-guide-for-easy-configuration/" }, { "title": "Configure SAML authentication", "url": "https://grafana.com/docs/grafana/latest/setup-grafana/configure-access/configure-authentication/saml/" } ], "verified_on": "2026-10-31" }, { "slug": "hcp-terraform", "app": "HCP Terraform (Terraform Cloud)", "vendor": "HashiCorp (IBM)", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "unknown", "notes": "2FA docs describe only a TOTP app plus backup codes. Org owners can require 2FA but have no documented method restriction. SAML SSO is available to all organizations, including Free Edition (with fixed owners and sso teams), and owners can bypass SSO.", "sources": [ { "title": "Two-factor authentication", "url": "https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/2fa" }, { "title": "Single sign-on", "url": "https://developer.hashicorp.com/terraform/cloud-docs/users-teams-organizations/single-sign-on" } ], "verified_on": "2026-10-31" }, { "slug": "heroku", "app": "Heroku Dashboard", "vendor": "Salesforce (Heroku)", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Heroku Teams", "sso_tax": "none", "scim": "unknown", "notes": "MFA is mandatory for all Heroku users. Methods are Salesforce Authenticator, third-party authenticator apps, security keys, built-in authenticators (Windows Hello, Touch ID), and recovery codes. No admin control to restrict methods is documented. SAML 2.0 SSO is for Heroku Teams and Heroku Enterprise customers only, and SSO users must have MFA enforced at their IdP.", "sources": [ { "title": "Multi-Factor Authentication (Heroku Dev Center)", "url": "https://devcenter.heroku.com/articles/multi-factor-authentication" }, { "title": "Single Sign-On (SSO) for Heroku", "url": "https://devcenter.heroku.com/articles/sso-for-heroku" } ], "verified_on": "2026-10-31" }, { "slug": "hubspot", "app": "HubSpot", "vendor": "HubSpot", "category": "crm-sales", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": false, "sso_plan": "Professional", "sso_tax": "upper-tier", "scim": "yes", "notes": "Passkeys work as a login method on all tiers, including FIDO2 hardware tokens such as YubiKey; 2FA is mandatory on paid tiers and also offers authenticator app and SMS. Super Admins can set passkeys as the allowed login method with an enforcement date, though users required to use SSO cannot use passkeys. SAML SSO and SCIM need a Professional or Enterprise subscription (for example Sales Hub Professional); OIDC is not documented.", "sources": [ { "title": "Set up and log in with passkeys", "url": "https://knowledge.hubspot.com/account-management/set-up-and-log-in-with-passkeys" }, { "title": "Set up two-factor authentication for your HubSpot login", "url": "https://knowledge.hubspot.com/account-security/set-up-two-factor-authentication-for-your-hubspot-login" }, { "title": "Restrict which login methods users can use to access your account", "url": "https://knowledge.hubspot.com/account-security/restrict-which-login-methods-users-can-use-to-access-your-account" }, { "title": "Set up single sign-on (SSO)", "url": "https://knowledge.hubspot.com/account-security/set-up-single-sign-on-sso" }, { "title": "Provision HubSpot users with SCIM through Okta", "url": "https://knowledge.hubspot.com/user-management/provision-hubspot-users-with-scim-through-okta" }, { "title": "Sales Hub pricing", "url": "https://www.hubspot.com/pricing/sales" } ], "verified_on": "2026-10-31" }, { "slug": "intercom", "app": "Intercom", "vendor": "Intercom", "category": "support-service", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Expert", "sso_tax": "upper-tier", "scim": "unknown", "notes": "Native 2FA uses authenticator app codes only, and admins can enforce 2FA workspace-wide but not a method. SAML SSO is on the Expert plan and can be made the only login method; OIDC is not documented. SCIM requires SAML SSO, but the SCIM articles only say it is available on certain plans and defer to the pricing page, which lists \"SSO & identity management\" on Expert without naming SCIM.", "sources": [ { "title": "Protect your account with 2FA, Google Sign On or SAML SSO", "url": "https://www.intercom.com/help/en/articles/181-protect-your-account-with-2fa-google-sign-on-or-saml-sso" }, { "title": "Integrate with an identity provider and log in with SAML SSO", "url": "https://www.intercom.com/help/en/articles/3974587-integrate-with-an-identity-provider-and-log-in-with-saml-sso" }, { "title": "System for Cross-domain Identity Management (SCIM) provisioning", "url": "https://www.intercom.com/help/en/articles/5798401-system-for-cross-domain-identity-management-scim-provisioning" }, { "title": "Intercom pricing", "url": "https://www.intercom.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "jamf-pro", "app": "Jamf Pro", "vendor": "Jamf", "category": "security-it", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": true, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "unknown", "notes": "Admins can sign in to Jamf Pro with SAML 2.0 SSO or with OIDC SSO through Jamf Account, or use a Jamf ID with optional MFA. Jamf's FIDO2 page covers Self Service for macOS end users, not admin login. Pricing is by quote and the SSO docs state no plan restriction.", "sources": [ { "title": "Jamf Pro: Enabling SSO with SAML", "url": "https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/Enabling_Single_Sign-On_in_Jamf_Pro?contentId=_GFQsyJMn_BfbOHe8PciAA" }, { "title": "Jamf Pro: SSO with OIDC through Jamf Account", "url": "https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/Jamf_SSO?contentId=2QD~k_oGq~dqyZE3cEyTqw" }, { "title": "Jamf Pro: FIDO2 Authentication", "url": "https://learn.jamf.com/r/en-US/jamf-pro-documentation-current/FIDO2_Authentication?contentId=_yc94GpIG45H~CTwJlRJ3w" } ], "verified_on": "2026-10-31" }, { "slug": "jetbrains-account", "app": "JetBrains Account", "vendor": "JetBrains", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": false, "oidc": false, "sso_plan": "Not offered", "sso_tax": "not-offered", "scim": "unknown", "notes": "2FA docs describe only authenticator-app codes. Organization admins can require 2FA in JetBrains Console but have no documented method restriction. JetBrains Account organization docs describe no SSO; SAML, OIDC and SCIM are documented only for the separate JetBrains IDE Services product.", "sources": [ { "title": "Enabling two-factor authentication", "url": "https://sales.jetbrains.com/hc/en-gb/articles/360013015240" }, { "title": "Two-factor authentication (JetBrains Console)", "url": "https://www.jetbrains.com/help/jetbrains-console/two-factor-authentication.html" }, { "title": "Verified domains", "url": "https://www.jetbrains.com/help/organization-guide/verified-domains.html" } ], "verified_on": "2026-10-31" }, { "slug": "kandji", "app": "Kandji (Iru)", "vendor": "Iru (formerly Kandji)", "category": "security-it", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "yes", "notes": "kandji.io now redirects to iru.com/kandji-mdm; the support site is still branded Kandji. Email and password login enforces MFA, but the only documented method is one TOTP app per user. Admins can disable Standard Authentication so admins must use SAML SSO (Entra, Google, Okta, JumpCloud, OneLogin, custom SAML). SCIM directories are documented for Okta, OneLogin, and Entra ID, but the page does not say whether they provision admins or device users. Pricing is by quote and the SSO docs state no plan restriction.", "sources": [ { "title": "Kandji: MFA for Standard Authentication", "url": "https://support.kandji.io/kb/mfa-for-standard-authentication" }, { "title": "Kandji: Single sign-on", "url": "https://support.kandji.io/kb/single-sign-on" }, { "title": "Kandji: SCIM", "url": "https://support.kandji.io/kb/scim" } ], "verified_on": "2026-10-31" }, { "slug": "lastpass", "app": "LastPass Business", "vendor": "LastPass", "category": "security-it", "swi_vendor": "password-management/lastpass", "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "unknown", "saml": false, "oidc": true, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "Passwordless