Skip to content
Start with Identity
Join free
Dataset · CC BY 4.0 · verified 2026-11-05

Identity Integration and Compatibility Matrix

Which of 13 workforce identity providers connect to AWS, Azure and Google Cloud, your HR system, your SaaS apps and your on-prem directories, and which 7 ITDR and governance tools ingest which identity sources. Tick your stack to see who covers all of it. Every cell links to the vendor's own documentation.

20
platforms, 455 sourced cells
8 of 13
workforce IdPs document AWS, Azure and Google Cloud
4 of 13
workforce IdPs document a Workday HR connector
2 of 13
document Shared Signals (SSF / CAEP) in production
My stack: tick everything a platform must connect to
Clouds
HR sources
SaaS targets
Legacy and on-prem
Protocols as IdP

Pick targets above to see which platforms document all of them.

Compact view: hover or tap a cell for the note; each cell links to its source. Pick a column group for notes inline.

  • authentik
    Open-source IdP
    20 yes, 2 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + SCIM to IAM Identity Center
    Source
    Azure / Entra
    Yes
    Entra ID provider syncs users and groups (Enterprise); WS-Fed or SAML domain federation
    Source
    Google Cloud
    how to
    Yes
    Workforce Identity Federation via SAML
    Source
    Workday
    Not documented
    no Workday connector found in docs or catalog
    Source
    SuccessFactors
    Not documented
    no SuccessFactors connector found in docs or catalog
    Source
    BambooHR
    Not documented
    no BambooHR connector found in docs or catalog
    Source
    Rippling
    Not documented
    no Rippling connector found in docs or catalog
    Source
    UKG
    Not documented
    no UKG connector found in docs or catalog
    Source
    Microsoft 365
    how to
    Yes
    WS-Fed domain federation; provisioning via Entra ID provider (Enterprise)
    Source
    Google Workspace
    Yes
    SAML SSO + Google Workspace provider sync (Enterprise)
    Source
    Salesforce
    how to
    Yes
    SAML + JIT; optional SCIM (Enterprise)
    Source
    Slack
    how to
    Yes
    SAML + optional SCIM
    Source
    GitHub
    how to
    Yes
    SAML + SCIM for GitHub Enterprise Cloud EMU
    Source
    Atlassian
    Partial
    SAML only, no provisioning
    Source
    ServiceNow
    Not documented
    no ServiceNow guide in catalog
    Source
    Zoom
    Partial
    SAML only, JIT at sign-in, no SCIM
    Source
    Active Directory
    Yes
    LDAP source sync with optional password writeback, no agent
    Source
    LDAP
    Yes
    LDAP source sync plus LDAP provider via outpost for legacy apps
    Source
    Kerberos / IWA
    Yes
    Kerberos source with browser SPNEGO
    Source
    RADIUS
    Yes
    RADIUS provider via outpost, PAP and EAP-TLS, authentication only
    Source
    Header-based
    Yes
    proxy provider outpost sets X-authentik headers
    Source
    AD FS apps
    how to
    Yes
    WS-Fed relying parties, passive only (Enterprise)
    Source
    SAML
    Yes
    SAML 2.0 provider with SLO
    Source
    OIDC
    Yes
    OAuth 2.0 and OIDC provider
    Source
    WS-Fed
    how to
    Yes
    passive WS-Fed, no WS-Trust or MEX (Enterprise)
    Source
    SCIM out
    how to
    Yes
    generic SCIM 2.0 provider for users and groups
    Source
    SCIM in
    Yes
    SCIM source accepts users and groups from Entra, Google, Okta
    Source
    SSF / CAEP
    Yes
    SSF transmitter (Enterprise)
    Source
  • AWS IAM Identity Center
    Cloud provider IdP
    4 yes, 5 partial of 28 columns: show all
    AWS
    how to
    Yes
    native: AWS account access via permission sets
    Source
    Azure / Entra
    Not documented
    no documented federation of Entra ID to Identity Center as IdP
    Google Cloud
    how to
    Not documented
    no Google Cloud doc listing Identity Center as IdP
    Workday
    Not documented
    no HR connector documented
    Source
    SuccessFactors
    Not documented
    no HR connector documented
    Source
    BambooHR
    Not documented
    no HR connector documented
    Source
    Rippling
    Not documented
    no HR connector documented
    Source
    UKG
    Not documented
    no HR connector documented
    Source
    Microsoft 365
    how to
    Partial
    catalog SAML app, no provisioning documented
    Source
    Google Workspace
    Not documented
    not named in public catalog docs
    Source
    Salesforce
    how to
    Partial
    catalog SAML app, no provisioning documented
    Source
    Slack
    how to
    Not documented
    not named in public catalog docs; full list only in console
    Source
    GitHub
    how to
    Not documented
    not named in public catalog docs; full list only in console
    Source
    Atlassian
    Not documented
    not named in public catalog docs; full list only in console
    Source
    ServiceNow
    Not documented
    not named in public catalog docs; full list only in console
    Source
    Zoom
    Not documented
    not named in public catalog docs; full list only in console
    Source
    Active Directory
    Yes
    AD Connector or AWS Managed Microsoft AD; user and group sync
    Source
    LDAP
    Not documented
    no LDAP interface or generic LDAP source documented
    Source
    Kerberos / IWA
    Not documented
    no desktop SSO documented
