Which AI Coding Tools Support SSO and SCIM? Cursor, Claude Code, GitHub Copilot, Codex and Gemini Code Assist by Plan
Every major AI coding tool offers SAML SSO on a business plan, but SCIM and audit logs start at Enterprise on Cursor, Claude Code and Codex, and GitHub Copilot inherits both from GitHub Enterprise Cloud. SSO also stops at the workspace you bought: a personal account or API key on the same laptop walks around it. We compare nine plans from vendor docs and show how to pin each client to your workspace and offboard developers.
D
Dr. Marcus Chen
Principal Security Researcher
Nov 13, 2026
On this page
Which AI coding tools support SSO and SCIM? As of 13 November 2026, every major coding assistant offers SAML single sign-on on a business plan, but SCIM, the protocol that provisions and removes users automatically, starts one tier higher almost everywhere. Cursor, Claude Code and OpenAI's Codex keep SCIM and audit logs for their Enterprise plans. GitHub Copilot inherits SAML and SCIM from the GitHub organization it runs in, which must be on GitHub Enterprise Cloud. Gemini Code Assist signs developers in with a Google Account, and Google stopped selling new Standard and Enterprise subscriptions on 9 October 2026.
There is a second limit, and it matters more.
SSO governs the workspace you bought. It does not govern the personal account, API key or long-lived token a developer gives a CLI agent on the same laptop, and SCIM cannot remove a credential your identity provider never issued.
Last verified: 13 November 2026, against each vendor's own pages: Cursor's pricing, security and enterprise docs; GitHub Docs and the GitHub changelog; the Claude Help Center and Claude Code docs; OpenAI's Codex docs and Trust Portal; and Google Cloud's Gemini Code Assist docs. OpenAI's Help Center returned 403 errors, so no OpenAI help article was read directly. "Not documented" means we could not find the statement on the vendor's own pages that day.
Figure 1. Your identity provider controls one of the three doors. The other two close only with settings pushed to the device.
Which AI coding tools support SAML SSO, SCIM and audit logs, plan by plan?
Every cell comes from the vendor's own documentation, fetched on 13 November 2026.
Tool and plan
SAML SSO
SCIM
Audit logs or audit API
Retention and training
SOC 2 report
GitHub Copilot Business ($19 per seat per month)
Yes, when the organization uses GitHub Enterprise Cloud
Yes, with organization SAML (Entra ID, Okta, OneLogin) or Enterprise Managed Users
Yes: Copilot events in the enterprise audit log, kept 180 days, can stream to a SIEM; local prompts not included
Not used to train models; zero data retention (ZDR) agreements with OpenAI and Anthropic, except Claude Fable 5, 5.1 and 5.2
SOC 2 Type 2 has covered Copilot Business since the April to September 2024 period
GitHub Copilot Enterprise ($39 per seat per month)
Yes; the plan is designed for GitHub Enterprise Cloud
Same as Business
Same as Business
Same as Business
Same as Business
Cursor Teams
Yes, SAML/OIDC
No; Enterprise only
No; Enterprise only
Team-wide privacy settings; with Privacy Mode on, Cursor does not train on the data
SOC 2 Type II attestation, on request through trust.cursor.com
Cursor Enterprise
Yes
Yes, on Enterprise plans with SSO enabled
Yes; streams to Splunk, Sumo Logic, an HTTPS webhook or S3; no prompts or code in payloads
Privacy Mode on by default and enforceable; most models under ZDR, three Claude Fable models need admin approval
Same as Teams
Claude Code on a Team plan
Yes
No; JIT provisioning only, which never removes members
No; Enterprise only
No training under commercial terms; standard 30-day retention
SOC 2 Type I and Type II for Claude for Work and the API
Claude Code on an Enterprise plan
Yes, and it can be required
Yes
Yes: 180-day export, and the same events in the Compliance API
ZDR for Claude Code for qualified accounts, enabled by Anthropic, not in the standard plan
Same as Team
Codex on ChatGPT Business
Yes
No; listed for Enterprise and Edu
No; the Compliance API is listed for Enterprise and Edu
No training on business data by default; ZDR for Codex not documented
OpenAI's SOC 2 Type 2 for 1 July 2025 to 30 June 2026 names ChatGPT Enterprise and Edu; Business and Codex not named
Codex on ChatGPT Enterprise or Edu
Yes
Yes
Yes: Compliance API for audit records; Compliance Logs Platform records available for 30 days
Retention controls; not used to train by default; OpenAI says API ZDR does not define retention for ChatGPT Work
Enterprise and Edu named; Codex not named
Gemini Code Assist Standard and Enterprise
Not documented on the Code Assist pages; developers sign in with a Google Account
Not documented
Cloud Audit Logs for the Gemini for Google Cloud API (admin activity and data access)
Stateless, prompts and responses not stored; not used to train without permission
SOC 1, SOC 2 and SOC 3 listed for Standard and Enterprise
Three patterns stand out. SSO is cheap: it arrives on the first business plan of every tool here. SCIM and audit logs are where the price jumps, and on Cursor, Claude and ChatGPT they arrive together on Enterprise. And SOC 2 belongs to the vendor, not the plan, so the report you download is the same whether you bought Teams or Enterprise.
