If you're small then the benefits of SSO aren't really there anyway. When you're a team of 10, what benefit is SSO really giving?

I work in a small company and we have to have SSO for compliance reasons (SOC II, HIPAA, NIST, etc)

It’s dumb but without it trying to tick all the compliance boxes is much more annoying.

You go through a review, and somebody asks who this guy xxx123 is that made this change, and somebody vaguely recalls it is some consultant that for some reason still have access to everything but quit two years ago. Love those meetings.

Unfortunately this is not true when you're trying to undergo a SOC 2 audit.

First, there is no requirement by SOC2 that says you "must use SSO for all applications". SOC2 talks about "logical access controls". For a team of 10, you would simply have a policy that states "any time a new developer comes on, they have to use MFA to access GitHub and this is enforced because we check the box in GH, blah blah" and "any time a developer leaves the company, we revoke all access, blah blah".

Also, if you're going to spend $20k+ on SOC2 because your clients require it, then spending the $20k on GitHub shouldn't be a problem because your clients should be paying for it (i.e. your ACV should be high enough to cover these things).

Yes, but SSO makes writing those policies (across all apps) much simpler. I think it's too bad that SSO is so heavily taxed, because it's quite an elegant way to solve account provisioning.

Interesting site: https://sso.tax/

Understood.

> I think it's too bad that SSO is so heavily taxed

Honestly, most software (especially SaaS) is underpriced for the value it creates. SSO is just an easy way to bump clients into the "real" pricing of the software while still letting them try most/all of the core features.