    RADIUS
    Partial
    RADIUS client to existing MFA server via AWS Managed Microsoft AD; not a RADIUS server
    Source
    Header-based
    Partial
    via AWS Verified Access (separate service) signed identity header
    Source
    AD FS apps
    how to
    Partial
    SAML 2.0 apps only, no WS-Fed
    Source
    SAML
    Yes
    SAML 2.0 IdP for catalog and customer managed apps
    Source
    OIDC
    No
    supports only SAML 2.0 apps; OAuth 2.0 flows only for AWS managed apps
    Source
    WS-Fed
    how to
    No
    supports only SAML 2.0-based applications
    Source
    SCIM out
    how to
    Not documented
    docs describe SCIM inbound only; no outbound provisioning to apps found
    Source
    SCIM in
    Yes
    SCIM 2.0 endpoint for users and groups from external IdP
    Source
    SSF / CAEP
    Not documented
    no Shared Signals support found
    Source
  • 14 yes, 5 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + SCIM to IAM Identity Center; IAM SAML roles also supported
    Source
    Azure / Entra
    Yes
    Entra tenant domain federated to Duo SSO (SAML + WS-Trust) with user and group provisioning
    Source
    Google Cloud
    how to
    Yes
    Cloud Identity / Google Workspace SAML SSO plus user and group provisioning
    Source
    Workday
    Not documented
    Duo SSO for Workday covers sign-in to Workday only, not Workday as HR source
    Source
    SuccessFactors
    Not documented
    no HR connector documented; inbound SCIM from any SCIM-compliant directory
    Source
    BambooHR
    Not documented
    no HR connector documented
    Source
    Rippling
    Not documented
    no HR connector documented; Rippling app page not machine-readable
    Source
    UKG
    Not documented
    no HR connector documented
    Source
    Microsoft 365
    how to
    Yes
    SAML 2.0 + optional WS-Trust, automated provisioning of users and groups
    Source
    Google Workspace
    Yes
    SAML + automated provisioning of users and groups
    Source
    Salesforce
    how to
    Yes
    SAML + SCIM provisioning (provisioning is beta)
    Source
    Slack
    how to
    Partial
    SAML app; SCIM may work via generic provisioning, not Duo Verified
    Source
    GitHub
    how to
    Partial
    SAML only, no provisioning
    Source
    Atlassian
    Yes
    SAML + SCIM provisioning
    Source
    ServiceNow
    Partial
    SAML only, no provisioning
    Source
    Zoom
    Partial
    SAML app; SCIM may work via generic provisioning, not Duo Verified
    Source
    Active Directory
    Yes
    directory sync and SSO auth source via Duo Authentication Proxy
    Source
    LDAP
    Yes
    OpenLDAP sync, plus Authentication Proxy as LDAP proxy for apps
    Source
    Kerberos / IWA
    Not documented
    Duo Passport shares Windows logon session with SSO apps, not Kerberos/IWA
    Source
    RADIUS
    Yes
    Authentication Proxy acts as RADIUS server for VPN and network devices
    Source
    Header-based
    Not documented
    Duo Network Gateway proxies on-prem web apps; no identity header SSO documented
    Source
    AD FS apps
    how to
    Partial
    SAML apps via generic SAML SP, no WS-Fed relying parties documented
    Source
    SAML
    Yes
    cloud-hosted SAML 2.0 IdP (Essentials, Advantage, Premier)
    Source
    OIDC
    Yes
    OIDC provider, authorization code flow only
    Source
    WS-Fed
    how to
    Not documented
    not documented; Microsoft 365 app uses SAML 2.0 plus WS-Trust
    Source
    SCIM out
    how to
    Yes
    SCIM 2.0 to Duo Verified apps, generic SCIM for other SSO apps
    Source
    SCIM in
    Yes
    inbound SCIM from Okta or any SCIM-compliant directory
    Source
    SSF / CAEP
    Not documented
    only an SSF interop demo on vendor blog, no product doc
    Source
  • Google Cloud Identity and Google Workspace
    Cloud provider IdP
    12 yes, 7 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + auto-provisioning to IAM Identity Center; no SCIM group sync
    Source
    Azure / Entra
    Yes
    via Office 365 app: SAML federation plus user provisioning to the tenant
    Source
    Google Cloud
    how to
    Yes
    native: Google Cloud organizations use Cloud Identity or Workspace accounts
    Source
    Workday
    Not documented
    SAML SSO into Workday only; no HR-driven inbound provisioning found
    Source
    SuccessFactors
    Not documented
    no inbound HR connector found
    BambooHR
    Not documented
    no inbound HR connector found
    Rippling
    Not documented
    no inbound HR connector found
    UKG
    Not documented
    no inbound HR connector found
    Microsoft 365
    how to
    Yes
    SAML SSO + automated provisioning (Office 365 app)
    Source
    Google Workspace
    Yes
    native
    Source
    Salesforce
    how to
    Yes
    pre-integrated SAML app + auto-provisioning
    Source
    Slack
    how to
    Yes
    pre-integrated SAML app + auto-provisioning
    Source
    GitHub
    how to
    Partial
    custom SAML app only; not in Google catalog or GitHub tested IdP list
    Source
    Atlassian
    Yes
    Atlassian Cloud SAML app + auto-provisioning
    Source
    ServiceNow
    Partial
    pre-integrated SAML app, no provisioning
    Source
    Zoom
    Partial
    pre-integrated SAML app, no provisioning
    Source
    Active Directory
