Back to Checks
vercel

Vercel team has SAML SSO enabled for centralized identity management

team_saml_sso_enabled
Service: teamSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundariesvercel-pro-plan
Resource Type:NotDefined

Vercel team is assessed for SAML single sign-on (SSO) enablement. SAML SSO enables centralized identity management through an external identity provider, ensuring consistent authentication policies across the organization.

Prowler logoProwlerprowler-provider-vercel

Risk

Without SAML SSO, team members authenticate using individual Vercel credentials that are not centrally managed. This increases the risk of credential sprawl, inconsistent password policies, and inability to enforce organization-wide authentication controls such as MFA.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks team_saml_sso_enabled

Recommendation

Enable SAML SSO for the Vercel team to centralize authentication through your organization's identity provider. This ensures consistent security policies, simplifies user lifecycle management, and enables enforcement of MFA and other access controls.

Remediation

Other

1Navigate to your Vercel team settings
2Go to the Security section
3Configure SAML SSO with your identity provider (Okta, Azure AD, etc.)
4Complete the SAML connection setup and verify it is linked

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.team.team_client import team_client


class team_saml_sso_enabled(Check):
    """Check if SAML SSO is enabled for the Vercel team.

    This class verifies whether the Vercel team has SAML single sign-on
    configured and enabled for centralized identity management.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Team SAML SSO Enabled check.

        Iterates over all teams and checks if SAML SSO is enabled.

        Returns:
            List[CheckReportVercel]: A list of reports for each team.
        """
        findings = []
        for team in team_client.teams.values():
            report = CheckReportVercel(
                metadata=self.metadata(),
                resource=team,
                resource_name=team.name,
                resource_id=team.id,
            )

            if team.saml and team.saml.status == "enabled":
                report.status = "PASS"
                report.status_extended = (
                    f"Team {team.name} has SAML SSO enabled"
                    f"{f' via {team.saml.provider}' if team.saml.provider else ''}."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Team {team.name} does not have SAML SSO enabled."
                    f"{plan_reason_suffix(team.billing_plan, {'hobby'}, 'SAML SSO is not available on the Vercel Hobby plan.')}"
                )

            findings.append(report)

        return findings

References