Table of Contents
- The Mid-Market Identity Crisis
- Why SSO and SCIM Matter Now
- D23.io’s Out-of-the-Box Advantage
- Self-Hosting Superset: The Hidden Costs
- Competing BI Tools and Their Identity Gaps
- Security Audit Readiness and Compliance
- Real-World Implementation: Speed and Cost
- The Operational Lift: What You Actually Save
- Vendor Consolidation and Platform Strategy
- Making the Business Case
- Next Steps: From Evaluation to Production
The Mid-Market Identity Crisis
You’re running a mid-market company—probably 200 to 2,000 employees—and your identity infrastructure is a mess. Your finance team uses Okta. Your engineering team syncs users through Azure AD. Your analytics team has a Superset instance that nobody can actually log into without a manual password reset because SSO was “too complicated to set up.” Your security team is losing sleep because you have 15 different identity silos and nobody can tell them how many active users actually have access to what.
This is not a technology problem. This is a business problem.
Every day your identity infrastructure stays fragmented, you’re burning money on manual user provisioning, you’re creating audit risk, and you’re slowing down the teams that need to move fast. When you hire someone new, onboarding takes three days instead of 30 minutes because their identity doesn’t cascade across your tools. When someone leaves, you can’t be sure you’ve revoked their access everywhere. And when your auditor asks for a user access report, your security team spends a week stitching together data from five different systems.
Mid-market companies face a specific bind: you’re too large to ignore identity governance, but you’re too lean to build and maintain a bespoke identity layer across every tool you use. You need a vendor who has already solved this problem at scale.
That’s where D23.io managed Superset changes the conversation.
Why SSO and SCIM Matter Now
Before we talk about D23.io specifically, let’s establish why SSO and SCIM have gone from “nice to have” to “table stakes” for any business software you’re evaluating.
Single Sign-On (SSO) Is No Longer Optional
SSO does one thing: it lets your users log into your tools using the same identity they already have in your identity provider—Okta, Azure AD, Google Workspace, whatever. No separate passwords. No password resets. No forgotten credentials.
For your end users, that’s a convenience. For your business, it’s a control point.
When SSO is properly implemented, you control access to every tool from a single source of truth. You can enforce multi-factor authentication across your entire stack. You can revoke access instantly—when someone leaves, they’re locked out of everything the moment you deactivate them in your IdP. You can audit who logged in, when, and from where.
Without SSO, you’re managing access through 15 different password managers, 15 different audit logs, and 15 different revocation processes. It’s not just inconvenient. It’s a compliance nightmare.
SCIM: The Automation Layer That Pays for Itself
SCIM—System for Cross-domain Identity Management—is the protocol that automates user provisioning and deprovisioning across your tools. It’s defined in RFC 7643: SCIM Core Schema, the official IETF standard that every major identity provider now supports.
Here’s what SCIM does: when you create a user in Okta, SCIM automatically creates that user in every connected application—your BI tool, your data warehouse, your collaboration platform, everything. When you deactivate them in Okta, SCIM automatically deactivates them everywhere. When you change their email address or group membership, SCIM syncs that change across your entire stack.
Without SCIM, your IT team is manually creating and deleting users in each tool. That’s not just slow—it’s error-prone. Users get created in some systems but not others. Access doesn’t get revoked cleanly. You end up with orphaned accounts and inconsistent group memberships.
With SCIM, that entire process is automated. SCIM Cloud provides a clear overview of how the standard eliminates manual identity management overhead. For a mid-market company with 500 employees and 20 SaaS tools, SCIM can save your IT team 10–15 hours per week.
That’s not just convenience. That’s $30,000–$50,000 per year in labour cost you’re not spending on manual user management.
D23.io’s Out-of-the-Box Advantage
D23.io is a managed Superset platform built specifically for mid-market and enterprise teams. Unlike self-hosted Superset or competing BI tools, D23.io ships with SSO and SCIM already configured and tested.
Let’s be specific about what that means.
SSO: Already Wired, Ready to Connect
When you sign up for D23.io, you don’t need to hire a consultant or spend weeks configuring SAML. D23.io supports SSO integration with all major identity providers:
- Okta: Okta Developer: SCIM Provisioning Guides covers the technical spec, but D23.io has already built the integration. You paste your Okta metadata URL, and you’re done.
