Enterprise sign-on sits on the top pricing tier in almost every business product, and there is a recurring argument about whether it should. The case against is that security features should not be a luxury. The case for is that the buyer who needs it is the buyer with a procurement process, and the cost of supporting them is real.
That argument is worth having once. The engineering question underneath it is more interesting and gets far less attention: an entitlement is a check, the check runs somewhere, and where you put it decides what happens on the morning a card expires.
Gate the setup, never the sign-in
The tempting implementation is a check on the authentication path: when a request arrives for an organisation with a connection, confirm the plan allows it. It is one line and it is a trap. Billing state changes for reasons that have nothing to do with security — a failed renewal, a card that expired, a finance team taking three weeks over a purchase order — and a check on that path means an entire company cannot sign in because an invoice is late.
Put the entitlement on the administrative action instead. Creating a connection, adding a second one, enabling directory provisioning: those are the operations that require the plan. Once a connection exists and is verified, authentication runs on its own terms. The commercial conversation then happens where it belongs, in the dashboard and in email, rather than at the sign-in box of somebody who has no idea a renewal is outstanding.
Billing state is a commercial signal. Wiring it into the authentication path turns a late invoice into an outage.
Downgrade is the direction nobody designs
Upgrading is easy: the customer pays, the feature appears. Downgrading is where the questions live, and they are questions of principle rather than code. People have been provisioned through the directory and have no password. Sessions are live. Group membership drives their roles. Turning the connection off makes all of that ambiguous at once.
Decide the answers deliberately and write them into the product rather than discovering them during a cancellation. A dormant connection that retains its configuration and can be reactivated is almost always the right shape — it keeps the customer's setup work intact, and it means a re-subscribe is a click rather than another round with their IT department.
- Keep provisioned accounts; deactivating a connection is not a reason to delete people
- Give directory-created users a route to a password or a fallback method before the door closes
- Let existing sessions expire naturally rather than terminating every one of them at the change
- Mark the connection dormant, preserving configuration and certificates for reactivation
- Tell the administrator what will happen, in the same screen where they downgrade
Trials, pilots and the order of events
The sequence in enterprise sales is inconvenient for a tier gate. The security review happens before the contract. The buyer's identity team wants to configure a connection, test it against their staging directory, and confirm it works, and all of that occurs while the account is still on whatever plan they signed up with by card.
So the gate needs a time-boxed exception rather than a hard boundary: a connection that can be created and tested for a defined window, with an obvious expiry the administrator can see. Without it, the sales team ends up asking an engineer to flip a flag for every pilot, which is a manual process that will eventually flip the wrong flag on the wrong account.
Price the thing that scales with you
If sign-on is packaged as a per-connection charge, a customer with four subsidiaries and four identity providers pays four times for one product, and they will notice. If it is a flat tier, a large customer costs the same as a small one. Neither is wrong, but they push behaviour in opposite directions, and the second is much easier to explain in a negotiation.
Whichever you choose, keep the entitlement model separate from the enforcement code. One place that answers may this organisation have a connection, called from the handful of administrative endpoints that need to know. Entitlement logic scattered across a codebase is the reason products end up unable to change their own pricing without a migration.
Everything here, already built
Sign-in, enterprise SSO, directory provisioning, roles and an audit trail behind one API. Start with the quickstart and have a working sign-in this afternoon.