Automated IAM for M&A success

Move SSO apps between identity tenants in hours, not months.

TenantFlex is the IdP-agnostic SaaS for migrating SAML and OAuth/OIDC application integrations between enterprise tenants. Discover, review and migrate in one workflow: less manual work, audited every step, so mergers, acquisitions and divestitures integrate faster. In production today, available as SaaS or deployed on-premises where data residency requires.

Request a demo See how it works

Microsoft Entra IDOktaPingOneadditional IdPs on request

In production · SaaS or on-premises

3Identity providers connected: Entra ID, Okta and PingOne — additional IdPs on request

2SSO protocols migrated end to end: SAML and OAuth/OIDC

1Workflow from pre-discovery to hand-off, across any IdP pair

0Other IdP-agnostic tenant-to-tenant tools on the market

The problem

Every deal comes with a tenant migration nobody budgeted for.

Identity is the first thing that has to work on Day 1 and the last thing that gets planned. Today that gap is filled by spreadsheets and consultants.

Customers

Migrating application integrations between tenants is a common and costly part of every merger, acquisition and divestiture.

Market gap

No IdP-agnostic tenant-to-tenant tool exists today for SSO-integrated applications. Vendor tooling only moves you toward that vendor.

Time constraints

Manual migrations are asynchronous and can take many engineer-hours per application, multiplied across hundreds of apps.

Financials

Many customers want to move because renewal costs at the incumbent IdP keep climbing, but the switching cost has kept them locked in.

The solution

One console for every tenant, every provider, every migration job.

Connect your source and target tenants, explore what is actually integrated, and run migrations with a full execution log. Multi-organisation by design, so advisers and integrators can work across clients.

TenantFlex create migration job screen with job configuration and application selection — **Migration jobs**Pick a source tenant and any connected destination — even the same provider — set the naming template and credential handling, then stage the selected applications for approval.

TenantFlex application review screen listing applications with their discovery assessment and migration status — **Application review**Browse every application and service principal in a connected tenant, see at a glance which carry standard or complex claims, and mark what is in scope before anything moves.

TenantFlex credential expiry screen listing signing certificates and client secrets with their end dates and status — **Credential expiry**Every signing certificate and client secret with an end date, across source tenants and migrated applications, soonest first. A nightly scan keeps the list current, and Scan refreshes it on demand.

Your tenant data, where you need it.The same product, two ways to run it.

SaaS

Hosted and operated by TenantFlex, in production today. Connect your tenants and start discovery the same day, with upgrades and new provider support delivered continuously.

Generally available

On-premises

The same production release, deployed inside your own environment for customers who need data residency or regulator-mandated control. Application metadata, credentials and migration logs never leave your network.

Generally available

How it works

Pre-discovery, review, migrate.

We support pre-discovery and migration of SSO apps for SAML and OAuth/OIDC between multiple IdPs. The workflow is the same whichever pair of providers you are moving between.

Discover

Connect a tenant and TenantFlex inventories its SSO integrations: SAML and OIDC apps, service principals, credentials and their expiry. You see what is really there, not what the CMDB says.

Review & approve

Pre-approve applications for migration, apply naming and configuration templates, and choose how credentials, certificates and IDs are handled on the target side.

Migrate & hand off

Run the job. Each app is recreated in the target tenant with a stage-by-stage execution log, then handed off to the application owner for cut-over.

Backup & DR cutover

Your identity provider is a single point of failure. Give it a standby.

When the IdP is down, compromised or mid-incident, every SSO application goes with it. TenantFlex keeps a current inventory of your integrations and can stage them in a second tenant at a different provider, so a cutover is a rehearsed job rather than a rebuild from memory.

A live backup of every SSO integrationContinuous discovery captures SAML and OIDC apps, service principals, certificates and claims configuration, exported as a restorable record rather than a screenshot in a runbook.
Warm standby at a second providerPre-stage in-scope applications in a standby tenant on Entra ID, Okta or PingOne, and keep them in sync as apps are added or credentials rotate.
Cutover measured in hoursFailover is a migration job you have already run in rehearsal: recreate, hand off to app owners, repoint. Failing back once the primary is healthy is the same job in reverse.
Evidence for resilience auditsRegulators in financial services now expect tested exit and recovery plans for critical ICT providers. Rehearsal logs and inventory exports give you something to show, not just a policy document.

TenantFlex backup screen listing captures per connection with their status and trigger — **Backup**Capture every SSO application a connection can see, on demand or on a schedule. Compare a capture with the tenant as it is now, and restore the fields that changed.

Access

Read-only to start. Nothing more until you need it.

