Dataset · CC BY 4.0 · verified 2026-10-31
Phishing-Resistant MFA Support Matrix
Which of 95 widely used business apps support passkeys and FIDO2 security keys for workforce sign-in, whether an admin can make them mandatory, which plan includes SSO, and whether SCIM provisioning is offered. Every cell links back to the vendor's own documentation. Analysis: what the matrix shows.
95
business SaaS apps checked
54%
support passkeys or security keys on their own login
13%
let admins require phishing-resistant MFA
60%
charge more for SSO (higher tier, enterprise or add-on)
95 of 95 apps
| App | Passkeys | Security keys | Enforce | SSO | SSO starts at | SCIM |
|---|---|---|---|---|---|---|
Security and IT Security keys work as a second factor in place of a six-digit code. The team 2FA policy allows or enforces 2FA with an authenticator app, security key, or Duo, but no setting restricts it to security keys. Passkey sign-in is documented only for new Individual accounts. SSO sign-in is OIDC only, is documented for 1Password Business, and Owners still sign in with account password and Secret Key. Vendor source | No | Yes | No | OIDC | Business Higher paid tier | Yes |
Adobe Creative Cloud for business (Admin Console) Design and marketing Adobe accounts can add passkeys stored on the device, a phone or a FIDO2 USB security key, and use them to sign in without a password. Admins can enforce 2-step verification org-wide for Enterprise ID and Adobe ID users, but its methods are email, SMS and the Adobe Account Access app. The passkey help articles are written for Adobe accounts in general and do not say whether Enterprise ID users can add passkeys. SSO uses Federated ID, which works with SAML 2.0 or with Microsoft Entra ID over OIDC. Federated ID is not supported on Creative Cloud for teams. Sync is through Entra ID Sync, Google Sync or the User Sync Tool, and the docs never mention SCIM. Vendor source | Yes | Yes | No | SAML, OIDC | Creative Cloud for enterprise Enterprise only | ? |
ADP Workforce Now HR and finance ADP Federated Single Sign-On uses SAML 2.0, covers ADP Workforce Now among other ADP platforms, and is listed at $0 per month on ADP Marketplace (a guided implementation option also exists); clients with 1,000+ employees request it through the Support Center. ADP's public pages do not describe native passkey or security key sign-in, and Workforce Now pricing is quote-based. Vendor source | ? | ? | ? | SAML | All plans (ADP Federated Single Sign-On, free Marketplace edition) All paid plans | ? |
Airtable Productivity Airtable 2FA uses an authenticator app only and needs an Airtable password, so accounts that sign in with Google cannot set it up. Requiring 2FA is an Enterprise Scale admin setting. SAML 2.0 SSO is available on Business and Enterprise Scale. The same SSO article, marked for Business and Enterprise Scale, describes SCIM through Okta, Entra ID or a custom integration, but it does not give a separate plan line for SCIM. Vendor source | No | No | No | SAML | Business Higher paid tier | Yes |
Asana Productivity Asana's admin and security page confirms admins can enforce 2FA and SAML, and the pricing page lists SAML authentication and SCIM on Enterprise (the SCIM row is tagged with a permissions management add-on). Asana's help center renders client-side and could not be read, so 2FA methods are unconfirmed. Vendor source | ? | ? | ? | SAML | Enterprise Enterprise only | Yes |
Atlassian Cloud (Jira, Confluence) Collaboration Atlassian accounts support security keys (such as YubiKey) as a 2SV method and passkeys for passwordless sign-in; for managed users admins can allow or block passkeys per authentication policy (blocked by default), but no setting requires passkeys or security keys, and enforced 2SV still allows authenticator apps. SAML SSO and SCIM need the Atlassian Guard Standard subscription, which the Cloud Enterprise plan includes at no extra cost. The user-facing passkey article still says managed accounts cannot use passkeys; the newer admin article is treated as current. Vendor source | Yes | Yes | No | SAML | Atlassian Guard Standard Paid add-on | Yes |
Security and IT Dashboard users can self-enroll in MFA with WebAuthn FIDO security keys, WebAuthn device biometrics, Guardian push, OTP, or SMS. Auth0 Teams SSO connections and SSO enforcement are for Enterprise tenants only (Early Access on Public Cloud, beta on Private Cloud); team-member accounts are created by JIT. The Teams security policies page says it can enforce MFA but does not describe limiting factors to WebAuthn. Vendor source | ? | Yes | ? | SAML, OIDC | Enterprise Enterprise only | ? |
AWS Management Console Cloud infrastructure Root and IAM users can register synced passkeys or FIDO security keys as MFA, up to eight MFA devices per user. IAM policy conditions only test whether MFA is present (aws:MultiFactorAuthPresent, aws:MultiFactorAuthAge) and cannot test the MFA type, so IAM users cannot be held to phishing-resistant methods; IAM Identity Center (no additional charge, SAML 2.0 plus SCIM) does let admins allow only security keys and built-in authenticators. Vendor source | Yes | Yes | No | SAML | All plans All paid plans | Yes |
BambooHR HR and finance Passkeys work on desktop and in the mobile app for companies using BambooHR's own sign-in; the option is hidden when a company signs in only through SSO. 2-Step Login (authenticator app) is available on all packages; passkey docs mention only device biometrics or PIN, not hardware keys, and do not say admins can require passkeys. SAML works with Okta, OneLogin, Microsoft, or any SAML 2.0 IdP; the pricing page (Core, Pro, Elite) does not list SSO. No plan that includes SSO is documented on the pricing page. Vendor source | Yes | ? | ? | SAML | Not stated on pricing page Plan not documented | ? |
