Enterprise SaaS: what changes when you sell to large companies

A company with thousands of employees wants your product, and its first email is not about features. It asks for a SOC 2 report, single sign-on, automatic user provisioning, a data processing agreement and a long security questionnaire. You have to decide whether your SaaS is ready for that buyer, and what it will cost you to get there.

Enterprise SaaS is software sold as a service to large organizations, on their terms: identity managed by their systems, security proven by independent audits, contracts negotiated by lawyers and invoices paid through procurement. The product can be the same one small teams use. What changes is everything around it. If SaaS itself is new to you, start with What is SaaS?.

Enterprise SaaS in plain terms

Think of a sandwich shop. Selling a sandwich to someone walking past takes a menu and a card reader. Catering for a hospital takes the same sandwiches plus allergen sheets, a health inspection certificate, a supplier contract, insurance papers and invoices sent to accounts payable on 60-day terms. The food did not change. The proof did.

Enterprise buyers ask for proof in five areas. Identity: their staff log in with the company account. Security evidence: an outside auditor has checked your controls. Data: they know where it is stored. Contracts: liability, privacy and termination are written down. Procurement: you can be paid by purchase order.

What enterprise buyers ask for

The table maps each common request to what it means and what evidence closes it. It is assembled from the standards and vendor documentation cited in each row.

Request	What it means	Evidence the buyer accepts
Single sign-on (SAML or OpenID Connect)	Staff sign in through the company identity provider, and access ends when HR closes the account	A working connection tested with their identity provider
User provisioning (SCIM)	Accounts are created, updated and removed automatically from the company directory	Support for SCIM, the protocol published as RFC 7644 in September 2015 (RFC 7644)
SOC 2 Type 2 report	An independent CPA firm tested your controls over a period of time	The report itself, plus bridge letters for months after the period
Audit logs	A record of who did what, and when, inside the product	Log export or an API to their security tools
Data residency	Customer data stays in a chosen region	Documented regions and replication rules
Contract and privacy terms	Master agreement, data processing agreement, liability limits	Signed documents after legal review
Procurement	Supplier registration, purchase orders, invoice terms	Your company set up as a vendor in their system

Single sign-on is often the first gate. Some vendors place it only on their top plan. GitHub, for example, lists SAML single sign-on on its Enterprise plan card and not on Team (GitHub pricing, as of October 2026). For you as a buyer, that pattern means a security requirement can move the whole company to a higher tier. For you as a seller, it is a deliberate line between small-team and enterprise pricing, as described in SaaS pricing models.

How a SOC 2 Type 2 report works

SOC 2 is an attestation framework from the American Institute of Certified Public Accountants (AICPA). Microsoft’s compliance documentation explains the two types clearly (Microsoft Learn, SOC 2 Type 2). A Type 2 report evaluates whether controls were designed appropriately and “were operating effectively over a specified time period”. Type 1 audits, the same page says, “don’t look back over a period of performance”. A buyer who wants evidence over time asks for Type 2.

The categories covered are Security, Availability, Processing Integrity, Confidentiality and Privacy. Microsoft’s own Office 365 audit runs on a 12-month period from October 1 to September 30. Reports usually arrive a few months after the period ends, and Microsoft issues quarterly bridge letters, which are its own statements rather than audits, to cover the gap.

Example: the timing a buyer sees, using that October-to-September period.

• A buyer reviews you on August 15, 2026.
• Your latest Type 2 report covers October 1, 2024 to September 30, 2025.
• Time between the end of that period and the review: 10.5 months.
• Bridge letters for the quarters ending December, March and June cover the months since.

A buyer sees nearly a year that no auditor has tested yet. Expect the question, and have the bridge letters ready. Microsoft’s page also points buyers to the “User Entity Responsibilities” at the end of its reports. These are the controls the customer must run for the system to meet the standard. Look for the same section in every vendor report you receive. For a related standard with cloud-specific controls, see ISO/IEC 27017 explained.

Data residency follows the same logic of documented commitments. Microsoft’s page states that most Office 365 services let customers choose the region where data is stored, and that Microsoft will not replicate customer data outside the chosen geographic area.

The revenue math of one large customer

Example: a labeled hypothetical. You sell a $15 per seat per month product to 50 small companies with 20 seats each. Then one enterprise signs for 2,000 seats at a negotiated $12.

• Small-company ARR: 50 x 20 x $15 x 12 = $180,000.
• Enterprise ARR: 2,000 x $12 x 12 = $288,000.
• Total ARR: $180,000 + $288,000 = $468,000.
• Enterprise share of ARR: $288,000 / $468,000 = 61.5%.
• If that one customer leaves at renewal, ARR falls back to $180,000, a drop of 61.5%.

One contract more than doubled the company’s recurring revenue. It also made the company depend on one renewal decision. That is the trade of enterprise SaaS. Bigger contracts bring longer sales cycles, security reviews, custom terms and concentration risk. For how public SaaS companies report revenue at scale, see What is a SaaS company?.

How the sale changes

Selling to a small team often ends with a credit card on a pricing page. An enterprise sale has more people in the room, and each can stop it:

1. The champion: the team lead who wants your product.
2. The economic buyer: the executive who owns the budget.
3. Security: reviews your SOC 2 report, questionnaire answers and architecture.
4. Legal: negotiates the master agreement and data processing terms.
5. Procurement: compares vendors, registers you as a supplier and issues the purchase order.

Each step takes time, and the steps rarely run in parallel unless you push for it. Send the security package with the first proposal, not after the champion says yes.

Common mistakes

1. Treating single sign-on as a later feature. Without it, many large buyers cannot even start a trial under their own rules. Why it happens: small customers never ask for it. Instead: support SAML or OpenID Connect and SCIM before you chase large accounts.
2. Starting the SOC 2 audit when a buyer asks for it. A Type 2 report needs a period of operation before it exists, so it cannot be produced in a week. Why it happens: the request arrives with a deadline. Instead: start the observation period early, and offer a Type 1 report and bridge letters while it runs.
3. Signing the enterprise’s paper without reading the liability clause. Uncapped liability or unlimited data breach costs can exceed the contract value many times. Why it happens: the deal feels close and the template looks standard. Instead: have counsel review limits of liability, indemnities and termination rights.
4. Letting one customer become most of the business. In the example, one contract is 61.5% of ARR. Why it happens: the large deal is easier to celebrate than to plan around. Instead: keep selling to smaller customers and negotiate multi-year terms with the large one.

Sources

• Microsoft Learn, SOC 2 Type 2, checked October 2026.
• IETF, RFC 7644: System for Cross-domain Identity Management: Protocol, September 2015.
• GitHub, Pricing, checked October 2026.

In three sentences

Enterprise SaaS is the same product sold with proof: single sign-on and SCIM provisioning, a SOC 2 Type 2 report, documented data residency, negotiated contracts and procurement-friendly billing. In the example, one 2,000-seat contract at $12 a month adds $288,000 of ARR and becomes 61.5% of the company’s revenue, with matching concentration risk. Build identity and audit evidence before you chase large accounts, send the security package early and keep every contract within limits you can survive.