How-to
Enterprise readiness checklist
The list an enterprise buyer works through is shorter and more predictable than it feels the first time. Most of it is identity, most of the rest is evidence, and almost all of it is cheaper to build before the deal than during it.
Identity — the part that blocks deals
These come up first because the customer's IT team is the gate. A product that cannot do them is not evaluated on its merits; it is deferred.
| Requirement | Why they ask | Where it lands |
|---|---|---|
| SAML SSO | Staff must not have another password | A connection per customer |
| OIDC SSO | Their platform prefers it | The same connection, different type |
| SCIM provisioning | Accounts must appear without a ticket | A webhook handler |
| Deprovisioning | Access must end when employment does | The same handler, deactivation path |
| Domain-based routing | People type an email, not a workspace | Verified domains on the organization |
| Self-serve setup | Their admin will not wait for yours | A portal link from your settings screen |
Deprovisioning is the requirement most often mistaken for SSO. A product with SSO and no provisioning cannot answer what happens when somebody leaves, and that question is asked in every security review.
Access control
- Roles that are meaningful per organization, so the same person can be an admin in one workspace and a viewer in another.
- Permissions enforced at the API, not only hidden in the interface.
- An organization admin who can manage their own members without contacting your support team.
- A documented, readable list of what each role can do — procurement reads this, not your code.
- A way to change or revoke access that takes effect immediately rather than at the next session refresh.
Evidence — the part that slows deals
The second wave of questions is about proof rather than features. The answers are mostly records, and records have to exist before they are asked for.
- An audit log the customer can search themselves, covering authentication, access changes and configuration.
- Export of that log on demand, in a format their tooling can read.
- A record of who granted whom which permission, and when.
- Session and device visibility, with revocation available to the customer's own admin.
- Data handling documentation: what you store, where, for how long, and who processes it on your behalf.
Certification programmes such as SOC 2 and ISO 27001 belong on this list as planned rather than claimed. Stating a certification you do not hold is a faster way to lose an enterprise deal than not holding one.
Operational expectations
| Question | What a good answer looks like |
|---|---|
| What happens if your identity provider is down? | A documented break-glass path, with its use audited |
| How do we test before rolling out? | A separate environment with separate keys and data |
| Who at your company can see our data? | A specific, small answer with an access record behind it |
| How do we get our data out? | An export path that exists today, not a promise |
| What is your incident notification process? | A stated timeframe and a named channel |
| Can we restrict which regions our data sits in? | A truthful answer, whichever direction it goes |
A sensible order to build in
Everything above is worth having, and doing it all at once is not realistic. This order front-loads what unblocks deals and defers what merely improves them.
- 1Organizations and memberships. Nothing else can be scoped without them, and retrofitting tenancy is the most disruptive change on this list.
- 2SSO for both protocols, as a connection record rather than a branch in your sign-in code.
- 3Self-serve setup, so onboarding a customer does not consume a day of your engineers' time.
- 4Provisioning and deprovisioning, which converts the hardest security question into a demo.
- 5Roles and permissions with per-organization scope.
- 6Audit logging, searchable and exportable by the customer.
- 7Session controls and step-up on sensitive actions.
A quick self-check
If you can answer these five without qualification, you are ready for the conversation. If you cannot, the gaps are the roadmap.
11. Bir musterinin BT yoneticisi SSO'yu sizin ekibiniz olmadan kurabilir mi?22. Biri isten ayrildiginda urunundeki erisimi kac dakikada biter?33. Bir musteri "gecen ay kim hangi yetkiyi verdi" sorusunu kendi ekraninda4 yanitlayabilir mi?54. Ayni kisi bir calisma alaninda yonetici, digerinde izleyici olabilir mi?65. Bir oturum, sahibi cikis yapmadan aninda iptal edilebilir mi?
Question two is the one to be honest about. Most products answer it with the session lifetime rather than with a revocation path, and the difference between those two numbers is usually days.