BILL (Bill.com) HR and finance BILL's pricing comparison table lists 'Single sign-on' on Corporate ($89 per user per month) and Enterprise but not Essentials or Team, although the Enterprise plan card also lists SSO as an addition over Corporate. The SSO protocol is not named publicly (saml set false pending confirmation), and the help center renders only with JavaScript, so MFA methods could not be verified; BILL's security page says only that it applies 2-factor authentication. Vendor source | ? | ? | ? | None | Corporate Higher paid tier | ? |
Bitbucket Cloud DevOps and engineering Sign-in uses the Atlassian account. Passkeys are blocked by default for managed users, and admins can allow or block them per authentication policy. Policies can require two-step verification but have no setting that limits it to passkeys or security keys. SAML SSO and SCIM need Atlassian Guard Standard ($4.35/user/month); Guard Standard is included with Atlassian Cloud Enterprise. Vendor source | Yes | Yes | No | SAML | Atlassian Guard Standard (add-on) Paid add-on | Yes |
Security and IT FIDO2 WebAuthn two-step login is free for all users, and passkey login works in the web app and Chromium extensions, but not for members of orgs using the Require SSO policy. The Require two-step login policy accepts any method. Login with SSO (SAML 2.0 and OIDC) is for Enterprise organizations; SCIM is available to Teams and Enterprise. Vendor source | Yes | Yes | No | SAML, OIDC | Enterprise Enterprise only | Yes |
Box Collaboration Box added FIDO2/WebAuthn security keys as an MFA method alongside TOTP apps, SMS and email; local MFA options are not available when the org requires SSO. The admin 'Limit to selected methods' setting lists Security Key and Authenticator app as '(Required)', so it is unclear whether admins can allow security keys only. The docs mention passkeys only in the Box mobile app MFA flow and describe no separate passkey enrollment. SSO (SAML 2.0) is for Business and Enterprise accounts. IdP provisioning is described as Box API based, with no SCIM mention. Vendor source | ? | Yes | ? | SAML | Business Higher paid tier | ? |
Brex HR and finance Brex added passkey sign-in in July 2026 (admins enable it under Settings > Early Access); a passkey can use Face ID, Touch ID, a device PIN, or a security key and replaces the password and MFA, but it is unavailable for users on SSO. All password sign-ins require MFA; docs do not say admins can require passkeys. SAML or OIDC SSO (OIDC not supported with Entra ID) and SCIM are tagged Premium, Enterprise, and Smart card. Vendor source | Yes | Yes | ? | SAML, OIDC | Premium Higher paid tier | Yes |
Calendly Productivity Calendly 2FA supports TOTP authenticator apps only. It may also email a login code when a sign-in looks unusual. The docs do not describe admins requiring 2FA. SAML 2.0 SSO requires the Teams plan with the SSO add-on or the Enterprise plan, and SCIM 2.0 requires Enterprise. Vendor source | No | No | No | SAML | Teams (with SSO add-on) Paid add-on | Enterprise |
CircleCI DevOps and engineering Docs state CircleCI supports MFA through authenticator apps only. Users who sign in with GitHub or Bitbucket rely on that provider's MFA. SAML SSO is on the Scale plan, which is contact-sales. Vendor source | No | No | No | SAML | Scale Enterprise only | ? |
ClickUp Productivity ClickUp's pricing comparison lists 2FA via authentication app and via SMS, with Optionally Require 2FA on Business and up, and no security key option. SAML SSO, Microsoft SSO, Okta SSO, and SCIM are Enterprise only. ClickUp's help center blocked automated access, so passkey sign-in could not be confirmed. Vendor source | ? | No | No | SAML | Enterprise Enterprise only | Yes |
Cloud infrastructure 2FA factors are security keys (hardware or built-in WebAuthn authenticators), TOTP, and email codes. Super Administrators can require 2FA but cannot limit it to security keys. Dashboard SSO is free on all plans through a Zero Trust organization on any tier, including Free; any Zero Trust IdP can be used, generic OIDC included. SCIM is Enterprise-only and works with Okta and Entra. Vendor source | ? | Yes | No | SAML, OIDC | All plans All paid plans | Enterprise |
Coda Productivity Optional 2FA is TOTP authenticator app only and applies only to email and password logins; Google, Microsoft, Apple and magic-link sign-in are also offered. SAML SSO and SCIM are Enterprise only, and Enterprise admins can turn off other sign-in options. coda.io/pricing now redirects to Superhuman Docs pricing. Vendor source | No | No | No | SAML | Enterprise Enterprise only | Enterprise |
Confluent Cloud Data and analytics Local-account MFA is FIDO2 only (security key, biometric authenticator or passkey), so when an OrganizationAdmin requires MFA every local user must use a phishing-resistant factor; Sign-in with Google or GitHub accounts and SSO users are outside this MFA. SAML SSO is listed on Basic and higher clusters, OIDC SSO is limited to Azure Marketplace, and SCIM needs the paid Advanced Security add-on. Vendor source | Yes | Yes | Yes | SAML, OIDC | All plans All paid plans | Yes |
Databricks Data and analytics Databricks-managed MFA (passkeys, security keys, authenticator apps) can be set to Required, Recommended or Disabled in the account console, but there is no documented way to exclude authenticator apps. It is only available when SSO is not configured; with unified-login SSO (SAML 2.0 or OIDC), MFA moves to the IdP, and Premium is now the lowest platform tier. Vendor source | Yes | Yes | No | SAML, OIDC | Premium All paid plans | Yes |
Datadog DevOps and engineering MFA docs describe only TOTP authenticator apps, one per account. Admins can require MFA for email and password logins but have no documented method restriction. The pricing table lists SAML SSO on Free, Pro and Enterprise infrastructure tiers (enabled through support); SCIM is on Infrastructure Pro and Enterprise. Vendor source | ? | ? | No | SAML | All plans All paid plans | Yes |
dbt Cloud (dbt platform) Data and analytics dbt enforces MFA for every username/password user on all plans; methods are SMS (+1 numbers only), authenticator app or a WebAuthn security key, chosen per user, so admins cannot restrict methods. SSO (SAML 2.0, Okta, Entra ID, Google Workspace) and SCIM need the contact-sales Enterprise or Enterprise+ plan, and the docs do not label any connector as OIDC. Vendor source | ? | Yes | No | SAML | Enterprise Enterprise only | Enterprise |
