Start with requirements
List the number and types of users, identity provider, device policies, data sensitivity, and support needs. Include the teams that will operate the service: IT, security, legal, procurement, and the people doing the work.
Verify the controls
Ask for current documentation on single sign-on, provisioning, administrator roles, logging, retention, export, and data handling. Availability may depend on the agreement or plan. Request a demonstration or written confirmation for requirements that are critical to your decision.
Review the contract and exit
Examine service levels, support response commitments, data-processing terms, pricing, renewal conditions, and what happens on termination. A feature description does not replace the contract. Test an export or exit procedure where feasible before making it a dependency.
Build a proof-of-fit checklist
Choose a representative workflow and test it with the teams that will operate it. For example, verify the joining and departure process, a required administrator role, a data export, and the support escalation route. Record the plan, configuration, evidence date, and any limits. Ask legal and procurement to compare the tested behavior with the proposed agreement. A pilot should use appropriately classified data and have a defined end date.
Choose the next step
| Situation | What to check |
|---|---|
| A control is a hard requirement | Obtain written evidence and test it in the proposed configuration. |
| The pilot ends | Decide who owns data, access, and the next commercial step. |
| The contract is due for renewal | Review changes in needs, pricing, and exit provisions. |
A practical checklist
- Document user, security, and support requirements.
- Verify each required control and plan restriction.
- Review commercial and data-processing terms.
- Plan migration, administration, and exit.