ManagementTenants

SSO Management

In a B2B setup, each tenant can use its own Identity Provider (IdP). Those connections are tenant SSO configurations.

With Descope you configure SAML or OIDC per tenant, map attributes and groups, and keep authentication consistent across your customers' apps.

Sub-tenants can inherit SSO from a parent tenant or use their own config.

How to Manage Tenant SSO

For any IdP (Okta, Entra, Google Workspace, or generic SAML/OIDC), generate a SSO Setup Suite link and either send it to the customer's IT admin or open it yourself. Templates, attribute/group mapping, connection test, and SCIM live there — you shouldn't need separate per-IdP written guides.

Descope Console

View and edit a tenant's SSO under Tenants → Authentication Methods → SSO.

Management SDKs and API

Automate tenant SSO (including maps) with the Management SSO SDKs or the Management tenants SSO API.

Infrastructure as Code

Terraform covers project-level SSO auth settings, SSO Setup Suite options, invite emails, and the hosted Admin Portal. Per-tenant SSO connections and SCIM are dynamic — configure them via Setup Suite, Console, or Management SDK/API, not as long-lived Terraform resources.

Was this helpful?

Tenant Select Component

Previous Page

With SDKs

Learn how to easily implement SSO management and authorization for your app via backend SDKs with Descope.

On this page

SSO ManagementHow to Manage Tenant SSOSSO Setup Suite (Recommended)Descope ConsoleManagement SDKs and APIInfrastructure as CodeRelated