38 of 67 SSO Brands Appear in Only One AI Engine. Microsoft and Okta Appear in All Four.

38 of 67 SSO Brands Appear in Only One AI Engine. Microsoft and Okta Appear in All Four.

An IT manager at a mid-size company has had enough. Every employee has a separate login for every SaaS app, the help desk spends hours each week on password resets, and offboarding a leaver means visiting a dozen admin consoles. So the manager opens an AI engine and describes the problem in plain words. The engine answers with a category name, single sign-on, and a short list of vendors, each with a sentence on SAML, SCIM and MFA.

That list is the shortlist. Whichever vendors are on it get a demo request. Whichever vendors are missing are not in the conversation, and nobody at that company ever knew they were options.

We wanted to know how stable that list is. If the manager had asked a different AI engine, would the answer have named the same vendors? We measured it across four engines and four markets at once.

Key Takeaways

• Microsoft and Okta together took 37.8% of all 934,000 brand mentions. Microsoft was the most-mentioned brand and Okta the second in every engine and every market.
• Below those two, the shortlist splits. Of 67 brand entities recorded, 12 appear in all four engines and 38 appear in only one.
• Vendor sites supply 82.4% of ChatGPT’s cited sources but 14.1% of Google AI Overview’s. No two engines share more than 0.24 of the domains they cite.
• ChatGPT most often names Microsoft Entra ID first. Gemini, Google AI Overview and Google AI Mode most often name Okta first.
• OneLogin is a measurement trap: 3,000 brand mentions, but 124,000 product mentions across three product entries.

How We Ran the Study

We issued 10,000 buyer-intent queries about enterprise single sign-on and workforce access management to four AI engines: ChatGPT, Gemini, Google AI Overview and Google AI Mode. Every query ran in the United States, Canada, India and Germany during October 2026, giving 40,000 responses per engine and 160,000 in total.

The query set is built from five core questions, each with paraphrase variants. The first is the headline buyer question, “Best enterprise single sign-on (SSO) solutions in 2026”. The other four come at the same need from different directions: protocol and provisioning requirements, rolling out across hundreds of SaaS apps without a dedicated identity team, the per-app-login problem described above without ever naming the category, and passwordless login with phishing-resistant MFA.

For each response we recorded its length, every page it cited and what kind of site that page sits on, whether each cited page still resolved, every brand and product it named, and the ordinal position at which each brand first appeared. The corpus held 1,094,000 cited sources, 934,000 brand mentions across 67 brand entities, and 871,000 product mentions across 86 product entries. The counting method is the one we describe in how to measure AI share of voice across engines.

Two limits apply. The engines are commercial services with no version pinning, so a repeat run would not return identical text. The query set is purposive rather than a random sample of real buyer queries. We report descriptive statistics only and make no significance claims. GrackerAI sells AI search visibility measurement for categories including this one; no vendor paid for, requested or reviewed any part of this study. The full method, every table and the validity discussion are in the complete benchmark report.

Two Vendors Hold the Head of the Category

The top of the enterprise SSO shortlist is not in dispute. Microsoft recorded 204,000 mentions, 21.8% of the total. Okta recorded 149,000, or 16.0%. Together they hold 37.8% of every brand mention in the corpus, and the order never changes: Microsoft is the most-mentioned brand in each of the four engines, and Okta is second in each.

The next three are JumpCloud at 108,000 mentions, Google at 97,000 and Ping Identity at 90,000. After them the counts fall away fast. CyberArk, sixth, recorded 36,000, less than a fifth of Microsoft’s total.