    Yes
    one-way user and group sync with Google Cloud Directory Sync
    Source
    LDAP
    Yes
    GCDS sync from LDAP servers plus Secure LDAP interface for apps (higher editions)
    Source
    Kerberos / IWA
    Not documented
    no Kerberos or IWA desktop SSO found
    RADIUS
    Partial
    FreeRADIUS backed by Secure LDAP; no built-in RADIUS server
    Source
    Header-based
    Partial
    via Google Cloud IAP (separate product) identity headers
    Source
    AD FS apps
    how to
    Partial
    custom SAML apps only, no WS-Fed documented
    Source
    SAML
    Yes
    SAML 2.0 IdP for catalog and custom apps
    Source
    OIDC
    Yes
    OpenID Certified provider (Sign in with Google)
    Source
    WS-Fed
    how to
    Not documented
    SSO docs describe SAML 2.0 only
    Source
    SCIM out
    how to
    Partial
    pre-built app list; custom SCIM profiles in limited beta
    Source
    SCIM in
    Not documented
    no SCIM server endpoint found
    SSF / CAEP
    No
    Cross-Account Protection (RISC) does not send events for Workspace users
    Source
  • 2 yes, 0 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + SCIM 2.0 to IAM Identity Center, roles mapped to groups (AWS guide)
    Source
    Azure / Entra
    Not documented
    Microsoft federation compatibility page silent; vendor docs not machine-readable
    Source
    Google Cloud
    how to
    Not documented
    no CyberArk guide in Google Workforce Identity Federation docs; vendor docs not machine-readable
    Source
    Workday
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    SuccessFactors
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    BambooHR
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Rippling
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    UKG
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Microsoft 365
    how to
    Not documented
    Microsoft federation compatibility page silent; vendor docs not machine-readable
    Source
    Google Workspace
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Salesforce
    how to
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Slack
    how to
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    GitHub
    how to
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Atlassian
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    ServiceNow
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Zoom
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Active Directory
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    LDAP
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Kerberos / IWA
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    RADIUS
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    Header-based
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    AD FS apps
    how to
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    SAML
    Yes
    acts as SAML IdP for IAM Identity Center (AWS guide)
    Source
    OIDC
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    WS-Fed
    how to
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    SCIM out
    how to
    Not documented
    SCIM 2.0 to AWS shown in AWS guide; generic SCIM outbound not verified, vendor docs not machine-readable
    Source
    SCIM in
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
    SSF / CAEP
    Not documented
    docs not machine-readable (docs.cyberark.com, now Idira Docs, returned HTTP 404 to every fetch)
  • JumpCloud
    Commercial IdP
    20 yes, 3 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML SSO + SCIM to IAM Identity Center
    Source
    Azure / Entra
    Yes
    Entra ID domain federation (SAML or WS-Fed) + M365 Cloud Directory Integration provisioning
    Source
    Google Cloud
    how to
    Yes
    Google Workspace/Cloud Identity SAML SSO + Google Workspace Cloud Directory Integration provisioning
    Source
    Workday
    Yes
    Workday Custom API Import via RaaS report; create, update, deprovision; legacy connector deprecated May 2026
    Source
    SuccessFactors
    Yes
    Custom API import; users created, updated and suspended
    Source
    BambooHR
    Partial
    BambooHR pushes via SCIM (one-way, managed by BambooHR); Custom API connector for extra attributes
    Source
    Rippling
    Yes
    Custom API import from Rippling workers endpoint; inactive status suspends users
    Source
    UKG
    No
    Docs say custom API integration cannot be used with UKG; no pre-built connector
    Source
    Microsoft 365
    how to
    Yes
    SAML or WS-Fed SSO + M365 Cloud Directory Integration provisioning
    Source
    Google Workspace
    Yes
    SAML SSO + Google Workspace Cloud Directory Integration (bi-directional sync)
    Source
    Salesforce
    how to
    Yes
    SAML + SCIM (users and groups)
    Source
    Slack
    how to
    Yes
    SAML + SCIM; Business+ or Enterprise Grid
    Source
    GitHub
    how to
    Yes
    SAML + SCIM for GitHub Enterprise Cloud (EMU and organization)
    Source
    Atlassian
    Yes
    SAML + SCIM for Atlassian Cloud; sync capped at 5,000 users
    Source
    ServiceNow
    Partial
    SAML only, no provisioning
    Source
    Zoom
    Yes
    SAML + SCIM
    Source
    Active Directory
    Yes
    Active Directory Integration agents on DCs or member servers; two-way sync of users, groups, passwords