Deel HR and finance Deel's SAML 2.0 Connect app lets members sign in through Okta, Ping Identity, JumpCloud, OneLogin, or Azure and makes SSO mandatory for every member, replacing password and Google login. The Deel help center (help.letsdeel.com) returned HTTP 403 to automated fetches, so native MFA methods, the SSO plan, and SCIM could not be verified; OIDC is not mentioned. No plan that includes SSO is documented on the pricing page. Vendor source | ? | ? | ? | SAML | Not stated on pricing page Plan not documented | ? |
DigitalOcean Control Panel Cloud infrastructure Account 2FA is an authenticator app or SMS only. Team owners can 'require secure sign-in', which accepts 2FA, Google sign-in, or GitHub sign-in. Team SSO is OIDC only, with no SAML. DigitalOcean's September 2025 launch release says SSO is included in every plan. Vendor source | No | No | No | OIDC | All plans All paid plans | ? |
Docker Hub DevOps and engineering The 2FA docs describe only TOTP authenticator apps, one per account, and say organization settings do not include 2FA, so admins can only enforce sign-in through SSO. SSO (SAML 2.0 or OIDC, including Entra ID OIDC) and SCIM need Docker Business ($24/user/month, self-serve). Vendor source | ? | ? | No | SAML, OIDC | Docker Business Higher paid tier | Enterprise |
Docusign eSignature Productivity Users can register a passkey (device biometrics) or a FIDO2 physical security key, either for two-step verification or for passwordless login. Docusign calls passwordless login a new feature that may not be on every account, and it cannot be used where SSO is required. SSO is only on the contact-sales Enhanced plans. Docusign's support center renders only with JavaScript, so admin enforcement, OIDC and SCIM could not be confirmed; SAML is recorded from Docusign's SSO documentation but the protocol page could not be machine-read. Vendor source | Yes | Yes | ? | SAML | Enhanced plans Enterprise only | ? |
Dropbox Collaboration Security keys (FIDO U2F or WebAuthn) work as a 2FA method only on dropbox.com in Chrome or Firefox, not in desktop or mobile apps, and SMS or app codes must be set up first. On team accounts, passkey sign-in stays off until an admin turns it on, and it is unavailable when SSO is required. Admins can require 2FA but cannot require a particular method. SSO is on Advanced, Business Plus and Enterprise team plans. Dropbox help documents Entra ID provisioning but never says SCIM. Vendor source | Yes | Yes | No | SAML | Advanced Higher paid tier | ? |
Security and IT Admin login methods include passkeys (security keys and biometrics), Yubikey AES, Duo Push with optional Verified Push, passcodes, SMS and phone; Owners can limit admins to chosen methods under Admin Authentication Methods, so passkeys-only is possible. Administrator SAML SSO is on Duo Essentials, Advantage and Premier (all paid plans, not Duo Free) and is unavailable to Security Cloud Sign-On customers. Vendor source | Yes | Yes | Yes | SAML | Essentials All paid plans | ? |
Elastic Cloud Data and analytics MFA is mandatory for email/password logins and cannot be turned off; methods are authenticator app, security key or biometrics, and email code, and no admin control over methods is documented. Organization-level SSO is SAML only and needs an Enterprise subscription on Elastic Cloud Hosted (it is included on any Serverless tier); OIDC exists only at deployment level, not for the Cloud console. Vendor source | ? | Yes | No | SAML | Enterprise Higher paid tier | ? |
Expensify HR and finance Expensify 2FA is TOTP from an authenticator app, on top of an emailed magic code; Domain Admins can require 2FA for all domain members but cannot require a specific method. SAML SSO is a Control plan feature, Domain Admins can turn on 'Require SAML login', and Okta SCIM provisioning is available on request from Concierge. Vendor source | No | No | No | SAML | Control Higher paid tier | Yes |
Figma Design and marketing Figma's own 2FA lists only SMS and authenticator apps (Google Authenticator, Duo Mobile, Authy); no security key or passkey option is documented. Org-wide 2FA requirement needs the Governance+ add-on, which is Enterprise-only, and SSO users must set MFA at their IdP. SAML SSO and SCIM setup are documented for Organization and Enterprise; setting seat types via SCIM is Enterprise-only. The only non-SAML SSO is Google sign-in, so OIDC is recorded as false. Vendor source | No | No | No | SAML | Organization Higher paid tier | Yes |
Freshworks (Freshdesk, Freshservice) Support and service The Freshworks account supports passwordless passkey sign-in (biometrics, PIN or hardware security key) once an admin turns on Passkey under Default Login Methods; native 2FA uses an authenticator app. Docs do not say whether passkeys can be made mandatory, so enforcement is unknown. SAML, OIDC, OAuth 2.0 and JWT SSO are listed on every paid Freshdesk and Freshservice plan; no SCIM documentation was found. Vendor source | Yes | Yes | ? | SAML, OIDC | Growth (Freshdesk); Starter (Freshservice) All paid plans | ? |
GitHub DevOps and engineering Org owners can require 2FA and turn on 'Only allow secure two-factor methods', but GitHub counts authenticator apps and GitHub Mobile as secure alongside passkeys and security keys, so admins cannot require phishing-resistant methods only. OIDC is offered only for Enterprise Managed Users with Microsoft Entra ID; SAML and SCIM are on GitHub Enterprise ($21/user/month). Vendor source | Yes | Yes | No | SAML, OIDC | Enterprise Enterprise only | Enterprise |
GitLab.com DevOps and engineering Passwordless passkey sign-in became generally available in GitLab 18.9 on all tiers. When a group enforces 2FA, either an authenticator app (TOTP) or WebAuthn satisfies it, so owners cannot require WebAuthn only. Group SAML SSO and SCIM on GitLab.com are on Premium and Ultimate, which are the only paid tiers. Vendor source | Yes | Yes | No | SAML | Premium All paid plans | Yes |