Brand	Total mentions	Share	ChatGPT	Gemini	AI Overview	AI Mode
Microsoft	204,000	21.8%	48,000	54,000	52,000	50,000
Okta	149,000	16.0%	35,000	39,000	36,000	39,000
JumpCloud	108,000	11.6%	32,000	26,000	21,000	29,000
Google	97,000	10.4%	20,000	26,000	21,000	30,000
Ping Identity	90,000	9.6%	18,000	24,000	23,000	25,000
CyberArk	36,000	3.9%	12,000	11,000	2,000	11,000
Cisco	26,000	2.8%	17,000	5,000	1,000	3,000
Rippling	20,000	2.1%	6,000	6,000	3,000	5,000
Slack	19,000	2.0%	6,000	6,000	2,000	5,000
Salesforce	17,000	1.8%	6,000	6,000	2,000	3,000

The ten brands in that table account for 766,000 mentions, 82.0% of the total. Two of them, Slack and Salesforce, are not access management vendors at all. They most likely appear because the engines name the SaaS apps an SSO rollout has to connect, which is a reminder that a brand count in this category is partly a count of integration targets.

The engines also differ in how they treat individual vendors. CyberArk records 12,000, 11,000 and 11,000 mentions in ChatGPT, Gemini and Google AI Mode, and only 2,000 in Google AI Overview. Cisco records 17,000 mentions in ChatGPT and 1,000 in Google AI Overview. A vendor tracking its visibility in one of those engines would draw a very different conclusion from one tracking the other.

Below the Head, Each Engine Builds Its Own List

The headline finding of this study sits in the long tail. The engines recorded 67 distinct brand entities between them. Only 12 of those appear in all four engines: Microsoft, Okta, JumpCloud, Google, Ping Identity, CyberArk, Cisco, Rippling, Slack, Salesforce, GitHub and Workday. Eight appear in three engines, nine in two, and 38 in only one.

Put plainly, more than half of all the brand entities recorded in this category are named by one engine only. Fifty of the 67 entities record 5,000 mentions or fewer, and 27 record the minimum of 1,000.

Gemini has the widest and most individual list. It names 37 brand entities, the most of the four, and 14 that no other engine names. ChatGPT is the narrowest: 24 entities, nine of them its own. Google AI Mode names 34 with eight of its own, and Google AI Overview 33 with seven.

AI engine	Brand entities named	Named by this engine only	Brand mentions per response
ChatGPT	24	9	5.83
Gemini	37	14	6.45
Google AI Overview	33	7	5.08
Google AI Mode	34	8	6.00

The single-engine names are mostly the smaller identity vendors that a mid-size buyer might genuinely want to evaluate. SecureAuth, Secret Double Octopus, PropelAuth, Entrust and 1Kosmos are named only by Gemini. OLOID is named only by Google AI Overview. Descope and Stytch are named only by Google AI Mode. SailPoint, one of the best-known names in identity governance, records the minimum of 1,000 mentions, all of them in ChatGPT.

Our finding: For a challenger identity vendor, “are we visible in AI engines?” has no single answer. In this category the most likely outcome for a vendor outside the top six is to be named by one engine and absent from the other three. The engine a buyer happens to open decides whether that vendor is on the list.

OneLogin: 3,000 Brand Mentions, 124,000 Product Mentions

The study recorded brands and products in separate fields, and in most cases the two tell the same story. OneLogin is the exception, and it is worth understanding before anyone builds a dashboard on brand counts alone.

At brand level, OneLogin is a minor name: 3,000 mentions, all of them in Google AI Mode. At product level it is the second-most-mentioned entry in the whole study. The product entry “OneLogin” alone recorded 115,000 mentions in all four engines and all four markets, behind only Microsoft Entra ID at 147,000. Across its three product entries, OneLogin records 124,000 product mentions.

The likely mechanism is simple. When an engine writes “OneLogin” as the name of a product in a list, it is counted as a product; when it writes about the company, it is counted as a brand. The engines mostly do the former. A vendor that reads only its brand-level number would conclude it is nearly invisible when it is, in fact, one of the most-named products in the category.

