Enterprise SSO and identity federation is challenging. With Ory Polis, you avoid headaches and connect identity providers and directories within days rather than months.
Enterprise readiness for B2B SaaS apps
Ory Polis eliminates the need for technical expertise by providing a developer-friendly solution that lets companies meet enterprise requirements without diverting resources from core product development.
Organizational single sign-on
Integrate SAML using your favorite OAuth 2.0 or OpenID Connect libraries. Go from the first line of code to deployment in days, not months. No SAML expertise required, just a simple API that works with your existing authentication flow.
Self-serve onboarding
Provide enterprise IT teams with secure configuration portals to establish their identity connections without extensive technical coordination. Reduce implementation friction and accelerate time-to-value for both you and your customers.
Directory Sync
Simplify user management with SCIM-based provisioning that synchronizes accounts and groups automatically. Connect to corporate directories through a unified integration that eliminates manual user administration.
Ahmed Elkaffas
Founder
Seamless Enterprise SSO integration with the customer's existing infrastructure, and minimal effort from the customer side, was very important for us.
Ory Polis features at a glance
Organizations
Group users within your project, manage SSO connections, and enforce domain-based authentication that integrates with existing identity providers.
OIDC single sign-on
Establish multiple OpenID Connect (OIDC-based) single sign-on connections for each organization, configurable through the Ory Console and API interfaces.
SAML support
Connect with SAML-based identity providers such as Microsoft Entra ID, Microsoft ADFS, Okta, Auth0, Google Workspace, Ping Identity, and more.
SAML to OIDC bridge
Our bridge enables cross-protocol Identity Federation, enabling your app to use modern OIDC internally while still accepting SAML connections from enterprise customers.
Identity Provider discovery
Route users to their SSO provider based on email domain, eliminating manual selection steps for seamless authentication across B2B and B2B2C apps.
Flexible deployment
Deploy anywhere to meet regional data sovereignty and compliance requirements. Ory offers complete deployment flexibility whether self-hosted, private cloud, or on-premises
How to de-risk identity at scale with Ory
OSS is where most teams start. The question is whether it holds up as scale, compliance, and security requirements grow. Running identity infrastructure yourself means owning everything, from patches to incident response, compliance controls, and performance tuning. At enterprise scale, that overhead competes with product innovation. Ory's commercial offerings, OEL and Ory Network, trade that burden for SLA-backed support, managed CVE patching, and audit-ready controls.
OSS
OEL
Ory Network
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
OSS: No
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Compliance-ready
Compliance and audit-ready (GDPR, PSD2, PCI-DSS, SOC 2, and others)
Ory Network: Yes
Global multi-region architecture
OSS: No
Global multi-region architecture
Multi-region capable
Global multi-region architecture
Ory Network: Yes
Purpose-based data retention
OSS: No
Purpose-based data retention
OEL: Yes
Purpose-based data retention
Ory Network: Yes
24/7 SLA support
OSS: No
24/7 SLA support
OEL: Yes
24/7 SLA support
Ory Network: Yes
CVE security patching
OSS: No
CVE security patching
OEL: Yes
CVE security patching
Ory Network: Yes
Unified control plane for ease of management
CLI
Unified control plane for ease of management
CLI & GUI
Unified control plane for ease of management
CLI & GUI
Production Helm Charts
OSS: No
Production Helm Charts
OEL: Yes
Production Helm Charts
n/a
Managed infrastructure
OSS: No
Managed infrastructure
n/a
Managed infrastructure
Ory Network: Yes
Custom Branding for Onboarding Portal
OSS: No
Custom Branding for Onboarding Portal
OEL: Yes
Custom Branding for Onboarding Portal
Ory Network: Yes
SAML & OIDC
OSS: No
SAML & OIDC
OEL: Yes
SAML & OIDC
Ory Network: Yes
Directory sync
OSS: No
Directory sync
OEL: Yes
Directory sync
Ory Network: Yes
Identity federation
OSS: No
Identity federation
OEL: Yes
Identity federation
Ory Network: Yes
Ory Polis FAQ
Ory Polis is an open-source enterprise Single Sign-On (SSO) service for SAML and OIDC identity providers. It abstracts the complexity of the SAML and OIDC protocols by presenting them as a standard OAuth 2.0 flow. It is available as open-source software, under the Ory Enterprise License for self-hosted production, and as part of the fully managed Ory Network.
- Accelerated Time-to-Market - Ory Polis transforms months of complex SAML/OIDC engineering into a few days of work. By using a "SAML-to-OIDC bridge," developers can integrate enterprise SSO using a familiar OAuth 2.0 flow rather than learning legacy protocols.
- Reduced Sales Friction - Polis provides a self-service configuration portal. This allows your enterprise customers' IT teams to set up their own SSO connections and identity providers (like Okta, Azure AD, or Google Workspace) without needing manual support from your engineering team.
- Automated User Management - Through Directory Sync (SCIM 2.0), Ory Polis automates the provisioning and de-provisioning of users. When an employee leaves a client’s company, their access to your app is automatically revoked, ensuring security and reducing administrative overhead.
- Flexible Data Residency - Unlike "black box" identity providers, Ory Polis offers deployment flexibility. Businesses can choose to host it themselves to meet strict data residency requirements or use the fully managed Ory Network.