Gong CRM and sales Gong documents no MFA of its own: sign-in is email and password, Google, Microsoft, Salesforce, SAML SSO or OpenID Connect (Okta, OneLogin), and Gong recommends SSO so the IdP policy applies. Authentication settings and SCIM provisioning are marked "Available on: Any Gong plan"; Gong pricing is quote-based. Vendor source | Via SSO | Via SSO | Via SSO | SAML, OIDC | All plans All paid plans | Yes |
Google Cloud console Cloud infrastructure Console sign-in is a Google account managed through Cloud Identity or Google Workspace. Admins can enforce 2SV with the 'Only security key' method, which now accepts passkeys as well as security keys. SSO from a third-party IdP (SAML or OIDC) is included in Cloud Identity Free, and Google Cloud customers can get Cloud Identity licenses at no cost. Vendor source | Yes | Yes | Yes | SAML, OIDC | All plans All paid plans | ? |
Google Workspace Productivity Workspace accounts can use passkeys to skip passwords and passkeys or security keys for 2-Step Verification; the 2SV enforcement option Only security key accepts both, and admins can limit passkeys to hardware security keys. Workspace can act as a SAML or OIDC service provider to a third-party IdP, and the help pages list no edition restriction for this (the pricing page does not list SSO). Google documents no inbound SCIM endpoint for Workspace itself; IdPs such as Okta provision users through Google's own APIs instead. Vendor source | Yes | Yes | Yes | SAML, OIDC | All plans All paid plans | No |
Grafana Cloud DevOps and engineering Cloud Portal MFA is TOTP only; docs state hardware security keys are not supported. Admins can enforce MFA, but social-login users are exempt. SAML on stacks needs Pro or Advanced; stacks also support OAuth/OIDC and SCIM (Okta, Entra ID), while Cloud Portal SAML is in private preview. Vendor source | ? | No | No | SAML, OIDC | Pro All paid plans | Yes |
HCP Terraform (Terraform Cloud) DevOps and engineering 2FA docs describe only a TOTP app plus backup codes. Org owners can require 2FA but have no documented method restriction. SAML SSO is available to all organizations, including Free Edition (with fixed owners and sso teams), and owners can bypass SSO. Vendor source | ? | ? | No | SAML | All plans All paid plans | ? |
Heroku Dashboard Cloud infrastructure MFA is mandatory for all Heroku users. Methods are Salesforce Authenticator, third-party authenticator apps, security keys, built-in authenticators (Windows Hello, Touch ID), and recovery codes. No admin control to restrict methods is documented. SAML 2.0 SSO is for Heroku Teams and Heroku Enterprise customers only, and SSO users must have MFA enforced at their IdP. Vendor source | ? | Yes | No | SAML | Heroku Teams All paid plans | ? |
HubSpot CRM and sales Passkeys work as a login method on all tiers, including FIDO2 hardware tokens such as YubiKey; 2FA is mandatory on paid tiers and also offers authenticator app and SMS. Super Admins can set passkeys as the allowed login method with an enforcement date, though users required to use SSO cannot use passkeys. SAML SSO and SCIM need a Professional or Enterprise subscription (for example Sales Hub Professional); OIDC is not documented. Vendor source | Yes | Yes | Yes | SAML | Professional Higher paid tier | Yes |
Intercom Support and service Native 2FA uses authenticator app codes only, and admins can enforce 2FA workspace-wide but not a method. SAML SSO is on the Expert plan and can be made the only login method; OIDC is not documented. SCIM requires SAML SSO, but the SCIM articles only say it is available on certain plans and defer to the pricing page, which lists "SSO & identity management" on Expert without naming SCIM. Vendor source | No | No | No | SAML | Expert Higher paid tier | ? |
Jamf Pro Security and IT Admins can sign in to Jamf Pro with SAML 2.0 SSO or with OIDC SSO through Jamf Account, or use a Jamf ID with optional MFA. Jamf's FIDO2 page covers Self Service for macOS end users, not admin login. Pricing is by quote and the SSO docs state no plan restriction. Vendor source | ? | ? | ? | SAML, OIDC | Not stated (sold by quote) Plan not documented | ? |
JetBrains Account DevOps and engineering 2FA docs describe only authenticator-app codes. Organization admins can require 2FA in JetBrains Console but have no documented method restriction. JetBrains Account organization docs describe no SSO; SAML, OIDC and SCIM are documented only for the separate JetBrains IDE Services product. Vendor source | ? | ? | No | None | Not offered Not offered | ? |
Kandji (Iru) Security and IT kandji.io now redirects to iru.com/kandji-mdm; the support site is still branded Kandji. Email and password login enforces MFA, but the only documented method is one TOTP app per user. Admins can disable Standard Authentication so admins must use SAML SSO (Entra, Google, Okta, JumpCloud, OneLogin, custom SAML). SCIM directories are documented for Okta, OneLogin, and Entra ID, but the page does not say whether they provision admins or device users. Pricing is by quote and the SSO docs state no plan restriction. Vendor source | No | No | No | SAML | Not stated (sold by quote) Plan not documented | Yes |
Security and IT Passwordless vault login works on desktop with Windows Hello, Touch ID or a USB security key, and on mobile with device biometrics; Business admins must enable it by policy, and the docs do not call it passkey login. Federated login (Entra ID, Google Workspace, Okta, PingOne, PingFederate, OneLogin, AD) is on Business and Business Max, not Teams; the Okta setup uses an OIDC single-page app plus SCIM provisioning, and no doc read names SAML for vault login. Vendor source | ? | Yes | ? | OIDC | Business Higher paid tier | Yes |
Linear DevOps and engineering Login is passwordless: email link or code, Google, passkey, or SAML. On Business and Enterprise, admins can require specific login methods, but the top role (owners or admins) can still log in by any method, and the docs do not confirm passkey-only as an option. SAML and SCIM are Enterprise only. Vendor source | Yes | ? | No | SAML | Enterprise Enterprise only | Enterprise |