GitHub is the exception to the tier pattern, because Copilot lists audit logs on Business, but it needs the most groundwork. SAML for an organization requires GitHub Enterprise Cloud, and GitHub's organization-level SCIM "cannot" be used "with an enterprise account or with an organization with managed users," so the identity model you chose for GitHub decides how Copilot seats are provisioned. The packaging is also moving: on 28 October 2026 GitHub announced Copilot included with GitHub Enterprise for every licensed user, available now to customers with an account team and opening to self-serve customers in stages, with Copilot Business and Copilot Enterprise still on sale.
Windsurf is not in the table. Its documentation now redirects to Cognition's docs.devin.ai, where the SSO and SCIM page says "This feature is only available to Enterprise users," and we could not tie that to a current Windsurf plan.
Figure 2. The SCIM column is the one that decides your plan. Offboarding without it is a manual task for every tool.
Why doesn't SSO cover personal accounts and CLI agents?
Because a coding agent accepts more than one kind of credential, and only one of them comes from your identity provider. Claude Code signs in with a Pro, Max or Ultra subscription, a Team or Enterprise seat, a Claude Console login, or cloud provider credentials. Codex offers "Sign in with ChatGPT for subscription access" and "Sign in with an API key for usage-based access" in the same CLI. Cursor's own enterprise docs warn that personal accounts "might not have Privacy Mode enabled." GitHub routes personal Copilot plans to their own endpoint, *.individual.githubcopilot.com.
The data commitments follow the credential, not the laptop. Anthropic's ZDR page says it plainly: "If a developer signs in to Claude Code with a personal account or with an API key from a different organization, those sessions are not covered."
Offboarding has the same gap. SCIM removes the seat in your workspace. It does nothing to a personal subscription the developer paid for, an API key from a side project, or a token minted for a script. Claude Code's claude setup-token produces a one-year OAuth token, and the authentication docs note that this command and /install-github-app enforce only forceLoginMethod, "so they can mint a token in a different organization." MCP servers add another layer: they start on the laptop, read their own credentials from local config files, and never pass through the IdP. Our guide to SSO for enterprise AI security covers the same boundary for chat tools.
How do you enforce SSO-only use of each coding tool?
Turn on SSO enforcement in each admin console first, then pin the client on the device. Every vendor ships a pin, and each one works only when your MDM or managed configuration delivers it.
Cursor. Require SSO for all team members, which Cursor says can "block password-based authentication entirely." Then deploy the AllowedTeamId MDM policy: "If a user tries to log in with a different team ID (like a personal account), Cursor logs them out immediately." Our Cursor enterprise security review covers the rest of the Enterprise hardening.
Claude Code. Turn on "Require SSO for Claude" in organization settings. Then set forceLoginMethod and forceLoginOrgUUID in managed settings; Claude Code "reports an error for a claude.ai login to any other organization" and blocks ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN and apiKeyHelper at startup. Server-managed settings arrive only after a developer authenticates into your organization, so push these two keys through device management. The Claude Code lockdown guide walks through the full managed settings file.
Codex. Set forced_login_method to allow only ChatGPT login, and forced_chatgpt_workspace_id to your workspace. If credentials don't match, "Codex logs the user out and exits."
GitHub Copilot. Use subscription-based network routing: allow *.business.githubcopilot.com or *.enterprise.githubcopilot.com and block *.individual.githubcopilot.com. If you plan to move to GitHub's newer Copilot access billing model, add the enterprise endpoint first, because GitHub warns that an allowlist permitting only the business endpoint "will block traffic for this billing model."
Gemini Code Assist. The setup docs describe licenses assigned through a Google Cloud billing account and IAM roles, with inactive licenses reassigned after 30 days. They do not describe a personal-account block, and with new sales closed, Google points customers to Antigravity in Gemini Enterprise editions.
Each pin sees only its own tool. A laptop can be pinned correctly in Cursor and still run Codex against a personal ChatGPT account, or a Claude Code session with a key copied from a side project. That cross-tool layer is where AccuroAI works: uploads to personal AI accounts are blocked while the licensed tool keeps working, the MCP servers on each developer machine are inventoried with a 0 to 100 risk score, and risky MCP servers and destructive agent commands are blocked by policy. Our coding assistant security page shows how that sits beside the vendors' own controls.
