SSO, SAML, OpenID Connect & SCIM — what is the difference?

When you start looking into Single Sign-On (SSO) for ContractHero, you quickly come across terms such as SAML, OpenID Connect and SCIM. They sound similar, but they solve different problems. This article explains the four terms in plain language and shows what ContractHero currently supports.

Your benefit

Anyone who keeps these terms clearly apart will communicate more precisely in the setup conversation with IT and Sales — and will know which question belongs to which topic. That saves rounds of back-and-forth during onboarding and makes decisions between IdPs (identity providers) more robust.

The four terms at a glance

Term	What it is	What it is for
SSO	Concept	"Log in once, work everywhere" — the umbrella term
SAML	Protocol	Authentication — typically enterprise, XML-based
OpenID Connect	Protocol	Authentication — modern, built on top of OAuth2
SCIM	Protocol	Provisioning — creating, changing and deleting users

SSO (Single Sign-On)

A concept, not a protocol. SSO means that your users log in once with a central identity provider (e.g. Microsoft Entra, Okta, Google) and automatically get access to all connected applications — without a second password.

The question "Does ContractHero have SSO?" on its own is therefore incomplete — the more precise question is: via which protocol (SAML, OpenID Connect, something else)?

SAML (Security Assertion Markup Language)

The older authentication protocol, frequently used in enterprise environments. It uses XML for the authentication communication between the identity provider (IdP) and the application. SAML has been established for years and is already set up in many IT landscapes.

Typical use cases:

Large enterprises with existing SAML IdPs (Microsoft ADFS, Okta SAML, etc.)
IT standardisations that have already defined SAML as mandatory

OpenID Connect (OIDC)

A modern authentication protocol based on OAuth 2.0. It uses JSON instead of XML, is more lightweight and mobile-/web-friendly. Most new applications rely on OpenID Connect.

What ContractHero supports: OpenID Connect via Microsoft Entra (formerly Azure AD) is the tested and supported SSO variant in ContractHero (see Related articles: "How do I set up SSO?"). Other OpenID Connect-compatible IdPs (e.g. Okta, Google Workspace) are technically possible — get in touch with us about your specific configuration.

SCIM (System for Cross-domain Identity Management)

A provisioning protocol, not an authentication protocol. SCIM answers a different question from SAML/OIDC: not "How does someone log in?", but "How are users created, changed and deleted in the system in the first place?".

With SCIM, your IdP synchronises automatically:

New employees are created in the IdP when they join → SCIM also creates them in the application.
Role or department changes are carried over into the application automatically.
Departures lead to automatic deactivation in the application.

Without SCIM, you have to create employees manually in every application and remove them one by one during offboarding. SCIM typically complements SSO — authentication plus automatic provisioning from a single source.

What ContractHero currently supports

SSO via OpenID Connect with Microsoft Entra (formerly Azure AD) — documented and supported (see Related articles).
Other OIDC IdPs (Okta, Google Workspace) — technically possible, agreed individually.
SAML — get in touch with us about your use case.
SCIM provisioning — get in touch with us about your use case.

Frequently asked questions

Do I need both — SSO and SCIM?
For small setups, SSO (authentication) is often enough. With a large number of employees or frequent staff changes, adding SCIM is worthwhile, because otherwise you have to maintain user lists manually.

Which protocol should I choose if I am starting from scratch?
OpenID Connect, if your IdP supports it — more modern and easier to configure. SAML, if your IT landscape is already based on it.

Does SSO work automatically as soon as I set it up?
No. You have to register the app in your IdP and enter the connection details in ContractHero. After that, your users need one logout/login cycle (see Related articles: "How do I set up SSO?").

Is SSO automatically more secure than a password login?
Not as such — SSO is only as secure as your IdP. With MFA, Conditional Access and device compliance in the IdP, logging in becomes considerably more secure than passwords alone.

Do users lose access if the IdP goes down?
In principle yes — which is why many setups have a fallback login with e-mail and password for owners. Check this in your ContractHero security settings.

What if I do not yet know what our IdP supports?
Ask your IT team — Microsoft Entra, Okta, Google Workspace, ADFS and most other IdPs support both SAML and OIDC.

Good to know

SSO and SCIM are independent of each other. You can run SSO without SCIM (create users manually, log in via the IdP) and the other way round. The combination is the clean end state, not a must at the start.
Microsoft Entra is the most common IdP among our customers. If you use Microsoft 365, Entra is already there — setting up SSO then typically takes 15–30 minutes.
We support you during onboarding. For SSO/SCIM setups, we go through the configuration together with your IT team.
Keep the terms clean. "Do you have SSO?" is roughly like "Do you drive a car?" — it says nothing about manufacturer, model or type of engine. Be specific about "OIDC", "SAML" and "SCIM", and name your IdP — then the setup conversation becomes far more productive.

How do I set up SSO? (Microsoft Entra / Azure AD)
Microsoft Entra: renewing the client secret for ContractHero SSO
How can roles and permissions be managed for additional users?

Updated on: 08/26/2026

Was this article helpful?

Thank you!