Ask HN: Is there still a reason to use Okta for SSO? Okta vs. Google SSO

Is there even a reason to use Okta SSO?

Every company actively decides at some point in time how employees shall login to SaaS vendors. The typical answer for early stage companies is Google SSO, whereas later stage companies tend to switch to Okta SSO.

In the early SSO days Okta was the best option to get MFA and granular controls. However, nowadays Google is offering 2FA as well. It’s also often the default option with many SaaS vendors and therefore neither requires manually setting up SSO nor requires an enterprise-subscription (see [sso.tax](http://sso.tax) for reference).

Therefore, why do you believe people should still use Okta?

- Is the biggest reason to use Okta their SCIM-Provisioning, RBAC etc.?

- Are there any limitations in Google Workspace that only Okta solves?

- Or for the Google folks out there: What’s the reason you are sticking with Google SSO?

I don't see why anyone would ever use Google anything for a business critical use. They seem allergic to providing customer support for anything other than advertising.

To be fair, they do provide support including live chat if you have Google Workspace (previous called GSuite) subscription. There is no support if you are on free gmail.

My company has been an Okta customer for several years and I'm responsible for administering it. However I don't have experience with other SSO products, so would be interested to hear what the experience is like on the other side.

The key thing for me is SCIM provisioning support, but not just that. There are quite a few apps that don't support SCIM, but Okta has built integrations for them anyway using API keys, etc. I understand you can build your own via Okta workflows also but I haven't done this.

We have oversight of all accounts linked to a given user, even if SSO is not supported by the service. Deprovisioning a user creates a task list of what should be manually eliminated also, which is great for our admin staff.

It interacts with Intune via SCEP so we can know that logins are coming from a trusted corporate device. This is mandated by some of our larger clients.

The final thing I like is that a large part of Okta's business is their IDP software (vs their Auth0 competitor they don't use). I do like specialist businesses for something like this. The software is less likely to end up in maintenance mode if it's not one product line out of hundreds.

Well, yes, but lack of support is the best-case scenario; the worst case is their tendency to abandon products entirely and on short warning.