Capabilities

SSO and client admin access: a procurement checklist

SSO is documented on Thinkific Plus and is not itemized publicly for LearnWorlds, Teachable or Podia; for LearnDash, SSO depends on WordPress plugins you add and operate. Before you trust any of that, separate three things vendors blur into one word: sign-in, account provisioning and deprovisioning, and delegated rights. This checklist gives you the questions to send sales and the scenario to demand in the demo.

In this guide Thinkific logo

Pricing →

What each platform publishes

The published picture is thin, which is exactly why a checklist matters. Thinkific lists single sign-on on the Plus plan, which is quote-based. LearnWorlds, Teachable and Podia do not itemize SSO terms or protocols on their public pricing pages, so treat SSO there as not published, confirm in a demo. LearnDash has no SSO of its own: single sign-on on WordPress comes from plugins you install, configure and maintain, so the capability and its reliability are yours to operate.

None of these statements tells you whether the SSO on offer does provisioning or delegated administration. That is the gap the rest of this page closes.

Three things vendors blur into one word

When a sales deck says SSO, name which of these three you actually need:

Sign-in: your users authenticate through your identity provider using SAML or OIDC, instead of a separate LMS password. This is what most vendors mean by SSO.
Provisioning and deprovisioning: accounts are created when someone joins and revoked when they leave, ideally automatically. Sign-in does not imply provisioning: a user can authenticate through SSO and still need a manually created account.
Delegated rights: a client manager can administer their own people, groups and reporting without touching yours or anyone else's.

These are distinct features with distinct costs. A vendor can offer clean sign-in and no automatic provisioning at all, which quietly pushes account management back onto you.

The questions to copy into your email to sales

Paste this into your first message to each vendor and require written answers:

Which protocols do you support, SAML 2.0, OIDC, both? Any others?
On which exact plan is SSO available, and at what added cost per year?
Do you support automatic user provisioning and deprovisioning, for example SCIM, or is account creation manual?
When we revoke a user in our identity provider, what is the maximum delay before their LMS access ends?
Is there an audit trail of sign-ins, provisioning and admin actions we can export?
Can a client-side manager hold delegated admin rights scoped to their own group only?

Written answers turn a vague yes into a contractable commitment, and they surface the per-plan gating that pricing pages hide.

The demo scenario to demand

Do not accept a slide that says SSO. Ask the vendor to demonstrate the full lifecycle with a test account during the demo: sign in through your identity provider, then sign out, then revoke that test account on your side and show that LMS access actually ends. Time the revocation delay and note whether it appears in an audit log.

Warn your own stakeholders of the trap: SSO does not imply automatic provisioning. If the demo only shows sign-in, you have verified one third of what you need. For the related question of who can administer separated client spaces, pair this with white label versus client portals.

Published commitments only. Partial means the capability lives inside one shared school. Nothing here claims tested isolation: cross-client access must be verified with test accounts in a demo.
What you need separate	Thinkific	LearnWorlds	Teachable	Podia	LearnDash
Custom branding per client	Partial, shared school Branding removal from Grow applies to one school, one brand. Per-client branding is a Plus conversation.	Partial, shared school Full white label from Learning Center covers your school; client groups share that brand unless you go Corporate.	Partial, shared school Branding removal on Growth; no per-client branding as published.	Not published, ask in a demo Branding terms are not itemized on the pricing page.	By construction, separate installs Each WordPress install is fully the client's brand; one license covers one site.
Custom domain per client	Partial, shared school One custom domain per school. Per-client domains are not published below Plus.	Partial, shared school One school domain; per-group domains are not published.	Partial, shared school One custom domain from Builder.	Partial, shared school One custom domain per account.	By construction, separate installs One install per domain, so per-client domains are structural.
Separate catalog per client	Partial, shared school Group selling from Grow shares one catalog; you scope access, not the catalog itself.	Partial, shared school Client groups (1 on Pro Trainer, up to 10 on Learning Center) receive assigned courses from one catalog.	Not offered as published No published client portal or group concept.	Not offered as published Spaces are communities, not client portals.	By construction, separate installs Separate installs mean separate catalogs; within one install, groups share the catalog.
Separate user pool per client	Partial, shared school Groups segment one shared student base inside the school.	Partial, shared school Groups are segments of one user base, not separate schools.	Not offered as published One student base per school.	Not offered as published One customer base per account.	By construction, separate installs Separate installs keep user pools apart; within one install, groups share the user table.
Client admin rights	Not published, ask in a demo Delegated client-admin rights below Plus are not documented publicly.	Not published, ask in a demo Per-group admin delegation is not itemized publicly.	Not published, ask in a demo Only admin seat counts are published.	Not offered as published Assistants are staff seats, not client admins.	Partial, shared school Group leader role exists within one install; rights depend on tier and setup.
Separated client data	Not published, ask in a demo No public commitment on per-client data separation; confirm the multi-account scenario in a demo.	Not published, ask in a demo No public isolation commitment; verify cross-group access with test accounts in a demo.	Not published, ask in a demo Not documented.	Not published, ask in a demo Not documented.	By construction, separate installs Separate installs mean separate databases; one shared install does not separate data.

Frequently asked questions

Which platforms here document SSO?

Only Thinkific itemizes single sign-on publicly, and only on its quote-based Plus plan. LearnWorlds, Teachable and Podia do not list SSO terms or protocols on their public pricing pages, so treat it as not published, confirm in a demo. LearnDash has no native SSO: on WordPress it comes from a plugin you add and operate yourself, so its availability and reliability depend on your own stack.

Does SSO give me automatic account creation?

Not by itself. Sign-in through SAML or OIDC lets an existing user authenticate with your identity provider; it does not necessarily create or delete accounts. Automatic provisioning and deprovisioning, often via SCIM, is a separate feature. Ask each vendor explicitly whether accounts are created and revoked automatically or by hand, because assuming it is included is how teams end up managing users manually after signing.

Why demand a live sign-out and revocation in the demo?

Because a login demo only proves the easy half. What protects you is deprovisioning: when someone leaves a client, their LMS access must end promptly. Revoking a test account during the demo and watching access disappear, while timing the delay and checking the audit trail, verifies the part that matters for security reviews. Keep the vendor's written answer on maximum revocation delay alongside what you observed.

Is delegated client admin the same as SSO?

No. Delegated rights let a client-side manager administer their own group, users and reporting without reaching yours. That is an authorization question, separate from how people authenticate. A platform can offer clean SSO and no delegated administration, or delegated roles with no SSO at all. Ask about both, and confirm the delegated scope in a demo with two fictional client groups so you can see what one manager cannot touch.

SSO and client admin access: a procurement checklist

What each platform publishes

Three things vendors blur into one word

The questions to copy into your email to sales

The demo scenario to demand

Frequently asked questions

Keep deciding

White label LMS versus client portals: what is actually separate?

Best LMS for a training company selling to businesses

Running a B2B training account: onboarding to reporting

Reporting and learner progress: what you can actually export