vault login works on desktop with Windows Hello, Touch ID or a USB security key, and on mobile with device biometrics; Business admins must enable it by policy, and the docs do not call it passkey login. Federated login (Entra ID, Google Workspace, Okta, PingOne, PingFederate, OneLogin, AD) is on Business and Business Max, not Teams; the Okta setup uses an OIDC single-page app plus SCIM provisioning, and no doc read names SAML for vault login.", "sources": [ { "title": "LastPass: Use LastPass passwordless login", "url": "https://community.lastpass.com/kb/articles/65-use-lastpass-passwordless-login%EF%BB%BF" }, { "title": "LastPass: Passwordless authentication", "url": "https://www.lastpass.com/features/passwordless-authentication" }, { "title": "LastPass: Federated login", "url": "https://www.lastpass.com/features/federated-login" }, { "title": "LastPass: Federated login with Okta", "url": "https://www.lastpass.com/features/federated-login/okta-directory" }, { "title": "LastPass: Set up federated login using Okta without an authorization server", "url": "https://community.lastpass.com/kb/articles/61-set-up-lastpass-federated-login-using-okta-without-an-authorization-server%EF%BB%BF" }, { "title": "LastPass pricing", "url": "https://www.lastpass.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "linear", "app": "Linear", "vendor": "Linear", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Login is passwordless: email link or code, Google, passkey, or SAML. On Business and Enterprise, admins can require specific login methods, but the top role (owners or admins) can still log in by any method, and the docs do not confirm passkey-only as an option. SAML and SCIM are Enterprise only.", "sources": [ { "title": "Login methods", "url": "https://linear.app/docs/login-methods" }, { "title": "SAML and access control", "url": "https://linear.app/docs/saml-and-access-control" } ], "verified_on": "2026-10-31" }, { "slug": "linkedin-sales-navigator", "app": "LinkedIn Sales Navigator", "vendor": "LinkedIn (Microsoft)", "category": "crm-sales", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Advanced (sales-assisted purchase)", "sso_tax": "enterprise-only", "scim": "yes", "notes": "Users sign in with their personal LinkedIn account, whose 2FA offers SMS or an authenticator app (plus a mobile sign-in prompt); no passkey or security key option is documented. SAML 2.0 SSO adds a corporate sign-in before the LinkedIn credential check rather than replacing it, and LinkedIn says it does not support OpenID. SSO is on Advanced only when bought through a sales rep and on Advanced Plus; SCIM (Okta, OneLogin, Entra ID) is on Advanced and Advanced Plus.", "sources": [ { "title": "Two-factor authentication overview", "url": "https://www.linkedin.com/help/linkedin/answer/a1358878" }, { "title": "Set Up Single Sign-on (SSO) for Sales Navigator - Overview", "url": "https://www.linkedin.com/help/sales-navigator/answer/a148043" }, { "title": "Sales Navigator account types and features", "url": "https://www.linkedin.com/help/sales-navigator/answer/a104003" }, { "title": "Configure and enable SCIM for Sales Navigator", "url": "https://www.linkedin.com/help/sales-navigator/answer/a1657264" } ], "verified_on": "2026-10-31" }, { "slug": "looker", "app": "Looker", "vendor": "Google Cloud", "category": "data-analytics", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "unknown", "notes": "Looker (original) built-in 2FA is authenticator-app codes only and, when turned on, applies to all email/password users with no exemptions. Looker (Google Cloud core) does not support email/password at all and relies on Google OAuth, SAML, OIDC or Workforce Identity Federation, so on core it is effectively SSO-only; the docs show no edition limit on authentication across Standard, Enterprise and Embed.", "sources": [ { "title": "Two-factor authentication | Looker", "url": "https://docs.cloud.google.com/looker/docs/admin-panel-authentication-two-factor" }, { "title": "Looker (Google Cloud core) feature differences", "url": "https://docs.cloud.google.com/looker/docs/looker-core-feature-differences" }, { "title": "Manage users on Looker (Google Cloud core)", "url": "https://docs.cloud.google.com/looker/docs/looker-core-user-management" }, { "title": "Looker (Google Cloud core) editions", "url": "https://docs.cloud.google.com/looker/docs/looker-core-edition-types" } ], "verified_on": "2026-10-31" }, { "slug": "loom", "app": "Loom", "vendor": "Atlassian", "category": "collaboration", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Loom sign-in uses Atlassian accounts: 2SV supports authenticator apps, SMS and security keys, and org admins can allow passkeys for managed users per authentication policy (blocked by default), but cannot require passkeys or keys. SAML SSO and SCIM are Enterprise-only on Loom pricing; Business plans can buy Atlassian Guard separately.", "sources": [ { "title": "Loom pricing", "url": "https://www.loom.com/pricing" }, { "title": "Configure SSO and Directory Sync (SCIM) | Loom", "url": "https://support.atlassian.com/loom/docs/configure-sso-and-directory-sync-scim/" }, { "title": "Use Loom with an Atlassian account", "url": "https://support.atlassian.com/loom/docs/use-loom-with-an-atlassian-account/" }, { "title": "Access your Atlassian account with a passkey", "url": "https://support.atlassian.com/atlassian-account/docs/access-your-atlassian-account-with-a-passkey/" }, { "title": "Manage two-step verification for your Atlassian account", "url": "https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/" }, { "title": "Manage passkey authentication (Atlassian Administration)", "url": "https://support.atlassian.com/security-and-access-policies/docs/manage-passkey-authentication/" } ], "verified_on": "2026-10-31" }, { "slug": "lucid", "app": "Lucid (Lucidchart, Lucidspark)", "vendor": "Lucid Software", "category": "collaboration", "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Local 2FA uses a third-party TOTP authenticator app, and Enterprise admins can enforce it for email and password users. SAML SSO and SCIM are Enterprise only; Google and Office 365 sign-in are also offered, but no custom OIDC IdP is documented.", "sources": [ { "title": "Lucid admin panel: Security settings", "url": "https://help.lucid.co/hc/en-us/articles/360049421752-Lucid-admin-panel-Security-settings" }, { "title": "Lucid: SAML overview", "url": "https://help.lucid.co/hc/en-us/articles/360049898191-SAML-overview" }, { "title": "Lucid: SCIM overview for Lucid", "url": "https://help.lucid.co/hc/en-us/articles/360049427352-SCIM-overview-for-Lucid" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "mailchimp", "app": "Mailchimp", "vendor": "Intuit", "category": "design-marketing", "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": false, "oidc": true, "sso_plan": "Premium", "sso_tax": "upper-tier", "scim": "unknown", "notes": "Local 2FA is SMS or an authenticator app only; when an Owner or Admin turns on 2FA, all other users must set it up, but no method choice is offered. Enterprise SSO is OIDC only (no SAML, IdP-initiated only), on Premium, with a Require SSO setting. SSO docs describe invitation-based user management and do not mention SCIM.", "sources": [ { "title": "Mailchimp: Set Up a 2-Factor Authentication App at Login", "url": "https://mailchimp.com/help/set-up-a-two-factor-authentication-app-at-login/" }, { "title": "Mailchimp: Set Account Security Options", "url": "https://mailchimp.com/help/set-account-security-options/" }, { "title": "Mailchimp Enterprise SSO User Guide", "url": "https://mailchimp.com/help/mailchimp-enterprise-sso-user-guide/" }, { "title": "Mailchimp: Okta SSO Setup", "url": "https://mailchimp.com/help/okta-sso-setup/" }, { "title": "Mailchimp marketing pricing", "url": "https://mailchimp.com/pricing/marketing/" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "microsoft-365", "app": "Microsoft 