- Azure AD: Microsoft Learn: Tutorial - Configure custom automatic user provisioning with SCIM describes the standard approach, but D23.io has pre-built connectors that work out of the box.
- Google Workspace: SAML federation is configured by default.
- AWS IAM Identity Center: AWS IAM Identity Center User Guide: Automatic provisioning with SCIM outlines the capability, and D23.io supports it natively.
When we say “out of the box,” we mean: you don’t need a developer to wire it up. Your IT team can configure it in an afternoon. No custom code. No integration layer. No consulting bill.
SCIM: Automated User Lifecycle from Day One
D23.io’s SCIM implementation follows the OpenID Foundation: SCIM Provisioning Resources standard, which means it works with any identity provider that supports SCIM.
Here’s what happens when you enable SCIM in D23.io:
- User Creation: When you add a user to your Okta organization, SCIM automatically creates that user in D23.io with the correct permissions and group membership.
- Attribute Sync: When you update a user’s email, name, or department in your IdP, those changes sync to D23.io automatically.
- Group Management: If you manage analytics access by department (Finance, Sales, Engineering), those group memberships stay in sync across your IdP and D23.io.
- Deprovisioning: When you deactivate a user in your IdP, SCIM immediately deactivates their access to D23.io. No orphaned accounts. No manual cleanup.
This is not a feature add-on. It’s built into the platform.
Compare this to self-hosted Superset, where SCIM support requires custom development. Or competing BI tools like Tableau or Looker, where SCIM integration is either not available or requires a third-party provisioning tool like Okta’s Universal Directory or Azure AD’s provisioning service.
Role-Based Access Control (RBAC) That Actually Works
D23.io’s SCIM implementation includes full support for role and group mapping. When you create a group in your IdP—“Analytics Admins,” “Finance Analysts,” “Sales Dashboards”—D23.io automatically maps those groups to the correct permissions within the platform.
This means:
- Finance users see only finance dashboards.
- Sales users see only sales dashboards.
- Admins have full access.
- Permissions are enforced at the data source level, not just the dashboard level.
You don’t need to manually assign roles in D23.io. You don’t need a separate access request process. You don’t need your analytics team to manage permissions separately from your IT team. Your IdP is the single source of truth for who has access to what.
Self-Hosting Superset: The Hidden Costs
Superset is open source and free. That’s the headline. But the cost of self-hosting Superset is not in the software licence—it’s in everything else.
Infrastructure and DevOps
When you self-host Superset, you’re responsible for:
- Compute: Running Superset on Kubernetes, EC2, or your own servers. That’s not free.
- Database: Superset needs a metadata database (PostgreSQL, MySQL). You’re running that too.
- Monitoring and Logging: You need observability. Application Performance Monitoring (APM), error tracking, audit logging—all of it falls on your team.
- Backups and Disaster Recovery: If your Superset instance goes down, your entire analytics layer is offline. You need redundancy, failover, and tested recovery procedures.
- Security Patching: When a vulnerability is discovered in Superset or its dependencies, you need to patch it immediately. That’s your responsibility.
For a mid-market company, that’s typically 1–2 full-time engineers, plus on-call support. At $150,000–$200,000 per year in salary, plus infrastructure costs of $30,000–$50,000 per year, you’re looking at $200,000+ per year just to keep the lights on.
Identity Integration: The Real Hidden Cost
Now add SSO and SCIM to self-hosted Superset.
Superset does have SAML support built in, but it’s basic. To get SCIM working, you need to:
- Understand the SCIM spec: RFC 7643: SCIM Core Schema is the standard, but implementing it requires deep knowledge of identity protocols.
- Build custom SCIM endpoints: Superset doesn’t ship with SCIM. You need to build a custom integration layer that listens to SCIM requests from your IdP and translates them into Superset API calls.
- Test and maintain: SCIM is stateful. If a sync fails halfway through, you need to handle retries, idempotency, and error recovery. You need to test this with your specific IdP (Okta, Azure AD, etc.).
- Debug in production: When SCIM sync fails—and it will fail sometimes—your IT team needs to troubleshoot it. That means understanding both Superset’s API and your IdP’s provisioning logs.
A consultant can do this in 4–6 weeks. Cost: $40,000–$80,000. But you’re not done. You need to maintain it. When Superset updates, you need to test your custom SCIM layer. When your IdP changes, you need to adapt your integration.