Microsoft Entra ID

Step 1 · read applications Application.Read.All

Lists applications and service principals with their sign-on configuration, redirect URIs, assignments, certificates and secret expiry. The inventory, discovery reports and credential expiry run on this alone.

Only for the features you use optional

Claims on SAML enterprise applicationsPolicy.Read.All
Without it, a SAML application's claims are reported as unknown rather than as standard.
Conditional access that applies to an applicationPolicy.Read.ConditionalAccess
SCIM provisioning statusSynchronization.Read.All
When an application was last signed in toReports.Read.All
Migrating into this tenantApplication.ReadWrite.AllPolicy.ReadWrite.ApplicationConfiguration
Destination only: create the applications and attach their claim policies. A source tenant never needs either.

Okta

Step 1 · read applications okta.apps.read

Lists applications with their sign-on mode, SAML and OIDC configuration, assignments and signing certificates. The API client also needs an administrator role that can read applications.

Only for the features you use optional

The sign-on policy governing an applicationokta.policies.read
API scopes granted to OAuth applicationsokta.appGrants.read
Without it, an OAuth application's API permissions are reported as unknown.
When an application was last authenticated tookta.logs.read
Also needs an administrator role that can read the System Log.
Migrating into this orgokta.apps.manage
Destination only. A source org never needs it.

PingOne

Step 1 · read applications Configuration Read Only

PingOne gives a worker application a role rather than scopes. This role lists applications and reads their attribute mappings, which are PingOne's claim configuration, and cannot change anything.

Only for the features you use optional

Migrating into this environment, or restoring a backupClient Application Developer
Creates applications and writes their configuration back. A source environment never needs it.

Leave expensive renewals behind

The only reason to accept the renewal quote is that leaving looked harder.

Incumbent IdPs price on lock-in: hundreds of hand-built SSO integrations that nobody wants to recreate. TenantFlex takes that migration off the critical path, so the renewal becomes a commercial decision instead of a hostage negotiation.

Know the real cost of switching before you signPre-discovery gives you the exact count of SAML and OIDC apps, who owns them and what would move, in days rather than a consulting engagement.
Cut the per-app cost that made switching uneconomicAutomated recreation replaces the manual, asynchronous work that ran to many engineer-hours per application. The migration budget stops being the argument for staying put.
Move to the provider you already pay forMany organisations are licensed for a second IdP through an existing enterprise agreement. Consolidating onto it removes a whole renewal line, not just a discount.
Negotiate with a credible walk-awayA completed pilot migration and a scheduled cutover date change the tone of the renewal conversation, even if you ultimately decide to stay.

Commercials

Pay for the applications you move, or hand the whole thing to us.

A tenant migration is a project with a beginning and an end, so the platform is licensed the way the work actually lands rather than per seat.

Two ways to engage.Take the platform, or take the platform and the people.

Licensed per application

You license the platform by the applications in scope, not by user count or tenant size. Discovery is how you find out what that number is, so you can size the work before committing to it. SaaS or deployed in your own environment, the same release either way.

Self-service

White-glove migration

We run it with you. Discovery and scoping, the claim and policy decisions that genuinely need a human, a cutover plan per application, and the hand-off to each application owner. You get the platform and the practitioners who have done these migrations by hand.

With consultancy

Roadmap

Where the platform goes next.

Today we migrate SSO. Each step widens what a tenant move can carry with it, in the order customers have asked for it.

✓

In production

SSO migration

Pre-discovery and migration of SAML and OAuth/OIDC applications between Entra ID, Okta and PingOne, running in customer environments today.

Close the gap

SCIM discovery is in production: pre-discovery shows which applications provision users and how. SCIM migration is next, so provisioning moves with the app, not after it.

In progress

Security lifecycle

Certificate and secret expiry tracking across tenants is in production. Rotation follows, so a credential is renewed before it expires.

Planned

Governance

App consent and OAuth grant governance, so what was approved in the source is understood in the target.

Proven background

Built by the people who have done these migrations by hand.

Proven track record driving enterprise-grade IAM and federation architecture projects within highly regulated industries, with extensive experience designing robust B2B, B2C and B2E identity infrastructures for global market leaders.

Lee McGovernFounder

Andrew BryarsDirector, Business Development

Joshua BarnardCTO

Identity programmes delivered for

$TenantFlex$ Get started

Bring your next tenant migration to TenantFlex.

TenantFlex is in production today and available both as SaaS and as an on-premises deployment. Tell us the source and target providers, and which deployment suits your data residency requirements, and we will walk you through a live migration.

[email protected] · www.tenantflex.com