365", "vendor": "Microsoft", "category": "productivity", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Microsoft 365 sign-in is Microsoft Entra ID, which supports synced passkeys and device-bound passkeys on FIDO2 security keys or in Microsoft Authenticator in all editions, including Entra ID Free. Requiring them needs the built-in Phishing-resistant MFA authentication strength in Conditional Access, which needs Entra ID P1 (included in Microsoft 365 Business Premium and E3/E5, not Business Basic or Standard). Tenants can federate custom domains to a third-party SAML 2.0 or WS-Fed IdP; SCIM-format inbound provisioning (API-driven inbound provisioning) also needs Entra ID P1, which is included in Microsoft 365 Business Premium.", "sources": [ { "title": "How to enable passkeys (FIDO2) in Microsoft Entra ID", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2" }, { "title": "Overview of Conditional Access authentication strengths", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths" }, { "title": "Microsoft 365 for business security overview", "url": "https://learn.microsoft.com/en-us/microsoft-365/admin/security-and-compliance/m365b-security-overview?view=o365-worldwide" }, { "title": "Microsoft Entra Connect: Use a SAML 2.0 Identity Provider for Single Sign On", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp" }, { "title": "API-driven inbound provisioning concepts", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts" } ], "verified_on": "2026-10-31" }, { "slug": "azure-portal", "app": "Microsoft Azure portal", "vendor": "Microsoft", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Portal sign-in is Microsoft Entra ID. Passkeys (FIDO2, synced or device-bound) are in all editions including Entra ID Free, and MFA is mandatory for Azure portal sign-in. Restricting sign-in to the built-in Phishing-resistant MFA strength needs Conditional Access (Entra ID P1). Federation to an external IdP is documented for AD FS, PingFederate, and SAML/WS-Fed. API-driven inbound provisioning (SCIM schema payloads) needs P1 or P2.", "sources": [ { "title": "How to enable passkeys (FIDO2) in Microsoft Entra ID", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-passkey-fido2" }, { "title": "Overview of Conditional Access authentication strengths", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths" }, { "title": "Plan for mandatory Microsoft Entra MFA", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication" }, { "title": "What is federation with Microsoft Entra ID?", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/whatis-fed" }, { "title": "API-driven inbound provisioning concepts", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts" } ], "verified_on": "2026-10-31" }, { "slug": "microsoft-entra-admin-center", "app": "Microsoft Entra admin center", "vendor": "Microsoft", "category": "security-it", "swi_vendor": "iam/microsoft-entra", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": false, "sso_plan": "Microsoft Entra ID Free", "sso_tax": "none", "scim": "yes", "notes": "Passkeys (FIDO2) include device-bound passkeys in Microsoft Authenticator. The built-in Phishing-resistant MFA authentication strength (FIDO2 key, Windows Hello for Business or platform credential, multifactor CBA) can be required for all users through Conditional Access, which needs Entra ID P1. For an IdP product, SAML means a verified domain can be federated to a third-party SAML 2.0 (or WS-Fed) IdP; Microsoft Entra Connect is listed as free, and no OIDC federation for member sign-in is documented. SCIM: API-driven inbound provisioning accepts SCIM-schema bulk payloads and needs P1.", "sources": [ { "title": "Microsoft Learn: Conditional Access authentication strengths", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-strengths" }, { "title": "Microsoft Learn: Passkeys in Authenticator", "url": "https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-enable-authenticator-passkey" }, { "title": "Microsoft Learn: Use a SAML 2.0 IdP for single sign-on", "url": "https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp" }, { "title": "Microsoft Learn: Microsoft Entra licensing", "url": "https://learn.microsoft.com/en-us/entra/fundamentals/licensing" }, { "title": "Microsoft Learn: API-driven inbound provisioning", "url": "https://learn.microsoft.com/en-us/entra/identity/app-provisioning/inbound-provisioning-api-concepts" } ], "verified_on": "2026-10-31" }, { "slug": "miro", "app": "Miro", "vendor": "Miro", "category": "collaboration", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "enterprise-only", "notes": "Miro's pricing page lists 2FA on all plans, SAML single sign-on from Business, and SCIM user provisioning on Enterprise only. Miro's help center blocked automated access, so 2FA methods and method enforcement are unconfirmed.", "sources": [ { "title": "Miro pricing", "url": "https://miro.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "monday-com", "app": "monday.com", "vendor": "monday.com", "category": "productivity", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "yes", "notes": "monday.com's Security and Privacy white paper (V2.3, linked from monday.com/security) lists 2FA by SMS or authenticator app only, with no passkeys or security keys; Google SSO is on Pro and Enterprise. Okta, Entra ID, OneLogin, Oracle, and custom SAML 2.0 SSO plus SCIM are Enterprise only.", "sources": [ { "title": "monday.com Security and Privacy white paper V2.3", "url": "https://dapulse-res.cloudinary.com/image/upload/v1789569403/Generator_featured%20images/Trust%20center/Security_and_Privacy_white_paper_V2.3.pdf" }, { "title": "monday.com security", "url": "https://monday.com/security" }, { "title": "monday.com pricing", "url": "https://monday.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "mongodb-atlas", "app": "MongoDB Atlas", "vendor": "MongoDB", "category": "data-analytics", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "unknown", "notes": "MFA is required for Atlas credentials; factors are security key or biometrics (FIDO2, Windows Hello), Okta Verify, authenticator app and email, with SMS closed to new users. Org owners can require MFA but no setting to limit methods is documented. SAML SSO for the Atlas UI is ticked on the Free, Flex and Dedicated tiers, while OIDC (Workforce Identity Federation) covers database access only.", "sources": [ { "title": "Manage Your Multi-Factor Authentication Options - Atlas", "url": "https://www.mongodb.com/docs/atlas/security-multi-factor-authentication/" }, { "title": "Guidance for Atlas Authentication - Atlas Architecture Center", "url": "https://www.mongodb.com/docs/atlas/architecture/current/auth/authentication/" }, { "title": "Manage Identity Providers (Federated Authentication) - Atlas", "url": "https://www.mongodb.com/docs/atlas/security/manage-federated-auth/" }, { "title": "MongoDB Pricing", "url": "https://www.mongodb.