    Source
    LDAP
    Yes
    Hosted Cloud LDAP interface (ldap.jumpcloud.com), read-only, LDAPS or STARTTLS
    Source
    Kerberos / IWA
    Not documented
    no Kerberos or IWA desktop SSO docs found
    RADIUS
    Yes
    Hosted Cloud RADIUS for WiFi and VPN
    Source
    Header-based
    Not documented
    no header-based SSO docs found
    Source
    AD FS apps
    how to
    Not documented
    no AD FS migration or WS-Fed relying party docs found
    SAML
    Yes
    SAML 2.0 catalog connectors and custom SAML apps
    Source
    OIDC
    Yes
    Custom OIDC app connector
    Source
    WS-Fed
    how to
    Partial
    WS-Fed documented for Microsoft 365/Entra ID only
    Source
    SCIM out
    how to
    Yes
    Custom SCIM 2.0 connector plus pre-built SCIM connectors
    Source
    SCIM in
    Yes
    JumpCloud SCIM API server (api.jumpcloud.com/scim/v2); no real-time group import
    Source
    SSF / CAEP
    Not documented
    no SSF or CAEP docs found
  • Keycloak
    Open-source IdP
    7 yes, 12 partial of 28 columns: show all
    AWS
    how to
    Partial
    generic SAML client only; not in AWS IdP tutorials, no outbound SCIM
    Source
    Azure / Entra
    Partial
    generic SAML federation only; not on Microsoft tested IdP list
    Source
    Google Cloud
    how to
    Yes
    Workforce Identity Federation lists keycloak as a provider vendor type
    Source
    Workday
    Not documented
    no HR connector documented
    Source
    SuccessFactors
    Not documented
    no HR connector documented
    Source
    BambooHR
    Not documented
    no HR connector documented
    Source
    Rippling
    Not documented
    no HR connector documented
    Source
    UKG
    Not documented
    no HR connector documented
    Source
    Microsoft 365
    how to
    Partial
    generic SAML only; not on Microsoft tested IdP list
    Source
    Google Workspace
    Partial
    SAML SSO documented by Google; no built-in provisioning, needs GCDS
    Source
    Salesforce
    how to
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    Slack
    how to
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    GitHub
    how to
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    Atlassian
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    ServiceNow
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    Zoom
    Partial
    generic SAML/OIDC client, no catalog or provisioning
    Source
    Active Directory
    Yes
    LDAP/AD user federation with sync; read-only, writable or unsynced modes
    Source
    LDAP
    Yes
    LDAP user federation (connects to LDAP); no LDAP interface for apps
    Source
    Kerberos / IWA
    Yes
    Kerberos/SPNEGO browser desktop SSO
    Source
    RADIUS
    Not documented
    not documented
    Source
    Header-based
    Not documented
    not documented
    Source
    AD FS apps
    how to
    Partial
    SAML apps only, no WS-Fed
    Source
    SAML
    Yes
    SAML 2.0 IdP
    Source
    OIDC
    Yes
    OpenID Connect provider
    Source
    WS-Fed
    how to
    No
    core SSO protocols are OIDC and SAML; WS-Fed not included
    Source
    SCIM out
    how to
    No
    Google docs: no built-in user and group provisioning
    Source
    SCIM in
    Yes
    SCIM API supported and on by default since 26.8; no bulk or password changes
    Source
    SSF / CAEP
    Partial
    experimental SSF transmitter, CAEP and RISC events, not for production
    Source
  • Microsoft Entra ID
    Commercial IdP
    22 yes, 6 partial of 28 columns: show all
    AWS
    how to
    Yes
    Gallery app: SAML SSO + SCIM users and groups to IAM Identity Center
    Source
    Azure / Entra
    Yes
    Native: Azure subscriptions use Entra ID tenants
    Source
    Google Cloud
    how to
    Yes
    Google documents Workforce Identity Federation with Entra ID (OIDC or SAML); Entra gallery also provisions Google Cloud / Workspace
    Source
    Workday
    Yes
    Workday inbound provisioning to AD and Entra ID: hire, update, terminate
    Source
    SuccessFactors
    Yes
    SuccessFactors inbound provisioning to AD and Entra ID: hire, update, terminate, rehire
    Source
    BambooHR
    Partial
    No Microsoft connector; listed under partner Aquera HR Sync connectors, or build on API-driven inbound provisioning
    Source
    Rippling
    Partial
    Rippling-built integration pushes users via API-driven inbound provisioning to AD
    Source
    UKG
    Partial
    No Microsoft connector; UKG Pro/Ready listed under partner Aquera HR Sync connectors
    Source
    Microsoft 365
    how to
    Yes
    Native: Microsoft 365 uses Entra ID for identity and authentication
    Source
    Google Workspace
    Yes
    Gallery app: SAML SSO + users and groups provisioning
    Source
    Salesforce
    how to
    Yes
    Gallery app: SAML SSO + user provisioning via Salesforce API
    Source
    Slack
    how to
    Yes
    Gallery app: SSO + SCIM users and groups (Business+; Enterprise Grid per Slack docs)
    Source
    GitHub
    how to
    Yes
    GitHub Enterprise Managed Users: SAML SSO + SCIM users and groups
    Source
    Atlassian
    Yes
    Atlassian Cloud: SSO + SCIM users and groups (Atlassian Guard/Access required)
    Source
    ServiceNow
    Yes
    Gallery app: SSO + users and groups provisioning; self-hosted instances not supported