You’re looking at another $20,000–$30,000 per year in maintenance and support.
Total cost of self-hosting Superset with SSO and SCIM: $250,000–$300,000 per year, plus the operational burden of managing identity sync failures.
Competing BI Tools and Their Identity Gaps
Let’s look at how other BI platforms handle SSO and SCIM.
Tableau
Tableau has SSO support, but SCIM is only available in Tableau Cloud (their SaaS offering), and even then, it’s limited. If you’re self-hosting Tableau Server, you’re managing users manually or through Active Directory integration, which only works in Windows environments.
For mid-market companies that use Okta, Google Workspace, or other cloud-native IdPs, Tableau’s identity story is weak.
Looker (Google Cloud)
Looker supports SSO via SAML and OAuth, but SCIM support is new and still being rolled out. If you need SCIM today, Looker requires you to use a third-party provisioning tool like Okta’s Universal Directory, which adds cost and complexity.
Plus, Looker is deeply integrated with Google Cloud. If you’re not a Google Cloud shop, you’re swimming upstream.
Power BI
Microsoft Power BI has deep integration with Azure AD, but if you’re using Okta or another IdP, the experience is clunky. SCIM is not supported. You’re back to manual user management or relying on Azure AD as your central IdP, which adds another layer of synchronisation.
Metabase
Metabase is open source and free, like Superset. It has basic SAML support, but no SCIM. If you want to automate user provisioning, you’re building custom integrations, just like with self-hosted Superset.
Sigma
Sigma has good SSO support and is adding SCIM capabilities. Sigma Documentation: Manage users and teams with SCIM shows their SCIM implementation is solid. However, Sigma’s pricing is per-user, per-month, which makes it expensive for large user bases. A mid-market company with 500 analysts paying $50–$100 per user per month is looking at $300,000–$600,000 per year in Sigma licenses alone.
D23.io managed Superset has a different pricing model: you pay for compute and storage, not per user. That means your identity costs don’t scale with headcount.
Security Audit Readiness and Compliance
Here’s where D23.io’s built-in identity infrastructure becomes a compliance asset, not just a convenience feature.
When you’re preparing for a SOC 2 or ISO 27001 audit, your auditor will ask:
- How do you control access to sensitive systems? Answer: SSO with multi-factor authentication.
- How do you provision and deprovision users? Answer: SCIM, fully automated.
- How do you audit access changes? Answer: SCIM provides a complete audit trail of every user creation, modification, and deletion.
- How do you ensure access is revoked when employees leave? Answer: SCIM deprovisioning is automatic and instantaneous.
With D23.io, you can answer all of these questions on day one. Your auditor sees a modern, automated identity infrastructure. You’re not explaining custom SCIM integrations or manual user management processes.
With self-hosted Superset or competing BI tools without built-in SCIM, you’re either:
- Explaining that you don’t have automated provisioning (audit risk)
- Explaining a custom integration that you built and maintain (audit complexity)
- Explaining a third-party provisioning tool you added (audit surface area)
When you work with PADISO on Security Audit | PADISO - SOC 2, ISO 27001 & GDPR Compliance, one of the first things we evaluate is your identity infrastructure. D23.io’s out-of-the-box SCIM support is a massive advantage because it’s a standard, well-understood control that auditors expect to see.
You’re not explaining bespoke architecture. You’re pointing to a standard implementation.
Real-World Implementation: Speed and Cost
Let’s walk through a real scenario: a mid-market financial services company with 300 employees, currently using self-hosted Superset with manual user management.
Current State: Self-Hosted Superset
- Infrastructure: 1 DevOps engineer managing Superset on Kubernetes. Cost: $150,000/year.
- User Management: IT team manually creates and deletes users. ~5 hours per week. Cost: $25,000/year.
- Identity Integration: No SSO. Users have separate passwords for Superset. Password reset requests: ~2 per week. Cost: $5,000/year.
- Compliance: During audit prep, they need to document their access control procedures. Because there’s no SCIM, they need to create custom documentation explaining their manual processes. Consulting: $10,000.
- Total annual cost: $190,000 + infrastructure.
Transition to D23.io
Week 1–2: Migration and Setup
- Export dashboards and data sources from self-hosted Superset.
- Import into D23.io.
- Configure SSO with Okta: 2 hours of IT time.