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "netlify", "app": "Netlify app", "vendor": "Netlify", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Native 2FA is an authenticator app only, and Netlify itself recommends FIDO2 through an identity provider via SSO. 2FA enforcement (None, Encouraged, Enforced) is available on Pro and higher. Team and Organization SAML SSO and SCIM Directory Sync are Enterprise only.", "sources": [ { "title": "User settings (Netlify docs)", "url": "https://docs.netlify.com/manage/accounts-and-billing/user-settings/" }, { "title": "Enforce 2FA (Netlify docs)", "url": "https://docs.netlify.com/manage/security/secure-netlify-access/enforce-2fa/" }, { "title": "Configure Team SAML SSO (Netlify docs)", "url": "https://docs.netlify.com/manage/security/secure-netlify-access/configure-team-saml-sso/" }, { "title": "Directory Sync (Netlify docs)", "url": "https://docs.netlify.com/manage/security/secure-netlify-access/directory-sync/" } ], "verified_on": "2026-10-31" }, { "slug": "netsuite", "app": "NetSuite", "vendor": "Oracle", "category": "hr-finance", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "unknown", "notes": "All roles can sign in with a passkey instead of a password; Oracle describes passkeys as physical or digital and recommends FIDO2-compliant, FIDO-certified ones. From 2026.2 a FIDO2 passkey can satisfy 2FA, but an authenticator app code is still requested every three months and admins can only disable passkey-as-2FA, not require it. NetSuite has no public pricing page and the docs give no cost for SSO, so sso_tax is unconfirmed; no native SCIM endpoint is documented.", "sources": [ { "title": "NetSuite Help: Passkeys", "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/article_0624120652.html" }, { "title": "NetSuite Help: Two-Factor Authentication (2FA)", "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_N327688.html" }, { "title": "NetSuite Help: Authentication Overview", "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_4369651411.html" }, { "title": "NetSuite Help: SAML Single Sign-on", "url": "https://docs.oracle.com/en/cloud/saas/netsuite/ns-online-help/chapter_N3825119.html" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "new-relic", "app": "New Relic", "vendor": "New Relic", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Standard", "sso_tax": "none", "scim": "yes", "notes": "Admins can turn on MFA per authentication domain, but the documented method is email verification with backup codes, which is not phishing-resistant. SAML SSO requires a paid edition, and the pricing page lists it on Standard; SCIM requires Pro or Enterprise.", "sources": [ { "title": "Authentication domains: SAML SSO, SCIM, and more", "url": "https://docs.newrelic.com/docs/accounts/accounts-billing/new-relic-one-user-management/authentication-domains-saml-sso-scim-more/" }, { "title": "New Relic pricing", "url": "https://newrelic.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "notion", "app": "Notion", "vendor": "Notion Labs", "category": "productivity", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "enterprise-only", "notes": "Passkeys work on all plans, including FIDO2 security keys such as YubiKey, but Notion says workspace owners cannot enforce passkeys, and passkeys are unavailable when the organization requires IdP login. 2-step verification offers authenticator codes or SMS, and only Enterprise owners can require MFA, for guests only. SAML SSO starts on Business; SCIM is Enterprise only.", "sources": [ { "title": "Passkeys", "url": "https://www.notion.com/help/passkeys" }, { "title": "Two-step verification", "url": "https://www.notion.com/help/two-step-verification" }, { "title": "SAML SSO configuration", "url": "https://www.notion.com/help/saml-sso-configuration" }, { "title": "Notion pricing", "url": "https://www.notion.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "npm", "app": "npm (npmjs.com)", "vendor": "GitHub (Microsoft)", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": false, "oidc": false, "sso_plan": "Not offered", "sso_tax": "not-offered", "scim": "no", "notes": "Since October 2025, new 2FA setups must use WebAuthn or passkeys as a second factor, and new TOTP setups are disabled. Existing TOTP still works for now, and org owners can require 2FA but cannot restrict which method members use. npm organization docs describe no SSO or SCIM.", "sources": [ { "title": "Configuring two-factor authentication", "url": "https://docs.npmjs.com/configuring-two-factor-authentication" }, { "title": "Strengthening npm security: changes to authentication and token management", "url": "https://github.blog/changelog/2025-10-10-strengthening-npm-security-important-changes-to-authentication-and-token-management" }, { "title": "Requiring two-factor authentication in your organization", "url": "https://docs.npmjs.com/requiring-two-factor-authentication-in-your-organization" }, { "title": "Organizations", "url": "https://docs.npmjs.com/organizations" } ], "verified_on": "2026-10-31" }, { "slug": "okta-admin-console", "app": "Okta Admin Console", "vendor": "Okta", "category": "security-it", "swi_vendor": "iam/okta", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "Starter", "sso_tax": "none", "scim": "unknown", "notes": "Okta FastPass and the FIDO2 WebAuthn passkey authenticator are phishing resistant, and the Okta Admin Console app sign-in policy can require a phishing-resistant possession factor. SAML and OIDC here mean admins can sign in through an external IdP added under Identity Providers; the pricing page lists SSO from Starter up but does not say which plan includes inbound IdP routing.", "sources": [ { "title": "Okta: Phishing-resistant authentication", "url": "https://help.okta.com/oie/en-us/content/topics/identity-engine/authenticators/phishing-resistant-auth.htm" }, { "title": "Okta: Enable MFA for the Admin Console", "url": "https://help.okta.com/oie/en-us/content/topics/security/mfa/mfa-enable-admins.htm" }, { "title": "Okta: Identity Providers", "url": "https://help.okta.com/en-us/content/topics/security/identity_providers.htm" }, { "title": "Okta pricing", "url": "https://www.okta.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "outreach", "app": "Outreach", "vendor": "Outreach", "category": "crm-sales", "swi_vendor": null, "passkeys": "sso-only", "security_keys": "sso-only", "enforce_phishing_resistant": "sso-only", "saml": true, "oidc": false, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "yes", "notes": "Outreach states that MFA options are not available directly in the platform, so phishing-resistant sign-in depends on the SAML IdP; once SSO is on it is the only way in. No plan that includes SSO or SCIM is documented in the help center or on the pricing page. The SCIM API document is marked as subject to change after beta.", "sources": [ { "title": "How to configure password policies", "url": "https://support.outreach.io/support/solutions/articles/159000426279-how-to-configure-password-policies" }, { "title": "Outreach Single Sign On (SSO) FAQ", "url": "https://support.outreach.io/support/solutions/articles/159000426332-outreach-single-sign-on-sso-faq" }, { "title": "Setting up other SAML IdP (SSO)", "url": "https://support.outreach.io/support/solutions/articles/159000425879-setting-up-other-saml-idp-sso-" }, { "title": "Outreach SCIM Protocol", "url": "https://support.outreach.io/support/solutions/articles/159000426344-outreach-scim-protocol" }, { "title": "Outreach pricing", "url": "https://www.outreach.ai/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "pagerduty", "app": "PagerDuty", "vendor": "PagerDuty", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Professional", "sso_tax": "none", "scim": "yes", "notes": "Docs describe no native MFA for username and password login, and the security hygiene guidance points to passwords plus SSO. SSO (SAML or Google) is on Professional, Business and Enterprise for Incident Management, and SCIM is on all plans.", "sources": [ { "title": "Single Sign-On (SSO)", "url": "https://docs.pagerduty.com/account-admin/sso" }, { "title": "SCIM user provisioning", "url": "https://docs.pagerduty.com/account-admin/manage-users/scim-user-provisioning" }, { "title": "Security hygiene for the current cyber threat landscape", "url": "https://docs.pagerduty.com/account-admin/security-hygiene-for-the-current-cyber-threat-landscape" } ], "verified_on": "2026-10-31" }, { "slug": "pipedrive", "app": "Pipedrive", "vendor": "Pipedrive", "category": "crm-sales", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All plans", "sso_tax": "none", "scim": "no", "notes": "Native 2FA uses an authenticator app or email verification; no passkey or security key option is documented. Enforcing 2FA for all users is a security rule on the Ultimate plan. SAML SSO is available on all plans and can be enforced; the help center has no SCIM documentation and its SSO guides describe manual user assignment in the IdP. The pricing page blocked automated fetches, so plan names were not confirmed there.", "sources": [ { "title": "2FA (Two-factor