    Source
    Zoom
    Yes
    Gallery app: SSO + SCIM user provisioning (no groups)
    Source
    Active Directory
    Yes
    Cloud Sync agent (or Connect Sync) syncs AD users, groups, contacts
    Source
    LDAP
    Yes
    LDAP interface via Entra Domain Services managed domain; provisioning agent can also write to LDAP directories
    Source
    Kerberos / IWA
    Yes
    Desktop SSO via Kerberos tickets on domain-joined devices (Entra Connect feature); PRT SSO on Entra joined devices
    Source
    RADIUS
    Partial
    NPS extension on Windows NPS adds Entra MFA to RADIUS; primary auth stays in AD, no native RADIUS server
    Source
    Header-based
    Yes
    Application Proxy native header-based SSO for on-prem apps
    Source
    AD FS apps
    how to
    Yes
    Documented AD FS app migration; SAML and WS-Fed apps as enterprise apps or app registrations
    Source
    SAML
    Yes
    SAML SSO for gallery and non-gallery apps
    Source
    OIDC
    Yes
    OpenID Connect provider (Microsoft identity platform)
    Source
    WS-Fed
    how to
    Yes
    WS-Federation apps supported as non-gallery apps or app registrations
    Source
    SCIM out
    how to
    Yes
    SCIM 2.0 client to any compliant non-gallery app endpoint
    Source
    SCIM in
    Partial
    API-driven inbound provisioning: Graph /bulkUpload accepts SCIM bulk payloads, not a full SCIM server; P1/P2
    Source
    SSF / CAEP
    Partial
    Continuous access evaluation based on CAEP, but for Microsoft resources (Exchange, SharePoint, Teams, Graph); no documented SSF stream for third parties
    Source
  • 22 yes, 3 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML to IAM Identity Center as external IdP + SCIM provisioning; IAM SAML roles also documented
    Source
    Azure / Entra
    Yes
    Microsoft 365/Entra ID federation via SAML or WS-Fed + users, groups and license provisioning
    Source
    Google Cloud
    how to
    Yes
    SAML SSO via Google Admin third-party IdP + Google Workspace provisioning app; no Workforce Identity Federation guide found
    Source
    Workday
    Partial
    Manual Import Users from Workday; scheduled inbound sync not documented
    Source
    SuccessFactors
    Partial
    Manual Import Users from SuccessFactors; inbound updates and deletes not documented
    Source
    BambooHR
    Yes
    BambooHR webhook creates, updates and deletes users in miniOrange
    Source
    Rippling
    Not documented
    not listed in integration catalog; Rippling documented only as external IdP
    Source
    UKG
    Not documented
    not listed in integration catalog
    Source
    Microsoft 365
    how to
    Yes
    SAML or WS-Fed SSO + users, groups and license provisioning
    Source
    Google Workspace
    Yes
    SSO + provisioning app (create, update, delete users and groups)
    Source
    Salesforce
    how to
    Yes
    SAML + SCIM provisioning (create, update, delete)
    Source
    Slack
    how to
    Yes
    SSO + SCIM provisioning (create, update, delete)
    Source
    GitHub
    how to
    Yes
    SAML SSO + SCIM provisioning (create, update, delete)
    Source
    Atlassian
    Partial
    SAML SSO to Jira Cloud via Atlassian Access; no Atlassian Cloud provisioning guide found
    Source
    ServiceNow
    Yes
    SSO + provisioning (create, update, delete, sync)
    Source
    Zoom
    Yes
    SSO + SCIM provisioning (create, update, delete)
    Source
    Active Directory
    Yes
    On-prem LDAP Gateway syncs AD users and groups and authenticates against AD
    Source
    LDAP
    Yes
    LDAP directory integration via LDAP Gateway (sync and authentication); no LDAP interface for apps documented
    Source
    Kerberos / IWA
    Yes
    Kerberos and NTLM via IWA module hosted on IIS
    Source
    RADIUS
    Yes
    miniOrange RADIUS server for VPN authentication and MFA
    Source
    Header-based
    Yes
    Access Gateway (on-prem reverse proxy) for header and cookie-based apps
    Source
    AD FS apps
    how to
    Yes
    Custom WS-Fed relying party apps plus on-prem Exchange OWA via WS-Fed
    Source
    SAML
    Yes
    Custom SAML App, miniOrange as IdP
    Source
    OIDC
    Yes
    OAuth2/OpenID Connect app with id_token
    Source
    WS-Fed
    how to
    Yes
    Custom WS-Fed app (realm, reply URL)
    Source
    SCIM out
    how to
    Yes
    SCIM Server (Destination) app for any SCIM-supported app
    Source
    SCIM in
    Yes
    SCIM base URL and bearer token accept provisioning from Entra ID
    Source
    SSF / CAEP
    Not documented
    no SSF or CAEP docs found
  • 28 yes, 0 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + SCIM to IAM Identity Center (create, update, deactivate, group push)
    Source
    Azure / Entra
    Yes
    Entra tenant domain federation (WS-Fed) plus user and group provisioning via Microsoft Office 365 app
    Source
    Google Cloud
    how to
    Yes
    Workforce Identity Federation with Okta (OIDC or SAML)
    Source
    Workday
    Yes
    HR-driven provisioning: hires, updates and terminations flow to Okta
    Source
    SuccessFactors
    Yes
    SuccessFactors Employee Central import and deactivation on termination
    Source
    BambooHR
    Yes
    Catalog app: create, update, attribute sourcing; listed under HR-driven IT