- Enable SCIM in Okta and D23.io: 1 hour of IT time.
- Test with a pilot group of 10 users: 4 hours of IT time.
- Total effort: ~7 hours of IT time. Cost: $500.
Week 3: Full Rollout
- Communicate SSO launch to all users.
- Disable legacy Superset instance.
- Monitor SCIM sync for 48 hours.
- Total effort: ~3 hours of IT time. Cost: $200.
New State: D23.io with SSO and SCIM
- Infrastructure: D23.io is fully managed. No DevOps overhead. Cost: $0.
- User Management: Fully automated via SCIM. IT team no longer creates or deletes users manually. Cost: $0.
- Identity Integration: SSO is built in. No password resets. Cost: $0.
- Compliance: SCIM audit trail is native. No custom documentation needed. Consulting: $0.
- D23.io subscription: Depends on compute and storage, but typically $30,000–$50,000/year for a mid-market company.
- Total annual cost: $30,000–$50,000.
Annual savings: $140,000–$160,000.
Payback period: 2–3 months.
This is not hypothetical. This is what we see across mid-market companies that make this transition.
The Operational Lift: What You Actually Save
Let’s break down the operational savings more granularly, because this is where the real value lives.
User Onboarding
Before (Self-Hosted Superset):
- New hire joins company.
- IT creates user in Okta.
- IT manually creates user in Superset.
- IT sets temporary password and sends it to new hire.
- New hire logs in, changes password.
- New hire waits for IT to assign them to the correct Superset groups.
- Total time: 2–4 hours spread across IT and new hire.
After (D23.io with SCIM):
- New hire joins company.
- IT creates user in Okta.
- SCIM automatically creates user in D23.io with correct group memberships.
- New hire logs in using SSO (Okta credentials they already have).
- Total time: 15 minutes of IT time. Zero time for new hire.
Savings per onboarding: 2–3 hours per new hire. For a company with 50 new hires per year, that’s 100–150 hours per year. At $50/hour fully loaded, that’s $5,000–$7,500 per year.
User Offboarding
Before (Self-Hosted Superset):
- Employee is terminated.
- IT deactivates user in Okta.
- IT manually deactivates user in Superset.
- IT needs to verify deactivation was successful.
- Total time: 30 minutes per offboarding. For 50 offboardings per year, that’s 25 hours per year.
After (D23.io with SCIM):
- Employee is terminated.
- IT deactivates user in Okta.
- SCIM automatically deactivates user in D23.io within seconds.
- Total time: 2 minutes per offboarding. For 50 offboardings per year, that’s 1.5 hours per year.
Savings per year: 23.5 hours per year. Plus, you’ve eliminated the risk of orphaned accounts. That’s worth another $2,000–$3,000 per year in audit and remediation costs avoided.
Password Reset Requests
Before (Self-Hosted Superset):
- Users forget their Superset password: ~2 per week.
- IT resets password: 5 minutes per request.
- User changes password: 2 minutes.
- Total time: 7 minutes per request × 2 per week × 52 weeks = 730 minutes per year = 12 hours per year.
- Cost: $600/year.
After (D23.io with SCIM):
- Users log in with SSO (Okta). No Superset password.
- Password reset requests: 0 per year.
- Savings: $600/year.
Access Request and Approval
Before (Self-Hosted Superset):
- User needs access to a new dashboard.
- User emails IT.
- IT asks manager for approval.
- IT manually adds user to Superset group.
- IT confirms completion.
- Total time: 20 minutes per request. For a company with 300 users and 2 access requests per user per year, that’s 600 requests per year = 200 hours per year.
- Cost: $10,000/year.
After (D23.io with SCIM):
- User needs access to a new dashboard.
- Manager adds user to the appropriate group in Okta.
- SCIM automatically syncs that group membership to D23.io.
- User has access immediately.
- Total time: 2 minutes for manager to add to group. For 600 requests per year, that’s 20 hours per year.
- Savings: 180 hours per year = $9,000/year.
Total Operational Savings
- Onboarding: $5,000–$7,500/year
- Offboarding and risk mitigation: $2,000–$3,000/year
- Password reset requests: $600/year
- Access request management: $9,000/year
- Total operational savings: $16,600–$20,100/year
Add this to the infrastructure savings ($140,000–$160,000/year), and you’re looking at $160,000–$180,000 per year in total savings.
