{"id":"enterprise-sso","slug":"enterprise-sso","name":"Enterprise SSO / SCIM","shortName":"Enterprise SSO / SCIM","problemStatement":"Close enterprise deals that require Okta/Azure AD SSO and directory sync.","whenNotTopPick":"Consumer-only app — Clerk without enterprise SSO yet.","categoryIds":["cat-auth-payments"],"depotPickProviderId":"workos","depotPickRationale":"capability SSO/SCIM + dx + privacy.","runnersUpIds":["auth0","clerk","stytch"],"weights":{"capabilityFit":0.2,"pricePerformance":0.12,"latencyReliability":0.12,"developerDx":0.12,"privacyPosture":0.25,"lockInRisk":0.09,"maturity":0.1},"methodologyNotes":"capability SSO/SCIM + dx + privacy.","tags":["enterprise"],"depth":{"whenNotToUse":{"text":"Consumer-only app — Clerk without enterprise SSO yet.","source":"editorial `whenNotTopPick` (data/jtbds.json)"},"whenNotToUseReason":null,"runnerUp":{"providerId":"auth0","name":"Auth0 (Okta)","overallForJob":7.93,"pickOverallForJob":8.49,"beatsPickOn":["latencyReliability","maturity"],"source":"first resolvable entry of the job's editorially ranked `runnersUpIds`; scores are stored job-weighted scores"},"runnerUpReason":null,"lockIn":{"pickLockInRisk":4.5,"runnerUpLockInRisk":7,"scale":"0–10 stored curated estimate; higher = more lock-in (worse)","pickExitSignals":[],"runnerUpExitSignals":[],"pickNotes":[],"selfHostFallback":[],"migration":"The pick has lower stored lock-in risk than runner-up Auth0 (Okta) (4.5 vs 7).","migrationReason":null,"derivedFrom":"stored lockInRisk scores, provider tags (oss, self-host, openai-compat, open-models), free rows that list this job, and verbatim provider notes. No migration guide was invented."}},"freshness":{"pick":{"score":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"lastReviewed":{"asOf":"2026-09-14","ageDays":43,"stale":true,"staleAfterDays":30,"reason":null},"sourceCheck":{"checkedAt":"2026-10-27","sourceUrls":1,"sourcesReachable":1,"pricingRows":0,"pricingRowsReconfirmed":0,"note":"A source re-check confirms the page is reachable and, for pricing rows, that the stored amount and SKU name appear on it. It does not re-derive or change the score.","reason":null}}},"depotPick":{"id":"workos","slug":"workos","name":"WorkOS","tagline":"When your first big customer asks for Okta SSO tomorrow, WorkOS is how you say yes without a rewrite.","overall":8.49},"runnersUp":[{"id":"auth0","slug":"auth0","name":"Auth0 (Okta)","tagline":"Enterprise identity Swiss Army knife. For startups, Clerk/WorkOS usually hurt less.","overall":7.93},{"id":"clerk","slug":"clerk","name":"Clerk","tagline":"Depot default auth for agent products with users. WorkOS when enterprise SSO is the main job.","overall":8.23},{"id":"stytch","slug":"stytch","name":"Stytch","tagline":"Auth pick when agents/M2M + org SSO matter more than Clerk's consumer UI kit. Watch Twilio integration…","overall":8.21}]}