    Source
    Rippling
    Yes
    Catalog app makes Rippling the profile source: create, update, attribute sourcing
    Source
    UKG
    Yes
    UKG Pro (UltiPro) catalog app: create, update, attribute sourcing, writeback
    Source
    Microsoft 365
    how to
    Yes
    WS-Fed + provisioning (create, update, deactivate, group push)
    Source
    Google Workspace
    Yes
    SAML + provisioning (create, update, deactivate, group push)
    Source
    Salesforce
    how to
    Yes
    SAML + provisioning (create, update, deactivate)
    Source
    Slack
    how to
    Yes
    SAML + SCIM (create, update, deactivate, group push)
    Source
    GitHub
    how to
    Yes
    SAML + SCIM for Enterprise Cloud orgs and Enterprise Managed Users
    Source
    Atlassian
    Yes
    SAML + SCIM (create, update, deactivate, group push)
    Source
    ServiceNow
    Yes
    SAML + provisioning via ServiceNow UD app
    Source
    Zoom
    Yes
    SAML/OIDC + SCIM (create, update, deactivate, group push)
    Source
    Active Directory
    Yes
    Okta AD agent imports AD users and groups
    Source
    LDAP
    Yes
    LDAP agent for directory integration plus cloud LDAP Interface for legacy apps
    Source
    Kerberos / IWA
    Yes
    Agentless Desktop SSO (Kerberos) or IWA web agent
    Source
    RADIUS
    Yes
    Okta RADIUS server agent for VPNs, PAP only, no WiFi
    Source
    Header-based
    Yes
    Okta Access Gateway reverse proxy for header-based and Kerberos apps
    Source
    AD FS apps
    how to
    Yes
    Template WS-Fed app for WS-Fed relying parties
    Source
    SAML
    Yes
    SAML 2.0 custom app integrations
    Source
    OIDC
    Yes
    OIDC custom app integrations
    Source
    WS-Fed
    how to
    Yes
    Template WS-Fed app, SP-initiated; also Microsoft 365
    Source
    SCIM out
    how to
    Yes
    SCIM provisioning on custom app integrations; provisioning feature must be enabled
    Source
    SCIM in
    Yes
    Inbound SCIM 2.0 API: external HR or IdP provisions into Okta
    Source
    SSF / CAEP
    Yes
    SSF transmitter (Session Revoked, Credential Change) and receiver (CAEP, RISC); Identity Threat Protection
    Source
  • 7 yes, 1 partial of 28 columns: show all
    AWS
    how to
    Yes
    SAML + SCIM to IAM Identity Center; no group delete, single ACS URL
    Source
    Azure / Entra
    Not documented
    OneLogin docs not machine-readable
    Google Cloud
    how to
    Not documented
    no OneLogin-specific Workforce Identity Federation guide found
    Workday
    Not documented
    OneLogin docs not machine-readable
    Source
    SuccessFactors
    Not documented
    OneLogin docs not machine-readable
    BambooHR
    Not documented
    OneLogin docs not machine-readable
    Rippling
    Not documented
    OneLogin docs not machine-readable
    UKG
    Not documented
    OneLogin docs not machine-readable
    Microsoft 365
    how to
    Not documented
    OneLogin docs not machine-readable
    Google Workspace
    Not documented
    OneLogin docs not machine-readable
    Salesforce
    how to
    Not documented
    OneLogin docs not machine-readable
    Slack
    how to
    Yes
    listed by Slack for SCIM provisioning (requires SAML SSO)
    Source
    GitHub
    how to
    Yes
    SAML + SCIM for GitHub organizations
    Source
    Atlassian
    Yes
    listed by Atlassian for SAML SSO and SCIM provisioning
    Source
    ServiceNow
    Not documented
    OneLogin docs not machine-readable
    Zoom
    Partial
    listed by Zoom as SAML IdP; provisioning with OneLogin not documented
    Source
    Active Directory
    Not documented
    OneLogin docs not machine-readable
    Source
    LDAP
    Not documented
    OneLogin docs not machine-readable
    Kerberos / IWA
    Not documented
    OneLogin docs not machine-readable
    RADIUS
    Not documented
    OneLogin docs not machine-readable
    Source
    Header-based
    Not documented
    OneLogin docs not machine-readable
    AD FS apps
    how to
    Not documented
    OneLogin docs not machine-readable
    SAML
    Yes
    SAML SSO, OneLogin as identity provider
    Source
    OIDC
    Yes
    OpenID Connect provider
    Source
    WS-Fed
    how to
    Not documented
    OneLogin docs not machine-readable
    SCIM out
    how to
    Yes
    SCIM 1.1 and 2.0 via SCIM Provisioner connector
    Source
    SCIM in
    Not documented
    developer SCIM docs cover outbound only
    Source
    SSF / CAEP
    Not documented
    no OneLogin SSF or CAEP documentation found
  • 20 yes, 3 partial of 28 columns: show all
    AWS
    how to
    Yes
    PingOne SAML + SCIM to IAM Identity Center (users only, no group SCIM); PingFederate SCIM guide also exists
    Source
    Azure / Entra
    Yes
    PingOne WS-Fed/WS-Trust federation of Entra ID domain + Microsoft Azure (Office 365) provisioning connector
    Source
    Google Cloud
    how to
    Yes
    Workforce Identity Federation with PingFederate (SAML), Google Cloud guide
    Source
    Workday
    Yes
    PingOne inbound and outbound Workday connector; full-time employees only, no contingent workers
    Source
    SuccessFactors
    Not documented
    not in PingOne provisioning connector list; documented only for PingOne Advanced Identity Cloud
    Source
    BambooHR
    Not documented
    not in PingOne provisioning connector list