Vendor Consolidation and Platform Strategy
There’s a strategic dimension to choosing D23.io that goes beyond SSO and SCIM, but it’s worth mentioning because it affects your long-term technology roadmap.
When you choose a managed platform like D23.io, you’re not just choosing a BI tool. You’re choosing a vendor that has already solved the identity problem. That means:
- You can consolidate vendors: Instead of Superset + a third-party provisioning tool + custom SCIM integration, you have one platform that does all of it.
- Your security team has fewer integration points to audit: Every integration is a potential vulnerability. D23.io’s built-in SCIM means one fewer integration.
- You have a clearer upgrade path: When SCIM standards evolve, D23.io updates the platform. You don’t need to maintain custom code.
- You can focus on analytics, not infrastructure: Your analytics team can focus on building dashboards and insights. Your IT team can focus on identity governance, not Superset maintenance.
This is why PADISO recommends D23.io to clients pursuing Platform Development in Sydney | PADISO or Platform Development in Melbourne | PADISO projects. When you’re modernising your analytics stack, you want a vendor that has already solved the hard infrastructure problems.
If you’re working with a Fractional CTO & CTO Advisory in Sydney | PADISO or Fractional CTO & CTO Advisory in Melbourne | PADISO, they’ll tell you the same thing: choose platforms that have built-in identity integration. It saves engineering time, reduces audit risk, and scales with your business.
Making the Business Case
If you’re presenting D23.io to your CFO, your CTO, or your board, here’s the business case in numbers.
Cost Comparison: Self-Hosted Superset vs. D23.io
| Cost Category | Self-Hosted Superset | D23.io | Savings |
|---|---|---|---|
| Infrastructure (compute, database, monitoring) | $50,000/year | Included | $50,000 |
| DevOps/SRE labour (1 FTE) | $150,000/year | $0 | $150,000 |
| User management labour (0.25 FTE) | $25,000/year | $0 | $25,000 |
| Custom SCIM integration (consulting + maintenance) | $50,000/year | Included | $50,000 |
| Operational overhead (onboarding, offboarding, access requests) | $20,000/year | $5,000/year | $15,000 |
| D23.io subscription | $0 | $40,000/year | -$40,000 |
| Total Annual Cost | $295,000 | $45,000 | $250,000 |
This is a 5-year net present value (NPV) calculation:
- Self-hosted Superset over 5 years: $295,000 × 5 = $1,475,000
- D23.io over 5 years: $45,000 × 5 = $225,000
- Net savings: $1,250,000
That’s the business case. It’s not close.
Risk Reduction
Beyond cost, there’s risk:
- Audit risk: Self-hosted Superset with manual user management is a compliance liability. D23.io with SCIM is audit-ready.
- Security risk: Every custom integration is a potential vulnerability. D23.io’s built-in SCIM is battle-tested and regularly updated.
- Operational risk: When your Superset instance goes down, your entire analytics layer is offline. D23.io is fully managed with SLA-backed uptime.
- Talent risk: Maintaining Superset requires specific expertise. That expertise is hard to hire and hard to retain. D23.io outsources that problem.
When you present this to your board, frame it as: “We can either invest $1.5M over 5 years maintaining our own BI infrastructure, or we can pay $225K for a managed platform and redeploy that engineering capacity to building our core product.”
That’s a strategic decision, not a tactical one.
Next Steps: From Evaluation to Production
If you’re seriously considering D23.io, here’s how to move forward.
1. Evaluate Your Current State
Before you migrate, understand what you’re migrating from:
- How many dashboards and data sources do you have? D23.io can import most Superset objects, but some custom code may need to be rewritten.
- What identity provider are you using? Okta, Azure AD, Google Workspace? D23.io supports all of them, but the setup process is slightly different for each.
- What’s your current user count and growth trajectory? This affects D23.io’s pricing and capacity planning.
- What compliance requirements do you have? If you’re pursuing SOC 2 or ISO 27001, D23.io’s built-in audit logging is a huge advantage.
2. Pilot with a Small Group
Don’t migrate everyone at once. Start with a pilot group of 10–20 power users:
- Set up SSO integration with your IdP.
- Enable SCIM provisioning.
- Import 5–10 critical dashboards.
- Run the pilot for 2–4 weeks.
- Collect feedback from users and IT.
- Iterate based on feedback.
