1.B2B feature: enforced SSO for enterprise workspaces
When it fits: Use this when sales has a list of blocked deals, enterprise buyers are asking for one specific capability, and engineering suspects the scope will grow the moment the PRD is shared.
PRD: Enforced SAML SSO for workspace admins
Owner: Renata Silva Team: Joon Park (design), Theo Marsh (eng lead), Alicia Grant (sales engineering) Status: Approved 2026-10-20 Target release: January 2027 Links: [[Enterprise readiness]], SSO epic PLAT-412
Summary
Workspace admins on the Business plan can require SAML sign-in for every member and block password logins. Without this, security reviews at companies above 500 employees fail on the first questionnaire.
Problem
- Who has it: Business-plan prospects with a security review, 14 deals in Q2 and Q3
- Evidence: those 14 deals total $410,000 in annual contract value; 9 named "SSO enforcement" as a blocker in writing
- Why now: two of the 14 renew their evaluation in February
Goals and success metrics
| Goal | Metric | Today | Target | Check on |
|---|---|---|---|---|
| Unblock security reviews | Deals lost to "no SSO enforcement" | 9 in two quarters | 0 in Q1 | 2027-04-01 |
| Adoption | Business workspaces with SSO enforced | 0 | 25 | 2027-03-31 |
Non-goals
- SCIM user provisioning. Asked for by 3 of 14 prospects; separate PRD in Q2.
- OIDC. No prospect has asked for it.
Requirements
| # | Requirement | Priority | Acceptance criteria |
|---|---|---|---|
| R1 | Admin uploads IdP metadata and tests it before enforcing | Must | A failed test shows the IdP's error text and does not enforce |
| R2 | Enforcement blocks password and email-link sign-in for members | Must | A member with a password gets "Sign in with your company account" |
| R3 | Break-glass: workspace owner keeps password access | Must | Owner can sign in if the IdP is down |
| R4 | Audit log entry when enforcement changes | Should | Entry shows who, when, old and new value |
Non-functional: SAML assertions validated server-side only; sign-in adds under 500 ms at p95.
Assumptions, risks and dependencies
- Assumption: Okta and Entra ID cover most prospects (12 of 14). We will know we were wrong if a pilot customer uses another IdP.
- Risk: admins lock themselves out. Mitigation: R3 and a mandatory test step.
Open questions
- Do guests have to use SSO too? Answered 2026-10-17: no, guests are exempt and labeled in the member list (Alicia, from 6 prospect calls).
- Is the audit log in scope for January or February? (owner: Theo) @due(2026-11-06)
Decision log
- 2026-10-20: SCIM moved out of scope because it doubles the estimate and only 3 deals need it. Decided by Renata with sales sign-off.