6 ms·

As a former IT admin who administered Okta it’s pretty feature rich and I thought the UX was pretty good compared to Microsoft

prepend 3y ago
I use Okta and Microsoft’s Intune/MFA/SSO and I’m not sure which is better. Neither is that great I think. The think that’s annoying to me is the price is $2-11/user/month for sso. That’s crazy considering orgs have thousands of employees that need this and previous self-hosted solutions from CA and others were $50-100k for unlimited accounts. And this seems like an odd place per user and it costs similar amounts to support 1000 users as 5000.
- samcat116 3y ago
  Welcome to the enterprise sass industry. (Also accounts with user counts that high aren’t paying MSRP you see)
- basch 3y ago
  What's more annoying is that every sass product on the planet puts sso behind their most expensive "ask us the price" tier. Microsoft should be including sso in their baseline/free products and all enterprise and wanna-be-enterprise software should put it in its base tier. Logon security shouldn't be tucked behind a paywall or held hostage as a bonus quadruple the price feature, because breaches have wide reaching consequences past just the company attacked going down.
  - TheNewsIsHere 3y ago
    I fully agree with you about the SSO tax. I would like to add that configuring Azure AD as an SSO provider is available to any tenant free. Some of the functionality like Conditional Access does require paid licensing. I’m aware of a number of businesses that are very happily using Keycloak in production. Not everyone can, although there is RH SSO if you need the support contract. Then there’s Gluu, Authelia, and many others depending on your needs. Sadly even with basic security we can’t seem to fully trust our own vendors to have our interests at heart.
    - basch 3y ago
      SSO without conditional access is almost worse. It's like Microsoft knows it COULD stop attackers from entering the account, but wont unless you pay them more. To give them credit, at least MFAuthenticator apps are free (and now basically forced.)
      - TheNewsIsHere 3y ago
        We mitigate this by disabling non-phishing resistant MFA factors in the tenant. You can achieve some of the Conditional Access MFA controls using the new MFA options and user groups, but it is not the same and doing it well requires a little more planning and sanity checking.

prepend 3y ago

I use Okta and Microsoft’s Intune/MFA/SSO and I’m not sure which is better. Neither is that great I think. The think that’s annoying to me is the price is $2-11/user/month for sso. That’s crazy considering orgs have thousands of employees that need this and previous self-hosted solutions from CA and others were $50-100k for unlimited accounts. And this seems like an odd place per user and it costs similar amounts to support 1000 users as 5000.

samcat116 3y ago
Welcome to the enterprise sass industry. (Also accounts with user counts that high aren’t paying MSRP you see)
basch 3y ago
What's more annoying is that every sass product on the planet puts sso behind their most expensive "ask us the price" tier. Microsoft should be including sso in their baseline/free products and all enterprise and wanna-be-enterprise software should put it in its base tier. Logon security shouldn't be tucked behind a paywall or held hostage as a bonus quadruple the price feature, because breaches have wide reaching consequences past just the company attacked going down.
- TheNewsIsHere 3y ago
  I fully agree with you about the SSO tax. I would like to add that configuring Azure AD as an SSO provider is available to any tenant free. Some of the functionality like Conditional Access does require paid licensing. I’m aware of a number of businesses that are very happily using Keycloak in production. Not everyone can, although there is RH SSO if you need the support contract. Then there’s Gluu, Authelia, and many others depending on your needs. Sadly even with basic security we can’t seem to fully trust our own vendors to have our interests at heart.
  - basch 3y ago
    SSO without conditional access is almost worse. It's like Microsoft knows it COULD stop attackers from entering the account, but wont unless you pay them more. To give them credit, at least MFAuthenticator apps are free (and now basically forced.)
    - TheNewsIsHere 3y ago
      We mitigate this by disabling non-phishing resistant MFA factors in the tenant. You can achieve some of the Conditional Access MFA controls using the new MFA options and user groups, but it is not the same and doing it well requires a little more planning and sanity checking.