How do you offboard a developer from every AI coding tool?
Remove the user in the identity provider. Where SCIM is on, that carries through: on Cursor, "Departing employees lose access when removed from your identity provider"; on Claude Enterprise, "Users removed from your IdP app are automatically removed"; on a GitHub organization with SCIM, the member is removed from the organization.
Remove them by hand where SCIM is missing. Without SCIM, Cursor says "you add users to your Cursor team by hand and remove them when they leave." On a Claude Team plan, JIT-provisioned users "stay in your member list and keep their seat until an admin removes them."
Revoke what SSO never issued. API keys in the Claude Console or the OpenAI platform, Cursor service accounts on Enterprise, and any long-lived Claude Code tokens all need their own revocation step.
Check the device. Look for personal logins in each coding tool and for MCP server configs holding their own tokens.
Export the record before it ages out. GitHub keeps Copilot audit events for 180 days, Claude exports cover the past 180 days, and OpenAI's Compliance Logs Platform keeps records for 30 days. Stream them to your SIEM so offboarding evidence outlives those windows.
What should you do this quarter?
For each coding tool you approve, buy the tier where SCIM lives, or write down who removes leavers by hand and how fast.
Turn on SSO enforcement in every admin console, not just SSO availability.
Push the device-side pins through MDM: AllowedTeamId, forceLoginOrgUUID, forced_chatgpt_workspace_id and Copilot network routing.
Decide on the Claude Fable models. Cursor holds them until an admin approves their retention policy, GitHub lists all three outside its Anthropic ZDR agreement by default, and Anthropic lists them as models that require data retention.
Stream every available audit log to your SIEM, and record where none exists (Cursor Teams, Claude Team, ChatGPT Business).
Plan for Gemini Code Assist renewals: annual subscriptions can renew until 31 January 2027 and monthly ones until 31 December 2027.
To keep all of this on one page, our AI Tool Controls Matrix lists SSO, SCIM, audit and retention plan by plan for AI tools, so an approval meeting starts from one sheet instead of nine vendor sites.
What can a security tool enforce, and what is still your call?
Software can enforce the pins, block personal accounts and risky MCP servers, and keep a record of every event. It cannot choose your plan tier, negotiate ZDR with a model vendor, or decide whether a contractor's personal Copilot subscription is acceptable. Those are procurement and policy calls. A SOC 2 report describes the vendor's controls, not yours. This article is not legal or audit advice.
Frequently asked questions
Which AI coding tool integrates with SSO and SCIM?
Cursor Enterprise, Claude Code on a Claude Enterprise plan, Codex on ChatGPT Enterprise or Edu, and GitHub Copilot in an organization on GitHub Enterprise Cloud with SCIM configured all document both. Cursor Teams, Claude Team and ChatGPT Business include SAML SSO without SCIM.
Is there an AI coding agent with SSO, SAML and SCIM support?
Yes. Claude Code and Codex are terminal agents, and both get SAML SSO and SCIM through their vendor's Enterprise plan. Cursor's agent gets them on Cursor Enterprise. The catch is the client: without a device-side pin such as forceLoginOrgUUID or forced_chatgpt_workspace_id, the same CLI will accept a personal login.
Can I enforce SSO and offboard developers automatically from our AI coding tools?
Partly. Enforcing SSO in the admin console plus a pin on the device closes the personal-account path for that tool, and SCIM removes the workspace seat when you remove the user in your identity provider. Neither touches API keys, long-lived tokens or MCP server credentials on the laptop.
What are the best AI coding platforms for enterprises requiring SOC 2, SAML SSO and zero data retention?
We don't rank them, but three document all three on their enterprise plans: Cursor Enterprise (SOC 2 Type II, SAML, ZDR agreements with model providers), Claude Code on Claude Enterprise (SOC 2 Type II, SAML, ZDR for qualified accounts on request) and GitHub Copilot Business or Enterprise (SOC 2 Type 2, SAML through GitHub Enterprise Cloud, ZDR agreements with OpenAI and Anthropic). Each carves out the Claude Fable models. OpenAI does not document ZDR for Codex under a ChatGPT plan.
For enterprise security teams, which alternatives to Cursor Enterprise offer SAML SSO, zero data retention and audit logs?
Claude Code on Claude Enterprise has SAML SSO, SCIM, audit log export with the Compliance API, and ZDR that Anthropic enables for qualified accounts. GitHub Copilot Business and Enterprise have SAML through GitHub Enterprise Cloud, an audit log with 180-day retention and provider ZDR agreements. Codex on ChatGPT Enterprise has SSO and the Compliance API, but no documented ZDR for Codex.