The product ranking shows the rest of the field:

Product	Brand	Mentions	Mean rank	Mean sentiment
Microsoft Entra ID	Microsoft	147,000	1.6	0.65
OneLogin	OneLogin	115,000	4.0	0.57
JumpCloud	JumpCloud	103,000	3.9	0.58
Okta Workforce Identity Cloud	Okta	102,000	1.6	0.75
Okta	Okta	39,000	2.4	0.46
Google Workspace	Google	26,000	3.1	0.30
Cisco Duo	Cisco	26,000	4.3	0.58
PingOne for Workforce	Ping Identity	25,000	3.1	0.70

Microsoft Entra ID and Okta Workforce Identity Cloud share the earliest mean rank among the 18 products with 10,000 or more mentions, at 1.6. Okta Workforce Identity Cloud also records the most favourable mean sentiment among those 18, at 0.75. OneLogin and JumpCloud are named often but further down the list, at mean ranks of 4.0 and 3.9.

Product naming is also badly fragmented. The 86 product entries include nine separate entries each for Okta and Ping Identity, six each for Microsoft and Google, and four for JumpCloud. “Okta Workforce Identity Cloud”, “Okta Identity Cloud”, “Okta Workforce Identity Cloud (WIC)” and plain “Okta” are recorded as different products, because that is how the engines wrote them. Ping Identity is spread across names such as “PingOne for Workforce”, “PingFederate”, “Ping Identity (PingFederate / PingOne)” and “Ping Identity (PingOne / PingFederate)”. Every one of those variants splits a vendor’s product-level count.

The Engines Read Different Evidence

The four engines agree on the vendors at the top. They do not agree on what to read before naming them.

ChatGPT draws 82.4% of its cited sources from vendor sites. Its single most-cited domain is Microsoft’s own documentation, which supplies 81,000 of its 306,000 sources, 26.5%, the highest single-domain share recorded in the study. Its second and third most-cited domains are Okta’s and JumpCloud’s own sites. ChatGPT’s evidence base is narrow as well as vendor-heavy: 29 distinct domains across all its responses.

Google AI Overview sits at the other end. Vendor sites supply 14.1% of its cited sources. It cites 495,000 sources from 167 distinct domains, more of both than any other engine, and its most-cited domain is a professional social network. Google AI Overview accounts for 52,000 of the study’s 55,000 social citations and 34,000 of its 39,000 forum citations. A major community forum is its third most-cited domain.

Google AI Mode (44.3%) and Gemini (34.4%) fall between the two. Both, along with Google AI Overview, rank the same identity education site among their three most-cited domains. Gemini cites the least overall, 90,000 sources across 40,000 responses, and its second most-cited domain belongs to OLOID, a vendor Gemini itself never names as a brand.

Source type	ChatGPT	Gemini	AI Overview	AI Mode	Total	Share
Vendor site	252,000	31,000	70,000	90,000	443,000	40.5%
Other	29,000	53,000	317,000	99,000	498,000	45.5%
Social	0	0	52,000	3,000	55,000	5.0%
Forum	1,000	0	34,000	4,000	39,000	3.6%
Review aggregator	6,000	6,000	13,000	3,000	28,000	2.6%
Government	18,000	0	3,000	0	21,000	1.9%

Government sources are almost entirely a ChatGPT habit: 18,000 of the 21,000 government citations come from it. That fits what ChatGPT says, too. It is the only engine that frames phishing-resistant MFA around NIST and CISA guidance, with 4,000 NIST mentions and 3,000 CISA mentions in the corpus.

The overlap numbers confirm how separate these evidence bases are. Measured as a Jaccard coefficient, where 0 means two engines cite no domains in common and 1 means they cite identical sets, the six engine pairs range from 0.05 to 0.24, with a mean of 0.14.