authentication)", "url": "https://support.pipedrive.com/en/article/2fa-two-factor-authentication" }, { "title": "Single sign-on", "url": "https://support.pipedrive.com/en/article/single-sign-on" }, { "title": "Security features in Pipedrive", "url": "https://support.pipedrive.com/en/article/security-features-in-pipedrive" } ], "verified_on": "2026-10-31" }, { "slug": "postman", "app": "Postman", "vendor": "Postman", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Team with Simple Security add-on", "sso_tax": "add-on", "scim": "enterprise-only", "notes": "Account docs describe 2FA only through an authenticator app for password sign-ins and describe no admin method restriction. SAML 2.0 SSO comes with Enterprise or Team plus the Simple Security add-on; SCIM is Enterprise only.", "sources": [ { "title": "Account settings", "url": "https://learning.postman.com/docs/getting-started/installation/account/settings" }, { "title": "Intro to SSO", "url": "https://learning.postman.com/docs/administration/sso/intro-sso/" }, { "title": "SCIM provisioning overview", "url": "https://learning.postman.com/docs/administration/scim-provisioning/scim-provisioning-overview" } ], "verified_on": "2026-10-31" }, { "slug": "pypi", "app": "PyPI", "vendor": "Python Software Foundation", "category": "devops-engineering", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": false, "oidc": false, "sso_plan": "Not offered", "sso_tax": "not-offered", "scim": "no", "notes": "2FA has been mandatory for all accounts since 2024, using a FIDO/WebAuthn security device (preferred) or a TOTP app, so phishing-resistant methods are not required. Organization account docs describe no SSO, SCIM, or 2FA-method policy.", "sources": [ { "title": "Two-factor authentication", "url": "https://docs.pypi.org/your-account/two-factor-authentication/" }, { "title": "Organization accounts", "url": "https://docs.pypi.org/organization-accounts/" }, { "title": "Organization accounts FAQ", "url": "https://docs.pypi.org/organization-accounts/org-acc-faq/" } ], "verified_on": "2026-10-31" }, { "slug": "quickbooks-online", "app": "QuickBooks Online", "vendor": "Intuit", "category": "hr-finance", "passkeys": "yes", "security_keys": "unknown", "enforce_phishing_resistant": "no", "saml": false, "oidc": false, "sso_plan": "Intuit Enterprise Suite", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Users can add passkeys to their Intuit Account and sign in without a password or one-time code; Intuit docs do not mention hardware security keys and describe no admin control over sign-in methods. Organization SSO (Entra ID, Google Workspace, Okta) with SCIM is free only for Intuit Enterprise Suite, Intuit Accountant Suite and QuickBooks Online Accountant, not the Simple Start to Advanced plans; the help article does not name the protocol, so saml and oidc are left false.", "sources": [ { "title": "Use passkeys to sign in to your Intuit Account", "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/multi-factor-authentication/use-passkeys-sign-intuit-account/L1CoQYJWE_US_en_US" }, { "title": "Secure your Intuit Account and prevent lockout with extra verification methods", "url": "https://quickbooks.intuit.com/learn-support/en-us/help-articles/verify-your-account-with-multi-factor-authentication/00/261914" }, { "title": "Set up single sign-on for your organization", "url": "https://quickbooks.intuit.com/learn-support/en-us/help-article/offboarding/set-single-sign-organization/L4IlUaXB5_US_en_US" }, { "title": "QuickBooks pricing", "url": "https://quickbooks.intuit.com/pricing/" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "ramp", "app": "Ramp", "vendor": "Ramp", "category": "hr-finance", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Free", "sso_tax": "none", "scim": "yes", "notes": "Users can register up to 6 passkeys, including a security key such as a YubiKey (Chrome or Edge; Safari skips that option), and a passkey replaces both the password and the MFA step. Ramp states admins cannot require passkeys, but admins can set sign-in methods per role and require SAML (Okta, Entra ID, OneLogin, JumpCloud, others) or Google SSO; the pricing page marks 'Secure logins with SCIM, SSO, and SAML' on Free, Plus, and Enterprise.", "sources": [ { "title": "Signing in with Passkeys | Ramp Help Center", "url": "https://support.ramp.com/logging-in-with-passkeys" }, { "title": "SSO, Sign-In Controls, and MFA in Ramp | Ramp Help Center", "url": "https://support.ramp.com/setting-up-single-sign-on-sso-and-login-controls-in-ramp" }, { "title": "Okta integration: Set up SAML SSO | Ramp Help Center", "url": "https://support.ramp.com/set-up-ramps-saml-sso-integration-with-okta" }, { "title": "Ramp Pricing and Plans", "url": "https://ramp.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "rippling", "app": "Rippling", "vendor": "Rippling", "category": "hr-finance", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": false, "oidc": false, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "unknown", "notes": "Rippling authentication policies can require MFA per group or per employee, and Rippling's own pages give the example of requiring YubiKeys for admins and recommend a hardware security key for SuperAdmins; Rippling lists YubiKey, passkeys, and authenticator apps among its MFA methods. Inbound SAML/OIDC into Rippling and SCIM could not be confirmed because the help center renders only with JavaScript, so saml/oidc are false pending confirmation. Pricing is quote-based and authentication policies are described under Rippling IT (Identity and Access). No plan that includes SSO is documented on the pricing page.", "sources": [ { "title": "Best Identity and Access Management Software | Rippling", "url": "https://www.rippling.com/products/it/identity-access-management" }, { "title": "7 powerful and simple steps to secure your Rippling tenant", "url": "https://www.rippling.com/blog/seven-powerful-simple-steps-to-secure-your-rippling-tenant" }, { "title": "Best 10 Multi-Factor Authentication (MFA) Providers for 2025 | Rippling", "url": "https://www.rippling.com/blog/mfa-providers" } ], "verified_on": "2026-10-31" }, { "slug": "salesforce-sales-cloud", "app": "Salesforce Sales Cloud", "vendor": "Salesforce", "category": "crm-sales", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Passkeys (built-in authenticators and synced passkeys) and WebAuthn security keys are MFA methods for direct login. Salesforce itself enforces phishing-resistant MFA for privileged users (admins and users with Modify All Data, View All Data, Customize Application or Author Apex) from July to September 2026, but non-privileged users can still choose Salesforce Authenticator or TOTP apps and no org-wide phishing-resistant-only setting is documented. Help docs list Federated Authentication (SAML) and SCIM as available in all editions; the Sales Cloud pricing page (Free Suite, Starter Suite, Pro Suite, Core, Advanced, Max) does not list SSO.", "sources": [ { "title": "MFA Verification Methods for Direct Salesforce Login", "url": "https://help.salesforce.com/s/articleView?id=xcloud.mfa_supported_verification_methods.htm&language=en_US&type=5" }, { "title": "Prepare for Phishing-Resistant MFA Enforcement for Privileged Users including Admins", "url": "https://help.salesforce.com/s/articleView?id=005321563&language=en_US&type=1" }, { "title": "Single Sign-On", "url": "https://help.salesforce.com/s/articleView?id=sf.sso_about.htm&language=en_US&type=5" }, { "title": "Manage Salesforce User Identities with SCIM", "url": "https://help.salesforce.com/s/articleView?id=xcloud.identity_scim_overview.htm&language=en_US&type=5" }, { "title": "Sales Cloud Pricing", "url": "https://www.salesforce.com/sales/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "sentry", "app": "Sentry", "vendor": "Functional Software (Sentry)", "category": "devops-engineering", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "2FA options are SMS, TOTP, and a WebAuthn factor labeled 'Passkey / Biometric / Security Key', used as a second