From sunsetting CIAM to modern customer identity

Descope is built for teams migrating off legacy CIAM platforms ahead of an announced end-of-life timeline, with dedicated onboarding support and no-code tooling designed to speed migration and reduce ongoing roadmap risk.

• After Identity Cloud's End of Sale date of March 7, 2024, new feature development stopped. The Social Login Dashboard retired March 31, 2026.

• Full service sunset lands December 31, 2027 and existing contracts cannot be renewed beyond that date, forcing customers to migrate.

Descope is multi-tenant by design and can support advanced B2B enterprise requirements. Tenants can easily be created and managed from the console or Management SDK.

Multi-tenancy is modeled through generic Properties tied to a single app, each with its own client secret and permissions.

• Strong support for both SAML and OIDC SSO. 

• Support all SAML group and attribute mappings.

• Use identity federation to unify customer identities across all customer and partner facing apps.

• Add multiple IdP connections to a single SSO tenant.

Hosted Login supports SSO only through OIDC and OAuth 2.0, requiring the same domain and device for silent sign-in. SAML appears only as an inbound protocol for custom providers.

Descope’s SSO Setup Suite allows your customers to easily set up SSO and SCIM to your app with their own IdPs.

SSO works across shared domains, but it tends to have a traditional, heavier enterprise configuration framework. Manual mapping of custom claims/attributes via standard JSON payloads.

No-code workflows to create and customize flows such as user invites, step-up auth, user merging, and identity orchestration.

Registration Builder manages fields, forms, and screens, but the underlying flow is a raw JSON file. Meaningful journey changes still require direct use of the Configuration API.

• Utilize a variety of native risk signals to enforce adaptive MFA like new device checks, impossible traveler, and VPN checks.

• Easily create branching user paths based on risk scores ingested from 3rd-party fraud services like reCAPTCHA, Telesign, and AbuseIPDB.

Risk-based authentication is an add-on built on ACR levels: password only, or password plus SMS and email. Hardware-based assurance (AAL3) is explicitly unsupported, and risk signals are not documented in detail.

• Add fine-grained and tenant-aware authorization (RBAC, ReBAC, ABAC) capabilities to your app. 

• Utilize custom JWT claims to define access controls for your app.

• Define custom roles per B2B tenant.

• Assign user roles and permissions based on workflow conditions.

Documented RBAC covers only internal Console access. There is no native fine-grained authorization engine, so app-side permissions must be custom-built using claims and entity attributes.

• Embeddable widgets for user and tenant-level identity delegation.

• Support for user profiles, user / role / access key / audit management.

• Widgets are fully customizable, including bringing in custom user attributes.

• Hosted Admin Portal to delegate user and identity management.

• Console RBAC covers internal admin only.

• No embeddable, self-service admin widgets.

• Limited fine-grained access for end users.

• Automated or on-demand user provisioning and deprovisioning.  

• Integrations with major IAM systems ensure synchronization of user data across systems.

• Self-service portal to help tenant admins set up and test their own SCIM connections.

• SCIM is not supported for Identity Cloud.

• User lifecycle automation has to be custom-built on the general-purpose Entity API rather than an industry-standard provisioning protocol.