This argument misses the mark that SSO tax is charging extra for a practice that: (a) BnL everyone should do, (b) reduces the SaaS provider's liability, (c) is

This argument misses the mark that SSO tax is charging extra for a practice that: (a) BnL everyone should do, (b) reduces the SaaS provider's liability, (c) is incredibly costly to change/transition how it's done after initial setup, (d) actually doesn't add much overhead when using poor-man's SSO aka OIDC/OAuth2* (the now ubiquitous "sign in with" or "continue with" buttons that require zero integration once set up once), (e) drags in a host of other odious interactions most buyers want nothing to do with (Call Us? Why?), and (f) is bad for industry trust as a whole. Also, people wouldn't even mind if you added $2/user so you can't lose their creds and they don't have to remember your password. (For comparison, all of Microsoft E5 security tools together add ~$20 to M365.) If you really want a differentiator they have to pay for that isn't SSO, go with "audit logs", "RBAC", and "Team Roles" management as lifts. Most anyone required to use SSO is required to use vendors that support audit logs. For SSO itself, you can also still charge for "automated group provisioning" (what used to be SCIM in SSO world). By the time they care about teams, they care about this. See more features to charge for here: https://www.enterpriseready.io/ https://www.enterpriseready.io/ * This is on top of the argument from elsewhere in this thread, "Use our Google login then..." Note to the B2B startup bubble: more of your potential small, mid, and Fortune 500 business customers (where customer headcount > 1) can "Sign in with" Microsoft than Google. (Some estimates put it at 85%). Meanwhile, what startups and businesses on each side of B2B think they need legacy SSO/SAML for, most can actually meet all their requirements with this far more straightforward approach combined with a domain name control check and email domain filter.