The first enterprise deal does not stall on your product. It stalls on a spreadsheet sent by somebody in security who has never used it, and it stalls for weeks.
Here is what that spreadsheet asks for, in roughly the order it comes up.
Single sign-on
Not optional, and not a paid add-on argument worth having. If people cannot sign in with their work identity, the account cannot be offboarded when somebody leaves, and offboarding is the thing security actually cares about.
Support OIDC first, since that covers Okta, Entra ID, Google Workspace and Auth0. Add SAML for the providers that still only speak it. Attach a verified email domain to the connection so a user can type their work address and be routed to the right provider without picking anything from a list.
Enforcement, per workspace
SSO existing is not the same as SSO being required. A workspace owner needs to be able to say: everyone here signs in through our provider, or with two-factor, and sessions expire after eight hours, and only from these IP ranges.
Two things to get right:
- Never let an owner lock themselves out. Check the policy against the person enabling it before it takes effect, and refuse with a clear reason.
- Watch the session cache. Ours checked policies against a cached session, which meant a maximum session age of eight hours was enforced against a value that could be five minutes stale. The check now reads the session row directly. A policy that is almost enforced is worse than none, because you will tell an auditor it works.
An audit trail they can take away
Every security review asks who did what. Every one of them then asks how the answer leaves your system.
Two exits cover it. A CSV export, for the person who wants to read it in a spreadsheet during the review. And a streaming push to their own collector, so the trail lands in their SIEM alongside everything else and stops being your problem. Ours streams newline-delimited JSON with a resumable cursor, so a collector that goes down for an hour catches up rather than losing the window.
One practical note: the obvious rule of "collectors must be HTTPS" blocks the private, in-network collectors that large companies actually run. Allow loopback, private ranges and internal domains explicitly.
Provisioning
SCIM is how a company with two thousand employees avoids inviting people by hand. The part teams skip is group mapping: their identity provider already knows who the engineers are, and that should decide the role here rather than someone re-entering it.
Data handling
Export and deletion, on a schedule, initiated by the customer. This one is a legal requirement in most of the markets you want to sell in, so it is not really a feature decision.
None of this differentiates your product. All of it is the price of entry, and every item is dramatically cheaper to build in a quiet week than during a deal with a procurement deadline attached.
Marcus Reyes
3 min read