HelloID

HelloID is a cloud IDaaS platform that combines access management (SSO, MFA) with lifecycle automation and self-service. It supports OpenID Connect, OAuth 2.0, SAML 2.0 (plus WS-Federation and form/basic for legacy), offers FIDO2/WebAuthn, OTP, SMS/Email, and hardware token MFA, and exposes SCIM 2.0 inbound endpoints for provisioning from Microsoft Entra ID.

Key Capabilities

• Standards-based SSO: WS-Federation and form/basic methods are available for non-federated/legacy apps.

• MFA / Passkeys: End-users can enroll multiple second factors including FIDO2/WebAuthn security keys, OATH hardware tokens, authenticator apps, SMS, and email; admins control remember-MFA behavior and policies.

• Provisioning (HR-driven): The Provisioning module automates account lifecycle from a system of record into targets (e.g., AD, Google Workspace) via connectors; many target connectors leverage SCIM or app APIs.

• Inbound SCIM: Microsoft Entra ID can provision users and groups into HelloID via SCIM 2.0 using the built-in gallery app.

Limitations

• Advanced OAuth profiles: Public docs cover OIDC/OAuth basics; there’s not enough public information to confirm support for PAR, DPoP, mTLS/FAPI.

• SCIM scope (outbound): HelloID publishes many target connectors (some SCIM-based), but there’s no single, vendor-hosted catalog confirming native outbound SCIM provider endpoints for every target—evaluate per connector.

• Legacy methods: Form/basic replay and browser plugins exist for non-federated apps; these increase credential handling compared to modern federation and may require extra hardening.

• SaaS delivery (ops model): Hosted by the vendor; customers needing fully self-hosted IdP stacks should verify requirements or pair with on-prem components.