SaaS companies serving enterprise customers often need to support SAML-based SSO so employees can log in with their corporate identity provider (Okta, Azure AD, Google Workspace, etc.). Implementing SAML from scratch requires specialized protocol expertise and months of engineering effort. Ory Polis eliminates that burden. You integrate with Ory Polis using familiar OAuth 2.0 or OIDC libraries, and Ory Polis handles the SAML/OIDC protocol translation behind the scenes. This reduces implementation time from months to days.
Ory Polis acts as a SAML-to-OIDC bridge. When your enterprise customer's IT admin configures their SAML identity provider, they upload the IdP metadata to Ory Polis. Ory Polis generates an OAuth 2.0 client for that connection. When a user signs in, your application initiates a standard OAuth 2.0 authorization flow against Ory Polis. Ory Polis redirects the user to their corporate identity provider, handles the SAML assertion, and returns an OAuth 2.0 access token to your application. Your code never touches SAML XML directly.
Yes. Ory Polis supports SAML and OIDC identity providers. Enterprise customers can connect their existing corporate IdP regardless of which protocol it uses. Ory Polis presents both as a unified OAuth 2.0 flow to your application.
Yes. Ory Polis supports SCIM-based directory synchronization for automated user provisioning and deprovisioning. When an employee is added or removed in the corporate directory, the changes are synchronized to your application automatically. Guided setup is available for common directory providers. You can build SCIM endpoints into your application using the Ory Polis library, or run Ory Polis as a standalone service that handles the SCIM webhook lifecycle for you.
Yes. Ory Polis takes a multi-tenant approach by design. Each SSO connection is scoped to a tenant and product pair. A tenant identifies your customer (by email domain, account ID, or similar identifier), and a product identifies which of your applications the connection applies to. You can manage multiple SSO connections for multiple customers from a single Ory Polis instance.
Ory Polis supports two integration modes. First, as a standalone service: you deploy Ory Polis as a separate process (Docker container, Kubernetes deployment, etc.) and interact with it over HTTP APIs. This mode includes an Admin Portal UI for managing SSO and directory sync connections. Second, as an embedded npm library: if your application runs on Node.js, you can embed Ory Polis directly into your application code. This avoids managing a separate service but does not include the Admin Portal UI out of the box.
Ory Kratos handles identity management: login, registration, MFA, sessions, and user profiles. Ory Polis handles enterprise SSO federation: bridging your application to corporate SAML/OIDC identity providers. They are complementary. On the Ory Network, Ory Polis capabilities are integrated into the platform alongside Ory Kratos. When self-hosting, you can run both as separate services.
Ory Polis delivers a "deploy-anywhere" IAM platform designed for trillion-scale performance and architectural flexibility. Seamlessly manage and secure customers, partners, and AI agents without the risk of vendor lock-in. With Ory’s modular building blocks, you consolidate identity infrastructure, lower TCO, and bring mission-critical applications to market faster through automated, high-scale governance.
Yes. Ory Polis provides self-service configuration portals where your enterprise customers' IT administrators can set up their own SAML/OIDC connections and directory sync without needing deep protocol expertise. This reduces the coordination overhead between your team and your customers' IT departments.
Ory Polis open source is free. You can self-host it at no cost.On the Ory Network, Ory Polis capabilities are included as part of the platform. B2B SSO features are available on the Growth plan and above. Enterprise plans are custom-priced.For self-hosted production with SLAs, CVE patching, and enterprise features, the Ory Enterprise License is available at custom pricing.
Deploy Ory Polis on your preferred infrastructure
Deploy on any infrastructure and take full control over your organizational and enterprise customer SSO.
Open Source deployment — Run, try, and inspect Ory Polis open source. Perfect to proof-of-concept your next big idea. 
Ory Enterprise License
OEL deployment — Ory Polis on OEL means optimized code with premium support for mission-critical production environments, on-prem, self-hosted – wherever else you need it, always up to date. 
Ory Network
Ory Network deployment — Ory Network includes Ory Polis powered capabilities in an instant-on global identity system. Achieve speed, security, scale, compliance and support with ease.
Integrations
Ready to try Ory Polis?
Get started with the guides and docs below
AuthProvider.tsx
...
const signIn = async () => {
// store the from url before redirecting ... we need this to correctly initialize the oauthClient after getting redirected back from SSO Provider.
localStorage.setItem(APP_FROM_URL, from);
// Initiate the login flow
await authClient?.fetchAuthorizationCode({
tenant,
product,
});
};
const signOut = async (callback: VoidFunction) => {
authClient?.reset();
setUser(null);
callback();
};
More on Ory Polis
May 29, 2025
Ory Acquires BoxyHQ: Introducing Ory Polis for Enterprise Single-Sign On
In a strategic move set to modernize the identity and access management landscape, Ory has acquired BoxyHQ and launched Ory Polis. Ory Polis addresses organizational identity needs across environments reliant on SAML and SCIM protocols. Previously known as BoxyHQ's Jackson, brings enterprise-ready single sign-on (SSO), directory synchronization, and self-service onboarding to organizations requiring robust B2B and B2B2C identity infrastructure.
