4 Identity Essentials for Scaling SaaS in Large Orgs by Daizen Ikehara (Auth0)

4 identity factors you didn't know you needed to support large organizations in your SaaS
Daizen Ikehara, Principal Developer Advocate at Auth0

apidays Singapore 2025
Where APIs Meet AI: Building Tomorrow's Intelligent Ecosystems
Marina Bay Sands Expo & Convention Centre
April 15 & 16, 2025

------

Check out our conferences at https://www.apidays.global/

Do you want to sponsor or talk at one of our conferences?
https://apidays.typeform.com/to/ILJeAaV8

Learn more on APIscene, the global media made by the community for the community:
https://www.apiscene.io

Explore the API ecosystem with the API Landscape:
https://apilandscape.apiscene.io/

Transcript

1. @neri78 4 Identity Factors You Didn’t Know You Needed to Support Large Organizations in Your SaaS Daizen Ikehara | @neri78
2. @neri78 👋 Hi, I am Daizen! X (Twitter): @Neri78 Bluesky: neri78.bsky.social LinkedIn: daizenikehara GitHub: http://github.com/neri78 Daizen Ikehara Principal Developer Advocate
3. @neri78
4. @neri78 Speed to Market is a key
5. @neri78 When your SaaS grows, you need to support various users
6. @neri78 Variety of Users Individual Users Group Users Enterprise Users (Large Organizations)
7. @neri78 Requirements are different… Ease of use Collaborations Auditing User Onboarding Subscription Management SSO Access Control User Management Branding Security
8. @neri78 Is your SaaS
9. @neri78 What kind of SaaS to “support large organizations” ? Business to Consumer (B2C) Business to Business (B2B) Business-to-Business-to-Consumer (B2B2C) Business-to-Business-to-Employee (B2B2E) Who uses? Who buys? SaaS Apps
10. @neri78 4 Identity Factors To Support Large Organizations Multi-tenancy Authorization Security Enterprise Federation
11. @neri78 01. Multi-tenancy • Common approach to support multiple customers • Each customer has their users • Experience should be isolated • Customized settings and data Data Data Data Compute Datastore Customer A (Tenant A) Customer B (Tenant B) Customer C (Tenant C)
12. @neri78 02. Authorization • Who’s allowed to do What? ◦ Administrators ◦ Members ◦ … and Others • What is the best Authorization model for your SaaS? ◦ Role-Based (RBAC) ◦ Attribute-Based (ABAC) ◦ Relationship-Based (ReBAC)
13. @neri78 ReBAC quick intro https://zanzibar.academy/ • Define relationship model ◦ Doc ◦ Owner ◦ Editor ◦ Viewer • Add Tuple on each operation ◦ Carl is a viewer of doc: slides • Query the model ◦ Is Carl a editor of doc:slides?
14. @neri78 03. Enterprise Federation • How users will prove their identity? • “bring your own identity” is a must • How to manage Onboarding and Offboarding? • What the scenario could happen if you do not have…?
15. @neri78 04. Security • What additional security measures are required for large organizations? ◦ Email Verification ◦ MFA / risk-based MFA ◦ MFA factors ◦ Timeouts ◦ Suspicious IPs (Allowed IPs) ◦ Bot detection • Auditing
16. @neri78
17. @neri78 Delegate administrative settings to your customer Admins
18. @neri78 SaaStart: Reference B2B SaaS App with Auth0 for delegated Administrations https://a0.to/saastart https://a0.to/saas-code
19. @neri78 Questions?
20. @neri78 Thank you! @neri78