	ChatGPT	Gemini	Google AI Mode	Google AI Overview
ChatGPT	1.00	0.05	0.19	0.07
Gemini	0.05	1.00	0.20	0.11
Google AI Mode	0.19	0.20	1.00	0.24
Google AI Overview	0.07	0.11	0.24	1.00

ChatGPT and Gemini, at 0.05, barely read the same web at all. Google AI Mode is the closest neighbour of each of the other three engines, which makes it the most “average” reader of the four.

Our finding: The engines reach almost the same top five from almost entirely different evidence. That is good news for Microsoft and Okta, whose position survives any evidence base, and difficult news for everyone else: a page that moves ChatGPT, which reads vendor documentation, may do nothing at all for Google AI Overview, which reads social networks and forums.

Who Gets Named First Depends on the Engine and the Measure

Being on the list is the first problem. Being named first is the second, because a reader meets the first vendor before the others.

ChatGPT most often opens its response with Microsoft Entra ID. Gemini, Google AI Overview and Google AI Mode most often open with Okta. But the mean ordinal position tells a slightly different story.

Microsoft holds the earlier mean position in three of the four engines: ChatGPT (1.5 against Okta’s 1.7), Gemini (1.6 against 2.3) and Google AI Mode (1.8 against 2.2). Only in Google AI Overview is Okta earlier, at 1.5 against Microsoft’s 1.7.

That means two engines, Gemini and Google AI Mode, open most often with Okta and yet place Microsoft earlier on average. The two measures are answering different questions. The modal first mention counts only the brand that opens each response. The mean position averages over every response that names the brand. Okta can open more responses than Microsoft and still average later if, in the responses it does not open, it sits further down the list.

Whichever measure you use, no vendor other than Microsoft or Okta holds the earliest mean position in any engine. Below the two leaders, positions spread out. Google ranges from 2.7 in Google AI Overview to 5.6 in ChatGPT, and JumpCloud from 3.2 in Google AI Mode to 4.4 in ChatGPT. Ping Identity (3.0 to 3.2) and CyberArk (4.0 to 4.2) are the most consistent: each engine places them in roughly the same slot.

The Four Engines Write Different Kinds of Answer

The response shapes differ as much as the evidence. ChatGPT writes the longest responses, at a mean of 519.5 words, and Google AI Overview the shortest, at 276.5. Gemini averages 363.8 words and Google AI Mode 281.8.

ChatGPT and Gemini also leave more responses apparently unfinished. Suspected truncation, a response that does not end with a sentence-closing mark, appears in 31% of ChatGPT’s responses and 25% of Gemini’s, and in none from the two Google surfaces. No engine refused a query. Hedging is low throughout, from 0% in Google AI Mode to 7% in Gemini.

Each engine also adds something the others do not. Gemini places YubiKey and miniOrange among its primary options in several US and India responses, and several of its responses make product claims with no citations attached. Google AI Overview names password managers as complements to SSO; we saw the same vendors lead our enterprise password manager benchmark. Google AI Mode links to its own parent ecosystem in 4,000 of its 40,000 responses.

What every engine shares is the evaluation frame. All four judge the category on centralised SSO, automated SCIM provisioning, SAML and OIDC federation, and adaptive or phishing-resistant MFA. The criteria are settled. The disagreement is about which vendors meet them and what evidence proves it.

Nothing Changes by Country at the Top

Microsoft is first and Okta second in all four markets. The same five brands hold the first five places everywhere, in one of two orders: JumpCloud, Ping Identity and Google in the United States and India, and Google, JumpCloud and Ping Identity in Canada and Germany.

Market	First	Second	Third	Fourth	Fifth
United States	Microsoft	Okta	JumpCloud	Ping Identity	Google
Canada	Microsoft	Okta	Google	JumpCloud	Ping Identity
India	Microsoft	Okta	JumpCloud	Ping Identity	Google
Germany	Microsoft	Okta	Google	JumpCloud	Ping Identity

Mean sentiment moves only from 0.45 in Canada and Germany to 0.49 in India. The variation is in the tail: 39 of the 86 product entries appear in a single market, and the number of distinct products observed per market ranges from 41 in India to 49 in the United States and Canada.

