The short version
- Desk booking tools usually land on IT’s desk after facilities or HR has already picked a favourite, so the vetting checklist matters more than the demo
- The non-negotiables are SAML or OIDC single sign-on, SCIM provisioning, role-based access control, audit logs, and encryption in transit and at rest
- Offboarding is the question most vendors fail: if deactivating a user in your directory does not kill their access, you own a manual process forever
- Ask the licensing questions in writing, since per-seat add-ons and premium tiers are where the real cost hides
Workplace software rarely arrives through IT. A facilities lead or an office manager trials a desk booking tool, likes it, and forwards it to you with “can you check this is secure”. On r/sysadmin this is a recurring story, and the admins who come out of it well are the ones who put every vendor through the same short checklist before anything touches the directory. Here is that checklist, vendor-neutral, in the order that kills bad options fastest.
1. Single sign-on: SAML or OIDC, not “login with Google”
Ask whether the product supports SAML 2.0 or OIDC against your identity provider, and whether SSO sits behind a paywall or a top-tier plan. A consumer-grade “sign in with Google” button is not single sign-on in any sense your security policy cares about: it bypasses your conditional access rules, your MFA policy, and your session controls. If SSO only appears in the enterprise tier of a tool being bought for one office, that price jump belongs in the decision now, not after rollout.
2. SCIM provisioning: does offboarding actually work?
SSO controls how people get in. SCIM provisioning controls who exists in the system at all. Without it, every joiner, mover, and leaver becomes a manual task in yet another admin console, and leavers are the one you will miss. The test question for any vendor: when I deactivate a user in Entra ID or Okta, what happens in your product, and how quickly? “They can no longer log in via SSO” is half an answer. You want the account deprovisioned, their future bookings released, and their data handled per your retention policy.
3. Role-based access control, scoped to sites and teams
A single global admin role is a red flag in any multi-site tool. Look for role-based access control that lets an office manager in one city manage that city’s floor plans and nothing else, while IT keeps the integration and security settings. If the only way to let someone edit a floor plan is to make them a full admin, the tool will accumulate full admins, and your audit will find them.
4. Audit logs you can export
When someone asks who changed a booking rule, deleted a floor, or exported the user list, the answer needs to come from an audit trail, not from memory. Check that admin actions are logged, that logs are retained long enough to be useful, and that you can get them out, whether by export or API, so they can land in your SIEM alongside everything else.
5. Encryption, certification, and network controls
Encryption in transit and at rest is table stakes; ask anyway, and ask where the data is hosted. An ISO 27001 certification (or SOC 2) tells you an auditor has checked the vendor’s controls, not just the vendor’s marketing. If your organisation restricts admin access by network, ask about IP allow-listing for the admin console.
The one-page vetting table
| Question to the vendor | Good answer | Walk away |
|---|
| How do users authenticate? | SAML 2.0 / OIDC with your IdP, MFA inherited | Separate username and password store |
| How are accounts provisioned and removed? | SCIM from Entra ID or Okta, automatic deprovisioning | CSV upload, manual deletion |
| Can admin rights be scoped? | Roles per site, team, or function | One global admin role |
| Are admin actions logged? | Exportable audit log with retention | “We can check for you if something happens” |
| Where does SSO/SCIM pricing sit? | Stated in writing before purchase | “Talk to sales about enterprise” |
| Independent security certification? | ISO 27001 or SOC 2, report available | None, or “in progress” with no date |
Ask the licensing question in writing
Security is where vendors get rejected; licensing is where budgets get burned. The pattern admins complain about most is the per-seat add-on: a booking plugin priced per user per month across the whole company, or a feature that quietly requires a premium Microsoft tier nobody budgeted for. Before sign-off, get in writing what the quoted price includes, what SSO and SCIM cost, and what happens to the price when the second office joins.
Where HybridHero sits against this list
Since you will run this checklist against every shortlisted tool, here is one data point: HybridHero supports SAML and OIDC SSO, SCIM provisioning with Entra ID (Azure AD) and Okta, role-based access control, IP allow-listing, audit logs, encryption in transit and at rest, and is ISO 27001 certified. Pricing is by custom quote. Run the same questions against it as against everyone else; the point of the checklist is that nobody gets a pass.
If you have been handed a shortlist to vet, the checklist above fits in one email to each vendor. The answers that come back slowly are answers too. More on how IT teams typically run this process is on our IT teams page, or you can put HybridHero through the checklist yourself.