LinkedIn Sales Navigator CRM and sales Users sign in with their personal LinkedIn account, whose 2FA offers SMS or an authenticator app (plus a mobile sign-in prompt); no passkey or security key option is documented. SAML 2.0 SSO adds a corporate sign-in before the LinkedIn credential check rather than replacing it, and LinkedIn says it does not support OpenID. SSO is on Advanced only when bought through a sales rep and on Advanced Plus; SCIM (Okta, OneLogin, Entra ID) is on Advanced and Advanced Plus. Vendor source | No | No | No | SAML | Advanced (sales-assisted purchase) Enterprise only | Yes |
Looker Data and analytics Looker (original) built-in 2FA is authenticator-app codes only and, when turned on, applies to all email/password users with no exemptions. Looker (Google Cloud core) does not support email/password at all and relies on Google OAuth, SAML, OIDC or Workforce Identity Federation, so on core it is effectively SSO-only; the docs show no edition limit on authentication across Standard, Enterprise and Embed. Vendor source | No | No | No | SAML, OIDC | All plans All paid plans | ? |
Loom Collaboration Loom sign-in uses Atlassian accounts: 2SV supports authenticator apps, SMS and security keys, and org admins can allow passkeys for managed users per authentication policy (blocked by default), but cannot require passkeys or keys. SAML SSO and SCIM are Enterprise-only on Loom pricing; Business plans can buy Atlassian Guard separately. Vendor source | Yes | Yes | No | SAML | Enterprise Enterprise only | Enterprise |
Lucid (Lucidchart, Lucidspark) Collaboration Local 2FA uses a third-party TOTP authenticator app, and Enterprise admins can enforce it for email and password users. SAML SSO and SCIM are Enterprise only; Google and Office 365 sign-in are also offered, but no custom OIDC IdP is documented. Vendor source | No | No | No | SAML | Enterprise Enterprise only | Enterprise |
Mailchimp Design and marketing Local 2FA is SMS or an authenticator app only; when an Owner or Admin turns on 2FA, all other users must set it up, but no method choice is offered. Enterprise SSO is OIDC only (no SAML, IdP-initiated only), on Premium, with a Require SSO setting. SSO docs describe invitation-based user management and do not mention SCIM. Vendor source | No | No | No | OIDC | Premium Higher paid tier | ? |
Microsoft 365 Productivity Microsoft 365 sign-in is Microsoft Entra ID, which supports synced passkeys and device-bound passkeys on FIDO2 security keys or in Microsoft Authenticator in all editions, including Entra ID Free. Requiring them needs the built-in Phishing-resistant MFA authentication strength in Conditional Access, which needs Entra ID P1 (included in Microsoft 365 Business Premium and E3/E5, not Business Basic or Standard). Tenants can federate custom domains to a third-party SAML 2.0 or WS-Fed IdP; SCIM-format inbound provisioning (API-driven inbound provisioning) also needs Entra ID P1, which is included in Microsoft 365 Business Premium. Vendor source | Yes | Yes | Yes | SAML | All plans All paid plans | Yes |
Microsoft Azure portal Cloud infrastructure Portal sign-in is Microsoft Entra ID. Passkeys (FIDO2, synced or device-bound) are in all editions including Entra ID Free, and MFA is mandatory for Azure portal sign-in. Restricting sign-in to the built-in Phishing-resistant MFA strength needs Conditional Access (Entra ID P1). Federation to an external IdP is documented for AD FS, PingFederate, and SAML/WS-Fed. API-driven inbound provisioning (SCIM schema payloads) needs P1 or P2. Vendor source | Yes | Yes | Yes | SAML | All plans All paid plans | Yes |
Security and IT Passkeys (FIDO2) include device-bound passkeys in Microsoft Authenticator. The built-in Phishing-resistant MFA authentication strength (FIDO2 key, Windows Hello for Business or platform credential, multifactor CBA) can be required for all users through Conditional Access, which needs Entra ID P1. For an IdP product, SAML means a verified domain can be federated to a third-party SAML 2.0 (or WS-Fed) IdP; Microsoft Entra Connect is listed as free, and no OIDC federation for member sign-in is documented. SCIM: API-driven inbound provisioning accepts SCIM-schema bulk payloads and needs P1. Vendor source | Yes | Yes | Yes | SAML | Microsoft Entra ID Free All paid plans | Yes |
Miro Collaboration Miro's pricing page lists 2FA on all plans, SAML single sign-on from Business, and SCIM user provisioning on Enterprise only. Miro's help center blocked automated access, so 2FA methods and method enforcement are unconfirmed. Vendor source | ? | ? | ? | SAML | Business Higher paid tier | Enterprise |
monday.com Productivity monday.com's Security and Privacy white paper (V2.3, linked from monday.com/security) lists 2FA by SMS or authenticator app only, with no passkeys or security keys; Google SSO is on Pro and Enterprise. Okta, Entra ID, OneLogin, Oracle, and custom SAML 2.0 SSO plus SCIM are Enterprise only. Vendor source | No | No | No | SAML | Enterprise Enterprise only | Yes |
MongoDB Atlas Data and analytics MFA is required for Atlas credentials; factors are security key or biometrics (FIDO2, Windows Hello), Okta Verify, authenticator app and email, with SMS closed to new users. Org owners can require MFA but no setting to limit methods is documented. SAML SSO for the Atlas UI is ticked on the Free, Flex and Dedicated tiers, while OIDC (Workforce Identity Federation) covers database access only. Vendor source | ? | Yes | No | SAML | All plans All paid plans | ? |
Netlify app Cloud infrastructure Native 2FA is an authenticator app only, and Netlify itself recommends FIDO2 through an identity provider via SSO. 2FA enforcement (None, Encouraged, Enforced) is available on Pro and higher. Team and Organization SAML SSO and SCIM Directory Sync are Enterprise only. Vendor source | No | No | No | SAML | Enterprise Enterprise only | Enterprise |