What Vendors Should Do With This

Measure every engine, or you are measuring a guess. With 38 of 67 brand entities named by one engine only, a vendor that checks ChatGPT and finds itself missing may be on Gemini’s list, and the reverse. A single-engine check can mislead in either direction.

Read product-level numbers as well as brand-level ones. OneLogin’s 3,000 brand mentions against 124,000 product mentions is the clearest case in this study of a dashboard telling a vendor the wrong story. Check how the engines actually write your name.

Pick one product name and use it everywhere. Okta and Ping Identity are each split across nine product entries. Engines repeat the names they find. If your own pages, release notes and partner listings use one consistent product name, the engines have less reason to invent variants.

Keep documentation current for the engines that read it. ChatGPT draws 82.4% of its evidence from vendor sites and 26.5% from a single vendor’s documentation. Setup guides, protocol support pages and SCIM provisioning docs are what it reads. Stale or vague docs are a direct visibility cost there.

Earn third-party coverage for the engines that read beyond you. Google AI Overview takes only 14.1% of its sources from vendor sites and draws heavily on professional social networks and forums. What practitioners write about your product on those platforms is what that engine sees.

State capability in the shared criteria. Every engine evaluates SSO on SCIM provisioning, SAML and OIDC federation, and phishing-resistant MFA. A page that says plainly which of those you support, and how, gives every engine the same extractable facts. The broader identity and access management vocabulary matters less than those four terms.

Do not spend on market-specific versions at the head. The top five are the same in all four markets. Localisation is more likely to matter for vendors in the tail, where 39 product entries appear in one market only.

Frequently Asked Questions

Which enterprise SSO vendor do AI engines mention most?

Microsoft, with 204,000 of 934,000 brand mentions (21.8%), followed by Okta with 149,000 (16.0%). Microsoft is the most-mentioned brand and Okta the second in all four AI engines and all four markets studied.

Which SSO vendor do AI engines name first?

It depends on the engine. ChatGPT most often opens with Microsoft Entra ID; Gemini, Google AI Overview and Google AI Mode most often open with Okta. On mean ordinal position, Microsoft is earlier in three engines and Okta in Google AI Overview.

How many AI responses did this SSO study analyze?

160,000 responses, from 10,000 buyer-intent queries issued to ChatGPT, Gemini, Google AI Overview and Google AI Mode across the United States, Canada, India and Germany in October 2026. The corpus contained 1,094,000 cited sources and 86 product entries.

Do AI engines agree on which SSO vendors to recommend?

At the top, yes: Microsoft and Okta lead everywhere, and 12 brand entities appear in all four engines. Below that, no: 38 of the 67 brand entities recorded appear in only one engine.

Do AI engines cite the same sources for SSO recommendations?

Mostly no. Cited-domain overlap between engine pairs ranges from 0.05 to 0.24 on a scale where 1 is identical. Vendor sites supply 82.4% of ChatGPT’s cited sources but 14.1% of Google AI Overview’s.

Final Thoughts

The enterprise SSO category has a settled head and an unsettled body. Microsoft and Okta lead every engine and every market, the same five brands fill the top five everywhere, and every engine judges the category on the same four criteria. Below the top six, the engines stop agreeing. Most brands they name are named by one engine alone, and the evidence each engine reads overlaps with the others by a quarter at most.

For the leaders, that is a stable position. For every other vendor in the category, visibility is a per-engine problem: getting onto ChatGPT’s list is a documentation job, getting onto Google AI Overview’s is a community and third-party job, and neither guarantees the other.

We ran the same protocol in other categories: which attack surface management platforms AI engines recommend, how AI engines rank compliance automation vendors, which bot management vendors AI engines name first, and which third-party risk vendor AI engines name first.

The full methodology, every per-engine table and the validity limits are in the complete benchmark report.