factor. Owners can require 2FA but have no documented method restriction. Google and GitHub SSO are on Team; SAML2 and SCIM are on Business and Enterprise.", "sources": [ { "title": "Sentry WebAuthn authenticator (u2f.py)", "url": "https://github.com/getsentry/sentry/blob/master/src/sentry/auth/authenticators/u2f.py" }, { "title": "Require two-factor authentication", "url": "https://docs.sentry.io/organization/authentication/two-factor-authentication/" }, { "title": "Single sign-on", "url": "https://docs.sentry.io/organization/authentication/sso/" }, { "title": "Sentry pricing", "url": "https://sentry.io/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "servicenow", "app": "ServiceNow", "vendor": "ServiceNow", "category": "support-service", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "All plans (quote-based subscriptions)", "sso_tax": "none", "scim": "yes", "notes": "Instance MFA supports FIDO2/WebAuthn with biometrics, passkeys or hardware security keys, alongside TOTP, SMS and email factors. Admins can create a FIDO2 MFA factor policy targeted by role or group, which suppresses other factors for matching users. Multi-Provider SSO (SAML 2.0 and OIDC) and the SCIM v2 provider are platform plugins; ServiceNow publishes no plan-based pricing, and the docs do not tie them to a subscription tier.", "sources": [ { "title": "FIDO2 as an MFA factor", "url": "https://www.servicenow.com/docs/r/platform-security/authentication/mfa-with-fido.html?contentId=ml2NQaFwCwMf2SWdu9JovQ" }, { "title": "Web Authentication - MFA", "url": "https://www.servicenow.com/docs/r/platform-security/authentication/web-authentication-mfa.html?contentId=Ua7rDFW2cmT~SxhQ5eA02g" }, { "title": "Multi-Provider Single Sign-On", "url": "https://www.servicenow.com/docs/r/platform-security/authentication/c_MultipleProviderSingleSignOn.html?contentId=zDFjD9AGznQc07k9rrcBog" }, { "title": "SCIM Provider", "url": "https://www.servicenow.com/docs/r/platform-security/identity/scim-provider.html?contentId=WKbhQIVsaZmWv_84B3yO4w" } ], "verified_on": "2026-10-31" }, { "slug": "shopify-admin", "app": "Shopify admin", "vendor": "Shopify", "category": "design-marketing", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Plus", "sso_tax": "upper-tier", "scim": "yes", "notes": "Shopify accounts can sign in with passkeys and use WebAuthn security keys or authenticator apps for two-step authentication; new SMS enrollment is closed. Plus organizations can require a secure sign-in method for all users, but not a specific one, so phishing-resistant enforcement needs SAML set to Required. SAML and SCIM API tokens are Plus-only.", "sources": [ { "title": "Shopify Help: Securing your account with two-step authentication", "url": "https://help.shopify.com/en/manual/your-account/logging-in/two-step-authentication" }, { "title": "Shopify Help: Passkeys", "url": "https://help.shopify.com/en/manual/your-account/logging-in/passkeys" }, { "title": "Shopify Help: SAML authentication", "url": "https://help.shopify.com/en/manual/organization-settings/security/saml" }, { "title": "Shopify Help: Organization security", "url": "https://help.shopify.com/en/manual/organization-settings/security" }, { "title": "Shopify pricing", "url": "https://www.shopify.com/pricing" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "slack", "app": "Slack", "vendor": "Salesforce", "category": "collaboration", "swi_vendor": null, "passkeys": "yes", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Business+", "sso_tax": "upper-tier", "scim": "yes", "notes": "Slack's help center lists passkeys (Face ID, fingerprint, or PIN) as a way to confirm identity at email sign-in, and Slack's changelog says passkey sign-in reached Free, Pro, and Business+ workspaces in September 2026. Slack's 2FA article covers only authenticator apps and SMS and says Slack does not support U2F, so no security keys; owners can require 2FA and block SMS, but cannot require passkeys. SSO is SAML only.", "sources": [ { "title": "Sign in to Slack", "url": "https://slack.com/help/articles/212681477-Sign-in-to-Slack" }, { "title": "Slack updates and changes", "url": "https://slack.com/help/articles/115004846068-slack-updates-and-changes" }, { "title": "Set up two-factor authentication", "url": "https://slack.com/help/articles/204509068-Set-up-two-factor-authentication" }, { "title": "Set up SAML single sign-on for Slack", "url": "https://slack.com/help/articles/203772216-Set-up-SAML-single-sign-on-for-Slack" }, { "title": "Slack pricing", "url": "https://slack.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "smartsheet", "app": "Smartsheet", "vendor": "Smartsheet", "category": "productivity", "swi_vendor": null, "passkeys": "sso-only", "security_keys": "sso-only", "enforce_phishing_resistant": "sso-only", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Smartsheet's own login offers a password or an emailed one-time code, plus Google, Microsoft and Apple sign-in. Its authentication docs describe no second factor of its own. SAML SSO and directory provisioning are Enterprise-only; SCIM is documented through Entra ID. The Entra ID 'OIDC' option uses the built-in Microsoft sign-in button, not custom OIDC IdP setup, so OIDC is recorded as false.", "sources": [ { "title": "Email-based TOTP | Smartsheet Learning Center", "url": "https://help.smartsheet.com/articles/2483175-email-based-totp" }, { "title": "Configure SAML for plan-level single sign-on to Smartsheet", "url": "https://help.smartsheet.com/articles/2476141-configure-saml-sso" }, { "title": "Configure Entra ID for plan-level OIDC or SAML with Smartsheet", "url": "https://help.smartsheet.com/articles/2482713-azure-oidc-saml" }, { "title": "Smartsheet pricing", "url": "https://www.smartsheet.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "snowflake", "app": "Snowflake", "vendor": "Snowflake", "category": "data-analytics", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "yes", "saml": true, "oidc": true, "sso_plan": "Standard", "sso_tax": "none", "scim": "yes", "notes": "MFA methods are passkey, authenticator app (TOTP) and Duo; hardware keys are used as passkey storage (the docs cite YubiKey), and an authentication policy with MFA_POLICY = (ALLOWED_METHODS = ('PASSKEY')) restricts sign-in to passkeys. Snowflake's phased removal of single-factor passwords ran Sep 2025 to Oct 2026 (Phase 3, strong authentication for all users, enforced per account Aug-Oct 2026); reader and trial accounts are excluded.", "sources": [ { "title": "Multi-factor authentication (MFA) | Snowflake Documentation", "url": "https://docs.snowflake.com/en/user-guide/security-mfa" }, { "title": "CREATE AUTHENTICATION POLICY | Snowflake Documentation", "url": "https://docs.snowflake.com/en/sql-reference/sql/create-authentication-policy" }, { "title": "Planning for the deprecation of single-factor password sign-ins | Snowflake Documentation", "url": "https://docs.snowflake.com/en/user-guide/security-mfa-rollout" }, { "title": "Snowflake Editions | Snowflake Documentation", "url": "https://docs.snowflake.com/en/user-guide/intro-editions" }, { "title": "Overview of SCIM | Snowflake Documentation", "url": "https://docs.snowflake.com/en/user-guide/scim-intro" } ], "verified_on": "2026-10-31" }, { "slug": "strata-cloud-manager", "app": "Strata Cloud Manager", "vendor": "Palo Alto Networks", "category": "security-it", "swi_vendor": "zero-trust/palo-alto", "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "yes", "notes": "Common Services identity federation supports SAML third-party IdPs (with Entra ID SAML guides) and does not document OIDC. SCIM provisions users and groups into Strata Cloud Manager from SailPoint, OCI, and Okta, and groups map to predefined roles. Native Palo Alto Networks account MFA methods were not documented on the pages reviewed. Pricing is by quote and the SSO docs state no plan restriction.", "sources": [ { "title": "Palo Alto Networks: Identity and access management (Common