NetSuite HR and finance All roles can sign in with a passkey instead of a password; Oracle describes passkeys as physical or digital and recommends FIDO2-compliant, FIDO-certified ones. From 2026.2 a FIDO2 passkey can satisfy 2FA, but an authenticator app code is still requested every three months and admins can only disable passkey-as-2FA, not require it. NetSuite has no public pricing page and the docs give no cost for SSO, so sso_tax is unconfirmed; no native SCIM endpoint is documented. Vendor source | Yes | Yes | No | SAML, OIDC | Not stated (sold by quote) Plan not documented | ? |
New Relic DevOps and engineering Admins can turn on MFA per authentication domain, but the documented method is email verification with backup codes, which is not phishing-resistant. SAML SSO requires a paid edition, and the pricing page lists it on Standard; SCIM requires Pro or Enterprise. Vendor source | ? | ? | No | SAML | Standard All paid plans | Yes |
Notion Productivity Passkeys work on all plans, including FIDO2 security keys such as YubiKey, but Notion says workspace owners cannot enforce passkeys, and passkeys are unavailable when the organization requires IdP login. 2-step verification offers authenticator codes or SMS, and only Enterprise owners can require MFA, for guests only. SAML SSO starts on Business; SCIM is Enterprise only. Vendor source | Yes | Yes | No | SAML | Business Higher paid tier | Enterprise |
npm (npmjs.com) DevOps and engineering Since October 2025, new 2FA setups must use WebAuthn or passkeys as a second factor, and new TOTP setups are disabled. Existing TOTP still works for now, and org owners can require 2FA but cannot restrict which method members use. npm organization docs describe no SSO or SCIM. Vendor source | Yes | Yes | No | None | Not offered Not offered | No |
Security and IT Okta FastPass and the FIDO2 WebAuthn passkey authenticator are phishing resistant, and the Okta Admin Console app sign-in policy can require a phishing-resistant possession factor. SAML and OIDC here mean admins can sign in through an external IdP added under Identity Providers; the pricing page lists SSO from Starter up but does not say which plan includes inbound IdP routing. Vendor source | Yes | Yes | Yes | SAML, OIDC | Starter All paid plans | ? |
Outreach CRM and sales Outreach states that MFA options are not available directly in the platform, so phishing-resistant sign-in depends on the SAML IdP; once SSO is on it is the only way in. No plan that includes SSO or SCIM is documented in the help center or on the pricing page. The SCIM API document is marked as subject to change after beta. Vendor source | Via SSO | Via SSO | Via SSO | SAML | Not stated (sold by quote) Plan not documented | Yes |
PagerDuty DevOps and engineering Docs describe no native MFA for username and password login, and the security hygiene guidance points to passwords plus SSO. SSO (SAML or Google) is on Professional, Business and Enterprise for Incident Management, and SCIM is on all plans. Vendor source | ? | ? | ? | SAML | Professional All paid plans | Yes |
Pipedrive CRM and sales Native 2FA uses an authenticator app or email verification; no passkey or security key option is documented. Enforcing 2FA for all users is a security rule on the Ultimate plan. SAML SSO is available on all plans and can be enforced; the help center has no SCIM documentation and its SSO guides describe manual user assignment in the IdP. The pricing page blocked automated fetches, so plan names were not confirmed there. Vendor source | No | No | No | SAML | All plans All paid plans | No |
Postman DevOps and engineering Account docs describe 2FA only through an authenticator app for password sign-ins and describe no admin method restriction. SAML 2.0 SSO comes with Enterprise or Team plus the Simple Security add-on; SCIM is Enterprise only. Vendor source | ? | ? | No | SAML | Team with Simple Security add-on Paid add-on | Enterprise |
PyPI DevOps and engineering 2FA has been mandatory for all accounts since 2024, using a FIDO/WebAuthn security device (preferred) or a TOTP app, so phishing-resistant methods are not required. Organization account docs describe no SSO, SCIM, or 2FA-method policy. Vendor source | ? | Yes | No | None | Not offered Not offered | No |
QuickBooks Online HR and finance Users can add passkeys to their Intuit Account and sign in without a password or one-time code; Intuit docs do not mention hardware security keys and describe no admin control over sign-in methods. Organization SSO (Entra ID, Google Workspace, Okta) with SCIM is free only for Intuit Enterprise Suite, Intuit Accountant Suite and QuickBooks Online Accountant, not the Simple Start to Advanced plans; the help article does not name the protocol, so saml and oidc are left false. Vendor source | Yes | ? | No | None | Intuit Enterprise Suite Enterprise only | Enterprise |
Ramp HR and finance Users can register up to 6 passkeys, including a security key such as a YubiKey (Chrome or Edge; Safari skips that option), and a passkey replaces both the password and the MFA step. Ramp states admins cannot require passkeys, but admins can set sign-in methods per role and require SAML (Okta, Entra ID, OneLogin, JumpCloud, others) or Google SSO; the pricing page marks 'Secure logins with SCIM, SSO, and SAML' on Free, Plus, and Enterprise. Vendor source | Yes | Yes | No | SAML | Free All paid plans | Yes |
Rippling HR and finance Rippling authentication policies can require MFA per group or per employee, and Rippling's own pages give the example of requiring YubiKeys for admins and recommend a hardware security key for SuperAdmins; Rippling lists YubiKey, passkeys, and authenticator apps among its MFA methods. Inbound SAML/OIDC into Rippling and SCIM could not be confirmed because the help center renders only with JavaScript, so saml/oidc are false pending confirmation. Pricing is quote-based and authentication policies are described under Rippling IT (Identity and Access). No plan that includes SSO is documented on the pricing page. Vendor source | Yes | Yes | Yes | None | Not stated (sold by quote) Plan not documented | ? |