    Source
    Rippling
    Not documented
    not in PingOne provisioning connector list
    Source
    UKG
    Not documented
    not in PingOne provisioning connector list
    Source
    Microsoft 365
    how to
    Yes
    PingOne WS-Fed (passive) and WS-Trust (active) for Microsoft 365 + Microsoft Azure (Office 365) provisioning connector
    Source
    Google Workspace
    Partial
    PingOne outbound provisioning connector; SSO setup page not found
    Source
    Salesforce
    how to
    Yes
    PingOne Salesforce provisioning connector; SAML SSO guides for PingFederate and PingOne for Enterprise
    Source
    Slack
    how to
    Yes
    PingOne Slack provisioning connector (users and groups); SAML SSO guide for PingFederate
    Source
    GitHub
    how to
    Yes
    PingOne GitHub EMU provisioning connector (users and groups); SAML SSO guides for PingFederate
    Source
    Atlassian
    Partial
    SAML SSO guides (PingFederate, PingOne for Enterprise); no PingOne Atlassian provisioning connector listed
    Source
    ServiceNow
    Yes
    PingOne ServiceNow provisioning connector; SAML SSO guide for PingOne for Enterprise
    Source
    Zoom
    Partial
    PingOne Zoom provisioning connector; SSO setup page not found
    Source
    Active Directory
    Yes
    PingOne LDAP Gateway agent, inbound and outbound with AD
    Source
    LDAP
    Yes
    PingOne LDAP Gateway supports AD and PingDirectory only; PingFederate LDAP data stores
    Source
    Kerberos / IWA
    Yes
    PingOne Kerberos via LDAP Gateway with AD; PingFederate Kerberos Adapter
    Source
    RADIUS
    Yes
    PingOne RADIUS gateway (PAP, MS-CHAP v2, EAP-MSCHAPv2); PingFederate RADIUS server
    Source
    Header-based
    Yes
    via PingAccess header identity mappings
    Source
    AD FS apps
    how to
    Yes
    PingFederate WS-Fed SP connections (software)
    Source
    SAML
    Yes
    PingOne SAML apps; PingFederate SAML 1.0 and 2.0
    Source
    OIDC
    Yes
    PingOne OIDC apps; PingFederate OIDC
    Source
    WS-Fed
    how to
    Yes
    PingFederate full WS-Fed; PingOne WS-Fed for Microsoft 365 only
    Source
    SCIM out
    how to
    Yes
    PingOne SCIM 1.1 and 2.0 outbound connection; PingFederate SCIM outbound
    Source
    SCIM in
    Yes
    PingOne SCIM 2.0 Users API; PingFederate SCIM inbound provisioning
    Source
    SSF / CAEP
    Not documented
    no SSF or CAEP docs found for PingOne or PingFederate
  • ZITADEL
    Open-source IdP
    4 yes, 7 partial of 28 columns: show all
    AWS
    how to
    Partial
    SAML to IAM Identity Center, no provisioning documented
    Source
    Azure / Entra
    Not documented
    Entra ID documented only as upstream IdP, not as target
    Source
    Google Cloud
    how to
    Yes
    Workforce Identity Federation via OIDC
    Source
    Workday
    Not documented
    no HR connector in docs
    Source
    SuccessFactors
    Not documented
    no HR connector in docs
    Source
    BambooHR
    Not documented
    no HR connector in docs
    Source
    Rippling
    Not documented
    no HR connector in docs
    Source
    UKG
    Not documented
    no HR connector in docs
    Source
    Microsoft 365
    how to
    Not documented
    no Microsoft 365 guide in docs
    Source
    Google Workspace
    Partial
    SAML only, no provisioning
    Source
    Salesforce
    how to
    Not documented
    no Salesforce guide in docs
    Source
    Slack
    how to
    Not documented
    no Slack guide in docs
    Source
    GitHub
    how to
    Not documented
    GitHub documented only as upstream IdP
    Source
    Atlassian
    Partial
    SAML only, no provisioning
    Source
    ServiceNow
    Not documented
    no ServiceNow guide in docs
    Source
    Zoom
    Not documented
    no Zoom guide in docs
    Source
    Active Directory
    Partial
    via LDAP IdP only, login-time JIT, no sync agent
    Source
    LDAP
    Yes
    LDAP as login IdP with JIT create and update; no LDAP interface
    Source
    Kerberos / IWA
    Not documented
    not found in docs
    RADIUS
    Not documented
    not found in docs
    Header-based
    Partial
    via third-party OAuth2 Proxy example
    Source
    AD FS apps
    how to
    Partial
    SAML apps only, WS-Fed not in docs
    Source
    SAML
    Yes
    SAML 2.0 IdP, Redirect and POST bindings
    Source
    OIDC
    Yes
    OIDC provider with discovery
    Source
    WS-Fed
    how to
    Not documented
    not found in docs
    SCIM out
    how to
    Not documented
    no outbound SCIM documented
    Source
    SCIM in
    Partial
    SCIM 2.0 server, preview, users only, no groups
    Source
    SSF / CAEP
    Not documented
    not found in docs

How to read it

Yes means the vendor (or the target, such as AWS or Slack) documents the integration. For clouds and SaaS apps that means sign-in plus automated provisioning; for HR systems, a connector that creates, updates and deactivates users. Partial means something is missing, for example SAML only with no provisioning, a generic template, a partner connector or a preview. No means the docs say it is not supported. Not documented means we could not find or read a vendor page that says either way (34% of workforce cells), which is a finding about the documentation, not proof the feature is missing.