Services)", "url": "https://docs.paloaltonetworks.com/common-services/identity-and-access-access-management" }, { "title": "Palo Alto Networks: Add an identity federation", "url": "https://docs.paloaltonetworks.com/content/techdocs/en_US/common-services/identity-and-access-access-management/manage-third-party-identity-provider-integrations/add-identity-federations.html" }, { "title": "Palo Alto Networks: SCIM", "url": "https://docs.paloaltonetworks.com/content/techdocs/en_US/common-services/identity-and-access-access-management/manage-third-party-identity-provider-integrations/scim-config.html" } ], "verified_on": "2026-10-31" }, { "slug": "stripe-dashboard", "app": "Stripe Dashboard", "vendor": "Stripe", "category": "hr-finance", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "All accounts", "sso_tax": "none", "scim": "yes", "notes": "The Dashboard supports passkeys, FIDO U2F/FIDO2 security keys, Touch ID or Windows Hello, TOTP and SMS. Admins can require two-step authentication for the team but not a specific method, so phishing-resistant enforcement comes from mandating SAML SSO through the IdP. Stripe says SSO is available to all users; SCIM requires SSO and a live-mode account.", "sources": [ { "title": "Stripe: Enable two-step authentication", "url": "https://support.stripe.com/questions/enable-two-step-verification" }, { "title": "Stripe: Set up a hardware security key for two-step authentication", "url": "https://support.stripe.com/questions/set-up-a-fido-u2f-security-key-for-two-step-authentication" }, { "title": "Stripe: Sign in using a passkey", "url": "https://support.stripe.com/questions/sign-in-using-a-passkey" }, { "title": "Stripe Docs: Security at Stripe", "url": "https://docs.stripe.com/security" }, { "title": "Stripe Docs: Single sign-on (SSO)", "url": "https://docs.stripe.com/get-started/account/sso" }, { "title": "Stripe: Does the Dashboard support login via SSO or SAML?", "url": "https://support.stripe.com/questions/does-the-dashboard-support-login-via-sso-or-saml" }, { "title": "Stripe Docs: Set up SCIM provisioning", "url": "https://docs.stripe.com/get-started/account/sso/scim" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "supabase", "app": "Supabase dashboard", "vendor": "Supabase", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Team", "sso_tax": "upper-tier", "scim": "unknown", "notes": "Dashboard MFA is TOTP only. Organization owners on the Pro, Team, or Enterprise plan can require MFA for all members. SAML 2.0 SSO for the dashboard is on the self-serve Team plan and Enterprise.", "sources": [ { "title": "Enable MFA (Supabase platform docs)", "url": "https://supabase.com/docs/guides/platform/multi-factor-authentication" }, { "title": "Enable SSO for your organization (Supabase docs)", "url": "https://supabase.com/docs/guides/platform/sso" }, { "title": "Supabase pricing", "url": "https://supabase.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "tableau-cloud", "app": "Tableau Cloud", "vendor": "Salesforce", "category": "data-analytics", "swi_vendor": null, "passkeys": "unknown", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "MFA has been required since Feb 1, 2022, either through an SSO IdP or 'Tableau with MFA', which accepts Salesforce Authenticator, TOTP apps, WebAuthn/U2F security keys and built-in authenticators; there is no documented way to restrict to keys, and keys do not work from Tableau Desktop or Prep Builder. SAML, generic OIDC, Google and Salesforce sign-in are documented without any edition limit.", "sources": [ { "title": "Multi-Factor Authentication and Tableau Cloud", "url": "https://help.tableau.com/current/online/en-us/to_security_mfa.htm" }, { "title": "Authentication - Tableau Cloud", "url": "https://help.tableau.com/current/online/en-us/security_auth.htm" }, { "title": "Configure SCIM - Tableau Cloud", "url": "https://help.tableau.com/current/online/en-us/scim_config_online.htm" } ], "verified_on": "2026-10-31" }, { "slug": "tailscale", "app": "Tailscale admin console", "vendor": "Tailscale", "category": "security-it", "swi_vendor": "zero-trust/tailscale", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "sso-only", "saml": false, "oidc": true, "sso_plan": "All plans", "sso_tax": "none", "scim": "yes", "notes": "Tailscale has no passwords: sign-in goes through an OIDC IdP (Google, Microsoft, GitHub, Apple, Okta, OneLogin, or custom OIDC) and MFA is set in that IdP. Passkey login (beta, all plans, invite-only) is also offered, and YubiKey is among the supported passkey managers. SCIM user and group provisioning is on Standard, Premium, and Enterprise.", "sources": [ { "title": "Tailscale: Supported identity providers", "url": "https://tailscale.com/kb/1013/sso-providers" }, { "title": "Tailscale: Passkeys", "url": "https://tailscale.com/kb/1269/passkeys" }, { "title": "Tailscale: User and group provisioning", "url": "https://tailscale.com/kb/1290/user-group-provisioning" }, { "title": "Tailscale pricing", "url": "https://tailscale.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "trello", "app": "Trello", "vendor": "Atlassian", "category": "productivity", "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Atlassian Guard Standard add-on (included in Trello Enterprise)", "sso_tax": "add-on", "scim": "yes", "notes": "Trello uses Atlassian account sign-in: 2SV supports authenticator apps, SMS and security keys such as YubiKey, and org admins can allow passkeys for managed users per authentication policy (blocked by default). Admins can make 2SV mandatory but not pick the method; SAML and SCIM need Atlassian Guard Standard, which Trello Enterprise includes.", "sources": [ { "title": "Atlassian: Manage two-step verification for your Atlassian account", "url": "https://support.atlassian.com/atlassian-account/docs/manage-two-step-verification-for-your-atlassian-account/" }, { "title": "Atlassian: Access your Atlassian account with a passkey", "url": "https://support.atlassian.com/atlassian-account/docs/access-your-atlassian-account-with-a-passkey/" }, { "title": "Atlassian: Enforce two-step verification", "url": "https://support.atlassian.com/security-and-access-policies/docs/enforce-two-step-verification/" }, { "title": "Atlassian: Configure SAML single sign-on with an identity provider", "url": "https://support.atlassian.com/security-and-access-policies/docs/configure-saml-single-sign-on-with-an-identity-provider/" }, { "title": "Atlassian: Understand user provisioning", "url": "https://support.atlassian.com/provisioning-users/docs/understand-user-provisioning/" }, { "title": "Trello pricing", "url": "https://trello.com/pricing" }, { "title": "Manage passkey authentication (Atlassian Administration)", "url": "https://support.atlassian.com/security-and-access-policies/docs/manage-passkey-authentication/" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "twilio-console", "app": "Twilio Console", "vendor": "Twilio", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Twilio Editions", "sso_tax": "enterprise-only", "scim": "yes", "notes": "Console SSO is SAML 2.0 and is 'available to all Twilio Editions customers'; it requires a Twilio Organization with verified domains. Automated provisioning and deprovisioning use the Twilio SCIM API, and JIT provisioning is not supported. The Editions page lists SAML 2.0 SSO under its contact-sales editions. Twilio's public docs do not list the console 2FA methods.", "sources": [ { "title": "Single Sign On (Twilio docs)", "url": "https://www.twilio.com/docs/iam/single-sign-on" }, { "title": "Twilio Editions", "url": "https://www.twilio.com/en-us/editions" }, { "title": "SCIM API reference (Twilio docs)", "url": "https://www.twilio.com/docs/iam/scim/api-reference" } ], "verified_on": "2026-10-31" }, { "slug": "sendgrid", "app": "Twilio SendGrid", "vendor": "Twilio", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Pro", "sso_tax": "upper-tier", "scim": "unknown", "notes": "SendGrid two-factor authentication is an SMS code or an authenticator app, and security-restricted actions require it. Accounts on Unified