Salesforce Sales Cloud CRM and sales Passkeys (built-in authenticators and synced passkeys) and WebAuthn security keys are MFA methods for direct login. Salesforce itself enforces phishing-resistant MFA for privileged users (admins and users with Modify All Data, View All Data, Customize Application or Author Apex) from July to September 2026, but non-privileged users can still choose Salesforce Authenticator or TOTP apps and no org-wide phishing-resistant-only setting is documented. Help docs list Federated Authentication (SAML) and SCIM as available in all editions; the Sales Cloud pricing page (Free Suite, Starter Suite, Pro Suite, Core, Advanced, Max) does not list SSO. Vendor source | Yes | Yes | No | SAML, OIDC | All plans All paid plans | Yes |
Sentry DevOps and engineering 2FA options are SMS, TOTP, and a WebAuthn factor labeled 'Passkey / Biometric / Security Key', used as a second factor. Owners can require 2FA but have no documented method restriction. Google and GitHub SSO are on Team; SAML2 and SCIM are on Business and Enterprise. Vendor source | Yes | Yes | No | SAML | Business Higher paid tier | Yes |
ServiceNow Support and service Instance MFA supports FIDO2/WebAuthn with biometrics, passkeys or hardware security keys, alongside TOTP, SMS and email factors. Admins can create a FIDO2 MFA factor policy targeted by role or group, which suppresses other factors for matching users. Multi-Provider SSO (SAML 2.0 and OIDC) and the SCIM v2 provider are platform plugins; ServiceNow publishes no plan-based pricing, and the docs do not tie them to a subscription tier. Vendor source | Yes | Yes | Yes | SAML, OIDC | All plans (quote-based subscriptions) All paid plans | Yes |
Shopify admin Design and marketing Shopify accounts can sign in with passkeys and use WebAuthn security keys or authenticator apps for two-step authentication; new SMS enrollment is closed. Plus organizations can require a secure sign-in method for all users, but not a specific one, so phishing-resistant enforcement needs SAML set to Required. SAML and SCIM API tokens are Plus-only. Vendor source | Yes | Yes | No | SAML | Plus Higher paid tier | Yes |
Slack Collaboration Slack's help center lists passkeys (Face ID, fingerprint, or PIN) as a way to confirm identity at email sign-in, and Slack's changelog says passkey sign-in reached Free, Pro, and Business+ workspaces in September 2026. Slack's 2FA article covers only authenticator apps and SMS and says Slack does not support U2F, so no security keys; owners can require 2FA and block SMS, but cannot require passkeys. SSO is SAML only. Vendor source | Yes | No | No | SAML | Business+ Higher paid tier | Yes |
Smartsheet Productivity Smartsheet's own login offers a password or an emailed one-time code, plus Google, Microsoft and Apple sign-in. Its authentication docs describe no second factor of its own. SAML SSO and directory provisioning are Enterprise-only; SCIM is documented through Entra ID. The Entra ID 'OIDC' option uses the built-in Microsoft sign-in button, not custom OIDC IdP setup, so OIDC is recorded as false. Vendor source | Via SSO | Via SSO | Via SSO | SAML | Enterprise Enterprise only | Enterprise |
Snowflake Data and analytics MFA methods are passkey, authenticator app (TOTP) and Duo; hardware keys are used as passkey storage (the docs cite YubiKey), and an authentication policy with MFA_POLICY = (ALLOWED_METHODS = ('PASSKEY')) restricts sign-in to passkeys. Snowflake's phased removal of single-factor passwords ran Sep 2025 to Oct 2026 (Phase 3, strong authentication for all users, enforced per account Aug-Oct 2026); reader and trial accounts are excluded. Vendor source | Yes | Yes | Yes | SAML, OIDC | Standard All paid plans | Yes |
Security and IT Common Services identity federation supports SAML third-party IdPs (with Entra ID SAML guides) and does not document OIDC. SCIM provisions users and groups into Strata Cloud Manager from SailPoint, OCI, and Okta, and groups map to predefined roles. Native Palo Alto Networks account MFA methods were not documented on the pages reviewed. Pricing is by quote and the SSO docs state no plan restriction. Vendor source | ? | ? | ? | SAML | Not stated (sold by quote) Plan not documented | Yes |
Stripe Dashboard HR and finance The Dashboard supports passkeys, FIDO U2F/FIDO2 security keys, Touch ID or Windows Hello, TOTP and SMS. Admins can require two-step authentication for the team but not a specific method, so phishing-resistant enforcement comes from mandating SAML SSO through the IdP. Stripe says SSO is available to all users; SCIM requires SSO and a live-mode account. Vendor source | Yes | Yes | No | SAML | All accounts All paid plans | Yes |
Supabase dashboard Cloud infrastructure Dashboard MFA is TOTP only. Organization owners on the Pro, Team, or Enterprise plan can require MFA for all members. SAML 2.0 SSO for the dashboard is on the self-serve Team plan and Enterprise. Vendor source | No | No | No | SAML | Team Higher paid tier | ? |
Tableau Cloud Data and analytics MFA has been required since Feb 1, 2022, either through an SSO IdP or 'Tableau with MFA', which accepts Salesforce Authenticator, TOTP apps, WebAuthn/U2F security keys and built-in authenticators; there is no documented way to restrict to keys, and keys do not work from Tableau Desktop or Prep Builder. SAML, generic OIDC, Google and Salesforce sign-in are documented without any edition limit. Vendor source | ? | Yes | No | SAML, OIDC | All plans All paid plans | Yes |
Security and IT Tailscale has no passwords: sign-in goes through an OIDC IdP (Google, Microsoft, GitHub, Apple, Okta, OneLogin, or custom OIDC) and MFA is set in that IdP. Passkey login (beta, all plans, invite-only) is also offered, and YubiKey is among the supported passkey managers. SCIM user and group provisioning is on Standard, Premium, and Enterprise. Vendor source | Yes | Yes | Via SSO | OIDC | All plans All paid plans | Yes |
