Question

A SaaS company integrates dozens of enterprise customers who use their own corporate identity providers for SSO via SAML. The security team discovers that when employees leave a customer organization, their access to the SaaS application often persists for weeks because the SAML federation only handles authentication at login time, not account lifecycle changes. The team needs to eliminate these orphaned accounts automatically. Which approach best addresses the root problem?

Accepted Answer

Implement SCIM so the customer's identity provider can automatically provision and deprovision user accounts in the SaaS application in near real time

Answer

Shorten the SAML assertion lifetime and reduce SSO session timeouts to force more frequent re-authentication

Answer

Require each customer to submit a monthly spreadsheet of terminated users so the SaaS provider can manually disable those accounts

Answer

Enable multi-factor authentication on all federated logins to strengthen identity assurance during authentication