Login manage 2FA in the Twilio Console instead. SAML 2.0 SSO is limited to Email API Pro, Premier, and Marketing Campaigns Advanced, with JIT provisioning of SSO Teammates.", "sources": [ { "title": "Two-Factor Authentication (Twilio SendGrid docs)", "url": "https://www.twilio.com/docs/sendgrid/ui/account-and-settings/two-factor-authentication" }, { "title": "Single Sign-On (Twilio SendGrid docs)", "url": "https://www.twilio.com/docs/sendgrid/ui/account-and-settings/sso" } ], "verified_on": "2026-10-31" }, { "slug": "twingate", "app": "Twingate admin console", "vendor": "Twingate", "category": "security-it", "swi_vendor": "zero-trust/twingate", "passkeys": "sso-only", "security_keys": "sso-only", "enforce_phishing_resistant": "sso-only", "saml": true, "oidc": true, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "Admins sign in through an IdP or a social login (Google, Microsoft, GitHub, LinkedIn), and no Twingate passwords or passkeys are documented. Teams includes SSO via Google Workspace only; Okta (OIDC), Entra ID, and JumpCloud (SAML) plus IdP provisioning (SCIM) start at Business ($10/user/mo), and Keycloak/OneLogin are Enterprise.", "sources": [ { "title": "Twingate: Identity providers", "url": "https://www.twingate.com/docs/identity-providers" }, { "title": "Twingate: Okta configuration", "url": "https://www.twingate.com/docs/okta-configuration" }, { "title": "Twingate: JumpCloud configuration", "url": "https://www.twingate.com/docs/jumpcloud-configuration" }, { "title": "Twingate pricing", "url": "https://www.twingate.com/pricing" } ], "verified_on": "2026-10-31" }, { "slug": "vercel", "app": "Vercel dashboard", "vendor": "Vercel", "category": "cloud-infrastructure", "swi_vendor": null, "passkeys": "yes", "security_keys": "yes", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Pro (paid add-on)", "sso_tax": "add-on", "scim": "enterprise-only", "notes": "2FA methods are TOTP or a passkey (any WebAuthn device, including security keys), and passkey login is supported. Team 2FA enforcement is a single on/off switch with no method restriction. SAML is on Enterprise, and Pro teams must buy the SAML SSO add-on; Directory Sync (SCIM) is Enterprise only.", "sources": [ { "title": "Two-factor Authentication (Vercel docs)", "url": "https://vercel.com/docs/two-factor-authentication" }, { "title": "Two-factor enforcement (Vercel docs)", "url": "https://vercel.com/docs/two-factor-enforcement" }, { "title": "SAML Single Sign-On (Vercel docs)", "url": "https://vercel.com/docs/saml" } ], "verified_on": "2026-10-31" }, { "slug": "webflow", "app": "Webflow", "vendor": "Webflow", "category": "design-marketing", "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": false, "sso_plan": "Enterprise", "sso_tax": "enterprise-only", "scim": "enterprise-only", "notes": "Local 2FA is TOTP authenticator app plus backup codes only, available on all plans. SSO is Enterprise Workspace only and can be optional or required; Webflow says it supports OAuth and SAML connections but does not describe OIDC, so oidc is false. SCIM and JIT need SSO enforced and are set up by Webflow's Enterprise team.", "sources": [ { "title": "Webflow Help: Two-factor authentication (2FA)", "url": "https://help.webflow.com/hc/en-us/articles/33961343631891-Two-factor-authentication-2FA" }, { "title": "Webflow Help: Keep your Webflow account secure", "url": "https://help.webflow.com/hc/en-us/articles/33961231453587-Keep-your-Webflow-account-secure" }, { "title": "Webflow Help: Single Sign-On (SSO) Login", "url": "https://help.webflow.com/hc/en-us/articles/46651862433683-Single-Sign-On-SSO-Login" }, { "title": "Webflow Help: SCIM provisioning", "url": "https://help.webflow.com/hc/en-us/articles/46651868408595-SCIM-provisioning" }, { "title": "Webflow pricing", "url": "https://webflow.com/pricing" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "workday", "app": "Workday", "vendor": "Workday", "category": "hr-finance", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": true, "sso_plan": "Not stated (sold by quote)", "sso_tax": "unknown", "scim": "unknown", "notes": "Workday's public security page confirms SAML SSO, OpenID Connect, and x509 certificate authentication, plus a native login with configurable password rules. Native MFA methods (passkeys, security keys) are documented only in the login-gated Workday admin guide, which robots.txt also excludes, so they are recorded as unknown.", "sources": [ { "title": "Security and Privacy: Trusting Workday with Your Data", "url": "https://www.workday.com/en-us/why-workday/trust/security.html" } ], "verified_on": "2026-10-31" }, { "slug": "xero", "app": "Xero", "vendor": "Xero", "category": "hr-finance", "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": false, "oidc": false, "sso_plan": "Not offered", "sso_tax": "not-offered", "scim": "no", "notes": "MFA is mandatory but uses Xero Verify push or a TOTP authenticator app. Passkey login exists only in the Xero Me mobile app; Xero staff said in May 2026 that desktop passkeys are still being explored and YubiKey support is not confirmed. Xero's security and pricing pages describe no SAML or OIDC SSO or SCIM, so the not-offered values rest on vendor silence.", "sources": [ { "title": "Xero: Multi-factor authentication", "url": "https://www.xero.com/us/security/multi-factor-authentication/" }, { "title": "Xero Central: Use a passkey to log in to Xero Me", "url": "https://central.xero.com/0/article/Using-passkeys-to-login" }, { "title": "Xero Product Ideas: MFA, add support for Yubikey (staff response)", "url": "https://productideas.xero.com/forums/939198-for-small-businesses/suggestions/45590479-mfa-add-support-for-yubikey" }, { "title": "Xero pricing plans", "url": "https://www.xero.com/us/pricing-plans/" } ], "swi_vendor": null, "verified_on": "2026-10-31" }, { "slug": "zendesk", "app": "Zendesk", "vendor": "Zendesk", "category": "support-service", "swi_vendor": null, "passkeys": "no", "security_keys": "no", "enforce_phishing_resistant": "no", "saml": true, "oidc": true, "sso_plan": "Suite Team", "sso_tax": "none", "scim": "no", "notes": "Native 2FA for team members uses an authenticator app, email or SMS codes; no passkey or security key option is documented, and admins can require 2FA but not a specific method. SAML and OIDC SSO are available on all Suite and Support plans. Zendesk states it has no official SCIM connections and points to its user API instead.", "sources": [ { "title": "Managing two-factor authentication for agents and admins", "url": "https://support.zendesk.com/hc/en-us/articles/4408826974874" }, { "title": "Enabling SAML single sign-on", "url": "https://support.zendesk.com/hc/en-us/articles/4408887505690-Enabling-SAML-single-sign-on" }, { "title": "Setting up single sign-on with OpenID Connect (OIDC)", "url": "https://support.zendesk.com/hc/en-us/articles/7957465432474-Setting-up-single-sign-on-with-OpenID-Connect-OIDC" }, { "title": "Does Zendesk support SCIM?", "url": "https://support.zendesk.com/hc/en-us/articles/8966513066138-Does-Zendesk-support-SCIM" }, { "title": "Zendesk pricing", "url": "https://www.zendesk.com/pricing/" } ], "verified_on": "2026-10-31" }, { "slug": "zoom", "app": "Zoom", "vendor": "Zoom Communications", "category": "collaboration", "swi_vendor": null, "passkeys": "unknown", "security_keys": "unknown", "enforce_phishing_resistant": "unknown", "saml": true, "oidc": false, "sso_plan": "Business", "sso_tax": "upper-tier", "scim": "yes", "notes": "Zoom's pricing page lists Single sign-on via SAML 2.0 on Business and Enterprise only, and the SCIM2 API needs a Business or Education account with an approved vanity URL and SSO enabled. Zoom's help center renders client-side and could not be read, so 2FA methods (passkeys, security keys) and method enforcement are unconfirmed.", "sources": [ { "title": "Zoom plans and pricing", "url": "https://zoom.us/pricing" }, { "title": "Zoom SCIM2 API", "url": "https://developers.zoom.us/docs/api/scim2/" } ], "verified_on": "2026-10-31" } ] }