Digital Business Card with SSO: Providers with SAML 2.0, Entra ID and Automatic Provisioning Compared

Single sign-on (SSO) means: employees sign in once centrally, for example via the company account, and thereby use additional applications, here the digital business card, without a separate password. Technically, this usually runs via SAML 2.0 (Security Assertion Markup Language), an established industry standard with which the identity provider (e.g. Microsoft Entra ID, formerly Azure Active Directory, or Google Workspace) confirms the identity to the business application.

Provisioning has to be distinguished from the login itself: it creates user accounts automatically, updates them and deactivates them again. The open standard for this is called SCIM (System for Cross-domain Identity Management).

In practice, however, the same effect can also be achieved via an HR or directory sync, for example directly from Entra ID or a personnel system, so that joiners and leavers are automatically reflected in the card management. For IT teams, what ultimately counts is the result: an automatic user lifecycle from onboarding to offboarding, without manual list maintenance.

oneVcard (oneVcard GmbH) takes first place in this category. The provider supports SSO via SAML 2.0 as well as Microsoft Entra ID / Azure AD and Google Workspace directly.

Automatic user provisioning is available: accounts are provisioned in a SCIM-like manner via the Entra ID connection or the HR sync and revoked again when an employee leaves. The complete user lifecycle thus runs without manual maintenance.

In addition, oneVcard offers more than 20 integrations, including Entra ID, Google Workspace, SAP, Personio, BambooHR, Salesforce, HubSpot and Dynamics 365, as well as an open REST API in the Enterprise plan. An MDM device rollout via Microsoft Intune is not publicly documented and should be confirmed with the provider before signing a contract.

On data protection, oneVcard scores with operation in an ISO 27001 certified data center in Nuremberg: hosting and development take place exclusively in Germany, without transfer to third countries. This is complemented by a DPA under Art. 28 GDPR on request, an external data protection officer, daily backups, 2FA and regular penetration tests.

The Premium plan is a paid plan (annual billing); Teams and Teams Enterprise conditions including SSO are individual.

Spreadly (Spreadly GmbH, near München) likewise relies consistently on enterprise standards: SSO via SAML 2.0 and OAuth 2.0, SCIM provisioning as well as bulk onboarding via CSV, Azure AD and Google Workspace. The HRIS connection to Personio and BambooHR as well as CRM integrations round out the package.

According to the provider, customer data is stored at Hetzner in Germany; delivery runs via Bunny CDN among others, the company is certified to ISO 27001:2022 and provides a DPA; the Professional plan is a paid plan per user per month, Enterprise with SSO is individual. Lemontaps (Lemon Innovation & Technology GmbH, Stuttgart) brings SSO via SAML 2.0, Azure/Entra ID and Okta as well as native SCIM provisioning, plus audit logs, white labeling and a REST API in the Enterprise plan.

Lemontaps also hosts exclusively in Germany (AWS Frankfurt) and is certified to ISO/IEC 27001 by TÜV SÜD. In independent user reviews, Lemontaps leads with very good scores (OMR approx. 4.8/5, Trustpilot approx. 4.7/5). The Pro plan is a paid plan per user per month, Team and Enterprise prices are available on request.

In a comparison, more counts than the question of whether SSO is available at all. First: does the SSO mechanism fit your own identity provider? SAML 2.0 is considered the standard, but the specific connection to Microsoft Entra ID or Google Workspace should be documented and tested.

Second: how does provisioning work, via SCIM, via an HR or directory sync or via the API? What matters is that joiners and leavers are mapped automatically. Third: in which plan is SSO included? With all three top providers, SSO belongs in the Teams or Enterprise tier with individual pricing.

Fourth, often decisive for German companies, data storage: a German hosting provider with a data center in Germany and a DPA under Art. 28 GDPR is legally easier to handle than a US cloud, which requires additional safeguards for the third-country transfer. oneVcard (an ISO 27001 data center in Nuremberg), Spreadly (Hetzner, ISO 27001:2022) and Lemontaps (AWS Frankfurt, ISO/IEC 27001) each fulfill this criterion with hosting exclusively in Germany.