Trello Productivity Trello uses Atlassian account sign-in: 2SV supports authenticator apps, SMS and security keys such as YubiKey, and org admins can allow passkeys for managed users per authentication policy (blocked by default). Admins can make 2SV mandatory but not pick the method; SAML and SCIM need Atlassian Guard Standard, which Trello Enterprise includes. Vendor source | Yes | Yes | No | SAML | Atlassian Guard Standard add-on (included in Trello Enterprise) Paid add-on | Yes |
Twilio Console Cloud infrastructure Console SSO is SAML 2.0 and is 'available to all Twilio Editions customers'; it requires a Twilio Organization with verified domains. Automated provisioning and deprovisioning use the Twilio SCIM API, and JIT provisioning is not supported. The Editions page lists SAML 2.0 SSO under its contact-sales editions. Twilio's public docs do not list the console 2FA methods. Vendor source | ? | ? | ? | SAML | Twilio Editions Enterprise only | Yes |
Twilio SendGrid Cloud infrastructure SendGrid two-factor authentication is an SMS code or an authenticator app, and security-restricted actions require it. Accounts on Unified Login manage 2FA in the Twilio Console instead. SAML 2.0 SSO is limited to Email API Pro, Premier, and Marketing Campaigns Advanced, with JIT provisioning of SSO Teammates. Vendor source | No | No | No | SAML | Pro Higher paid tier | ? |
Security and IT Admins sign in through an IdP or a social login (Google, Microsoft, GitHub, LinkedIn), and no Twingate passwords or passkeys are documented. Teams includes SSO via Google Workspace only; Okta (OIDC), Entra ID, and JumpCloud (SAML) plus IdP provisioning (SCIM) start at Business ($10/user/mo), and Keycloak/OneLogin are Enterprise. Vendor source | Via SSO | Via SSO | Via SSO | SAML, OIDC | Business Higher paid tier | Yes |
Vercel dashboard Cloud infrastructure 2FA methods are TOTP or a passkey (any WebAuthn device, including security keys), and passkey login is supported. Team 2FA enforcement is a single on/off switch with no method restriction. SAML is on Enterprise, and Pro teams must buy the SAML SSO add-on; Directory Sync (SCIM) is Enterprise only. Vendor source | Yes | Yes | No | SAML | Pro (paid add-on) Paid add-on | Enterprise |
Webflow Design and marketing Local 2FA is TOTP authenticator app plus backup codes only, available on all plans. SSO is Enterprise Workspace only and can be optional or required; Webflow says it supports OAuth and SAML connections but does not describe OIDC, so oidc is false. SCIM and JIT need SSO enforced and are set up by Webflow's Enterprise team. Vendor source | No | No | No | SAML | Enterprise Enterprise only | Enterprise |
Workday HR and finance Workday's public security page confirms SAML SSO, OpenID Connect, and x509 certificate authentication, plus a native login with configurable password rules. Native MFA methods (passkeys, security keys) are documented only in the login-gated Workday admin guide, which robots.txt also excludes, so they are recorded as unknown. Vendor source | ? | ? | ? | SAML, OIDC | Not stated (sold by quote) Plan not documented | ? |
Xero HR and finance MFA is mandatory but uses Xero Verify push or a TOTP authenticator app. Passkey login exists only in the Xero Me mobile app; Xero staff said in May 2026 that desktop passkeys are still being explored and YubiKey support is not confirmed. Xero's security and pricing pages describe no SAML or OIDC SSO or SCIM, so the not-offered values rest on vendor silence. Vendor source | No | No | No | None | Not offered Not offered | No |
Zendesk Support and service Native 2FA for team members uses an authenticator app, email or SMS codes; no passkey or security key option is documented, and admins can require 2FA but not a specific method. SAML and OIDC SSO are available on all Suite and Support plans. Zendesk states it has no official SCIM connections and points to its user API instead. Vendor source | No | No | No | SAML, OIDC | Suite Team All paid plans | No |
Zoom Collaboration Zoom's pricing page lists Single sign-on via SAML 2.0 on Business and Enterprise only, and the SCIM2 API needs a Business or Education account with an approved vanity URL and SSO enabled. Zoom's help center renders client-side and could not be read, so 2FA methods (passkeys, security keys) and method enforcement are unconfirmed. Vendor source | ? | ? | ? | SAML | Business Higher paid tier | Yes |
How to read it
"Yes" means the vendor documents the capability for the app's own login. "Via SSO" means the app relies on your identity provider, so phishing resistance depends on how you configure the IdP. "?" means the vendor does not document it. Download the full data as CSV or JSON.
Related
- What phishing-resistant MFA means
- Passkey rollout checklist
- Identity Breach Database: what happens when MFA is missing or bypassed
- Phishing-resistant MFA vendors
About the matrix
- Which SaaS apps support passkeys for employee login?
- Of the 95 business apps in this matrix, 51 (54%) let users sign in to the app's own login with a passkey or a FIDO2 security key, per vendor documentation checked 2026-10-31. Filter the table above for the current list.
- Can admins require phishing-resistant MFA in SaaS apps?
- Only 12 of 95 apps (13%) document an admin setting that requires passkeys or security keys for every user of the app's own login. Most apps that support the factor leave it optional, so the practical way to enforce phishing-resistant MFA is to put the app behind SSO and enforce it at the identity provider.
- What is the SSO tax?
- The SSO tax is the practice of offering single sign-on only on a higher-priced or enterprise plan. Of the 82 apps here that offer SSO and document which plan includes it, 49 (60%) put it on a higher paid tier, an enterprise plan, or a paid add-on.
- How is this matrix sourced and can I reuse it?
- Every cell comes from the vendor's own documentation or pricing page, linked per app, and "Not documented" means the vendor does not say. The data is CC BY 4.0: download the CSV or JSON, cite the page, and link back. Send corrections through the contact page.