The two tabs use different columns: identity providers are scored on what they federate and provision to, ITDR and governance tools on which identity sources they ingest. Full definitions are in the dataset schema. Download the data as CSV or JSON. Example: for AWS, Workday, Slack and Active Directory, 4 platforms document full support for all four (JumpCloud, Microsoft Entra ID, Okta Workforce Identity and Ping Identity).

Set it up

SSF / CAEP in preview or limited form: Keycloak and Microsoft Entra ID. Inbound SCIM (another system can provision into the platform) documented by 8 of 13.

About the matrix

Which SSO integrates with AWS, GCP, and Azure?
Of the 13 workforce identity platforms in this matrix, 8 document federation to all three clouds (AWS sign-in with provisioning, an Entra ID tenant or Azure portal as a target, and Google Cloud through Workforce Identity Federation or Cloud Identity with provisioning): authentik, Cisco Duo, Google Cloud Identity and Google Workspace, JumpCloud, Microsoft Entra ID, miniOrange Workforce IAM, Okta Workforce Identity and Ping Identity. Checked against vendor and cloud provider documentation on 2026-11-05. Tick AWS, Azure and Google Cloud in the stack picker for the current list and the source behind each cell.
Which identity provider is best at integrating with old SSO systems?
For legacy and on-prem systems, 4 of 13 workforce platforms document all six legacy integrations we check (Active Directory sync, LDAP, Kerberos or IWA desktop SSO, RADIUS, header-based web apps and on-prem SAML or WS-Fed apps): authentik, miniOrange Workforce IAM, Okta Workforce Identity and Ping Identity. Coverage drops on the older protocols: 6 document Kerberos or IWA, 5 header-based apps and 5 WS-Fed relying parties or AD FS migration. "Best" depends on which of those your apps use, so pick them in the stack picker.
How to integrate IAM with AWS, Azure and GCP?
Use one workforce identity provider as the source of truth and federate each cloud to it: SAML plus SCIM into AWS IAM Identity Center, domain federation or provisioning into Microsoft Entra ID (or use Entra ID as the IdP), and Workforce Identity Federation into Google Cloud, which needs no user sync. 8 of the 13 platforms here document all three. SWI's recipes walk through AWS IAM Identity Center federation, Google Cloud Workforce Identity Federation and SCIM provisioning from Entra ID or Okta step by step.
IAM platform comparison for regional banks core banking integration
Core banking systems are not a column: the matrix records only integrations named in vendor documentation, and we did not survey core banking connectors. What it does show is on-prem reach: 4 workforce platforms (authentik, miniOrange Workforce IAM, Okta Workforce Identity and Ping Identity) document Active Directory, LDAP, Kerberos or IWA, RADIUS, header-based and on-prem SAML or WS-Fed integration. If your core banking front ends authenticate through any of those, check those columns, then ask the vendor for a named reference integration with your core provider.
Which leading ITDR platforms offer deep integration with identity providers?
All 3 ITDR platforms in the matrix (CrowdStrike Falcon Identity Protection, Microsoft Defender for Identity and Silverfort Identity Security Platform) document ingesting Okta, Microsoft Entra ID and on-prem Active Directory. 2 of them also document Ping Identity as a full source: CrowdStrike Falcon Identity Protection and Silverfort Identity Security Platform. Cloud IAM is the weak spot for ITDR: none of the 3 document ingesting AWS IAM, Azure RBAC and Google Cloud IAM together, against 4 of 4 identity governance platforms.
Which identity fabric solutions offer the best integration with cloud platforms?
Among governance and ITDR platforms, 4 of 7 document connectors for all three cloud permission models (AWS IAM, Azure RBAC and Google Cloud IAM): C1, SailPoint Identity Security Cloud, Saviynt Identity Cloud and Veza Access Platform. Among workforce identity providers, 8 of 13 document sign-in federation to AWS, Azure and Google Cloud. An identity fabric usually combines one of each, so use both tabs of the matrix.
Which identity providers support Workday as an HR source?
4 of 13 workforce identity platforms document a Workday connector that creates, updates and deactivates users: JumpCloud, Microsoft Entra ID, Okta Workforce Identity and Ping Identity. Only Okta Workforce Identity documents all five HR systems we check (Workday, SAP SuccessFactors, BambooHR, Rippling and UKG). Identity governance tools cover HR better: 4 of 4 document Workday as an identity source.
How is this matrix sourced and can I reuse it?
The matrix has 455 cells. Every Yes, Partial and No (314) links to the platform's own documentation or integration catalog, or to the target's official docs that list the platform, with a check date. "Not documented" (141 cells) means we could not find or read a vendor page that says either way, never that the feature is missing. The data is CC BY 4.0: download the CSV or JSON, cite the page and link back. Send corrections with a public doc link through the contact page.