SSO, SAML, SCIM: an L&D leader’s plain-English explainer

If you lead L&D, you’ve sat in a meeting where IT said “it needs to support SAML and SCIM” and everyone nodded. This is the no-jargon version of what those acronyms mean, why your IT team insists on them, and what each one changes for your learners, your admins and your security review.

SSO: one login for everything

Single Sign-On means your people use the company login — the same one that opens their email — to access the LMS. No separate username, no separate password, nothing new to forget.

Why it matters to you, not just IT: forgotten passwords are the single biggest engagement killer we measure. In deployments without SSO, a meaningful share of learners who click a training reminder bounce at the login screen and never come back. With SSO, clicking the reminder simply opens the course. If you fix only one technical thing before a roll-out, fix this.

SAML: how the login actually happens

SAML is the protocol that makes SSO work between two systems that have never met. When a learner opens the LMS, the LMS asks your identity provider — Microsoft Entra ID, Okta, Google Workspace — “is this person legit?”. The identity provider checks, then sends back a signed note saying “yes, this is Priya from Operations.” The LMS trusts the note because it’s cryptographically signed, and lets her in.

The learner sees none of this. The whole exchange takes under a second. When a vendor says “we support SAML 2.0,” they mean their product can hold this conversation with whatever identity system your company already runs. (You’ll also hear OAuth and OpenID Connect — different dialects of the same idea. Your IT team will know which one they use; a good LMS supports all of them.)

SCIM: who gets an account, automatically

SAML handles logging in. SCIM handles existing. With SCIM, your HR system tells the LMS automatically: Priya joined Operations on Monday — create her account and enroll her in onboarding. Rahul moved to Risk — switch his learning path. Sara left the company — deactivate her access today.

Without SCIM, somebody on your team maintains user lists by hand — uploading CSVs, chasing leavers, explaining to auditors why a person who exited in March still had an active account in July. That last one is not hypothetical; it’s one of the most common audit findings in access reviews.

What your security team will ask

When an LMS goes through security review, the identity questions are predictable. A vendor should answer all four without hesitation:

1. Do you support SAML 2.0 / OpenID Connect against our identity provider?
2. Do you support SCIM 2.0 provisioning and same-day deprovisioning?
3. Can you enforce that all users sign in via SSO only, with no password fallback?
4. Are sign-in events logged and exportable for our access audits?

Learnify answers yes to all four — SAML 2.0, OAuth 2.0 and OpenID Connect for sign-in, SCIM 2.0 for provisioning, SSO-only enforcement and exportable auth logs. If your IT team wants the technical detail, we’ll happily get them on a call with our engineers.