This approach de-risks the migration and gives you a chance to catch issues before you roll out to the entire company.
3. Plan Your Full Rollout
Once the pilot is successful, plan your full migration:
- Week 1: Import all dashboards and data sources.
- Week 2: Configure SCIM for all users.
- Week 3: Soft launch—run D23.io and self-hosted Superset in parallel.
- Week 4: Hard cutover—decommission self-hosted Superset.
- Weeks 5–8: Monitor and optimise.
Total migration time: 4–8 weeks. Most companies can do this with zero downtime.
4. Optimise Your Identity Strategy
Once you’re on D23.io, you have an opportunity to optimise your broader identity strategy:
- Consolidate identity providers: If you’re using multiple IdPs (Okta for some teams, Azure AD for others), now’s the time to consolidate.
- Implement group-based access control: Use your IdP to manage access to D23.io dashboards. This scales with your organization.
- Automate access requests: Build a workflow in your IdP that allows users to request access to groups, with automatic approval based on manager hierarchy.
- Set up audit logging: Ensure D23.io’s audit logs are being exported to your SIEM or audit log aggregator.
When you work with PADISO on Services | PADISO - CTO as a Service, Custom Software, AI & Automation, we help you think through these identity strategy decisions. It’s not just about the BI tool—it’s about building an identity infrastructure that scales with your business.
5. Prepare for Compliance
If you’re planning a SOC 2 or ISO 27001 audit, D23.io’s built-in identity controls are a major advantage. Work with your security team to document:
- How SSO is configured.
- How SCIM provisioning works.
- How access is audited.
- How access is revoked when employees leave.
When you work with PADISO on Security Audit | PADISO - SOC 2, ISO 27001 & GDPR Compliance, we’ll help you build an audit-ready identity infrastructure. D23.io is already halfway there.
6. Measure and Communicate Results
Once you’re live on D23.io, measure the impact:
- Time to onboard new users: Should drop from 2–4 hours to 15 minutes.
- Time to offboard users: Should drop from 30 minutes to 2 minutes.
- Password reset requests: Should drop to zero.
- IT team time spent on user management: Should drop by 80%+.
- Audit readiness: Should improve significantly.
Communicate these results to your leadership team. This isn’t just a tactical infrastructure change—it’s a strategic shift that frees up engineering capacity and reduces risk.
Conclusion: Why Mid-Market Buyers Choose D23.io
D23.io is not the cheapest BI tool. It’s not the most feature-rich. But for mid-market companies that value operational efficiency, security, and compliance readiness, it’s the most rational choice.
Here’s why:
-
SSO and SCIM are built in, not bolted on. You don’t need to hire consultants or build custom integrations. You get modern identity management out of the box.
-
You save $150,000–$200,000 per year on infrastructure and labour. That’s not marketing speak—that’s real money that you can redeploy to building your core product.
-
You reduce audit and security risk. SCIM provisioning is a standard control that auditors expect to see. You’re not explaining custom integrations or manual processes.
-
You eliminate the operational overhead of user management. Onboarding, offboarding, and access requests become automatic. Your IT team can focus on strategy, not firefighting.
-
You get a partner who has already solved the hard infrastructure problems. You’re not maintaining Superset. You’re using a managed platform that evolves with your business.
When you’re evaluating BI tools, the question isn’t “Does this tool have SSO and SCIM?” The question is “Does this vendor have SSO and SCIM built in, tested, and ready to go?”
D23.io is the answer.
If you’re a mid-market company that’s tired of managing Superset infrastructure or paying per-user licensing for competing BI tools, it’s time to have a conversation with D23.io. And if you need help thinking through your broader platform strategy—how BI fits into your data architecture, how identity scales with your business, or how to prepare for a security audit—PADISO can help. We work with mid-market and enterprise teams across Fractional CTO & CTO Advisory in New York | PADISO, Platform Development in New York | PADISO, Fractional CTO & CTO Advisory in San Francisco | PADISO, Platform Development in San Francisco | PADISO, and Fractional CTO & CTO Advisory in Miami | PADISO to build modern, audit-ready, identity-first platforms. Whether you’re based in Sydney, Melbourne, New York, or San Francisco, we can help you evaluate tools like D23.io and build a platform strategy that scales.
The best time to implement SSO and SCIM is before you need them for an audit. The second best time is today.