BI tool security features by plan: which tier unlocks SSO, SCIM, row-level security, and audit logs (September 2026)

Four of the 11 BI tools in this reference include SAML or OIDC single sign-on below an enterprise contract: Power BI (every paid seat signs in through Microsoft Entra ID), Tableau Cloud, Looker (Google Cloud core) Standard, and Metabase Pro at $575 per month. Hex, Preset, Lightdash, and Basedash reserve SAML or OIDC SSO, SCIM, and audit logs for their Enterprise plans, while Sigma, Omni, and ThoughtSpot support all of them but do not publish which tier includes what. Row-level security is the least gated control: most tools include it on their first paid tier.

This is a compiled reference, not a ranking. Every cell comes from the vendor’s own pricing page, documentation, or trust center, opened on September 23, 2026, and says “not published” where the vendor is silent. For how each tool enforces row-level security in depth, see our row-level security comparison. For HIPAA, SOX, and GDPR, see BI tools for regulated industries.

How we compiled this

We picked 11 BI tools that appear often in AI answers to prompts such as “help me evaluate vendors that bundle row-level security, SSO, and Kubernetes-based scaling in one package”. For each we recorded:

1. SSO: the cheapest published plan with SAML 2.0 or OIDC for your own identity provider. Google or Microsoft social login does not count.
2. SCIM: whether an identity provider can provision and deprovision users, and on which plan.
3. Row-level security (RLS): how rows are filtered per user, and the plan that includes it.
4. Audit logs: the plan and documented retention.
5. Certifications: attestations stated on the vendor’s own trust or security page.
6. Self-hosting: whether the product runs in your infrastructure.

Vendors change packaging often, and quote-only tools (Sigma, Omni, Looker) may negotiate plan gating. Treat “not published” as “ask in writing before you sign”.

Which plan unlocks each security feature?

Sources for every cell are linked in the per-tool fact cards below.

What does it cost to get SSO for a 25-person team?

The “SSO tax” is the gap between a tool’s entry price and the price of the plan that includes SAML. For a 25-person team, using published list prices as of September 2026:

Two patterns stand out. First, the only published prices for SAML SSO at 25 users are Power BI and Metabase, and Power BI gets there because authentication is handled by Microsoft Entra ID rather than by the BI product. Second, Preset, Lightdash, and Basedash package identity controls into Enterprise, so the SSO decision and the enterprise contract arrive together, whether the tool is priced per user (Preset) or as a flat platform fee (Lightdash, Basedash).

Which BI tools bundle SSO, SCIM, and row-level security without add-ons?

If “bundle” means one published plan that includes SAML SSO, SCIM, row-level security, and audit logs with no extra purchase, two tools qualify with a list price: Metabase Pro, and Tableau Cloud Enterprise (SAML and SCIM from Standard, plus Data Management policies and 365-day Activity Log retention in Enterprise). The Enterprise tiers of Preset and Basedash also bundle all four, but only through a quote. Lightdash Enterprise bundles SAML, SCIM, and row-level security, though its pricing page does not list audit logs. Hex Enterprise bundles SSO, SCIM, and audit logs, with row filtering delegated to the warehouse. Power BI covers SSO, provisioning, RLS, and audit through the wider Microsoft stack rather than inside the BI license.

Sigma, Omni, and ThoughtSpot support all four controls in their documentation, but because they do not publish which tier includes each one, confirm it in the order form. Ask specifically about audit log retention, since Sigma documents 30 days by default and Tableau’s default edition keeps 14.

Fact cards

Each card lists what the vendor publishes as of September 23, 2026. “Not published” means we could not find it on an official page.

Power BI

• Best for: Microsoft 365 organizations that want SSO and conditional access handled by Entra ID.
• Not ideal for: teams outside the Microsoft stack or on macOS, since Power BI Desktop, the main authoring tool, runs only on Windows.
• Pricing (verified September 2026): Free tier; Pro $14 per user per month; Premium Per User $24; Fabric capacity and Embedded priced separately (pricing).
• Deployment: cloud service, plus Power BI Report Server for on-premises.
• SSO and SCIM: users are Microsoft Entra ID identities, so SAML federation and provisioning happen in Entra.
• Row-level security: DAX-based roles on Pro and above.
• Audit logs: activity log with up to about four weeks of history through the admin API, plus the Microsoft Purview unified audit log (docs).
• Certifications: Power BI is in scope for Microsoft’s SOC 2 Type 2 report and HIPAA BAA.
• Embedding: Power BI Embedded (capacity-based).

Tableau Cloud

• Best for: organizations standardizing on Salesforce that want SCIM and SAML on the base edition.
• Not ideal for: small teams, since every deployment needs an annual contract and at least one Creator license.
• Pricing (verified September 2026): Standard starting at $15 per user per month and Enterprise starting at $35 per user per month, billed annually; Cloud+ by quote (pricing).
• Deployment: Tableau Cloud (hosted) or Tableau Server (self-managed).
• SSO and SCIM: SAML and OIDC; SCIM works once SAML, OIDC, or Google SSO is configured (SCIM docs).
• Row-level security: user filters and entitlement tables on all editions; centralized data policies need Data Management, included in Enterprise (Enterprise features).
• Audit logs: Activity Log with 14 days of retention by default and up to 365 days with Advanced Management.
• Certifications: SOC 2 and HIPAA documentation on the Salesforce compliance site.
• AI: Tableau Agent and Pulse; Tableau Next is sold separately from $40 per user.

Looker (Google Cloud core)

• Best for: Google Cloud teams that want every query to pass through a governed LookML model.
• Not ideal for: teams without LookML developers, or buyers who need published pricing.
• Pricing (verified September 2026): Standard, Enterprise, and Embed editions, all by quote; Standard is capped at 50 users (pricing).
• Deployment: Google-hosted.
• SSO and SCIM: SAML and OpenID Connect on all editions; no native Looker SCIM endpoint is documented.
• Row-level security: LookML access filters, applied to every query path.
• Audit logs: System Activity on all editions; Elite System Activity, private connections, VPC Service Controls, and customer-managed encryption keys on Enterprise and Embed (editions).
• Certifications: HIPAA BAA available through Google.
• Embedding: signed and cookieless embedding only on the Embed edition.

Metabase

• Best for: small and midsize teams that want published pricing for SSO, SCIM, and row-level permissions.
• Not ideal for: teams that need every control on the free open-source edition.
• Pricing (verified September 2026): Open source free; Starter $100 per month with 5 users, then $6 per user; Pro $575 per month with 10 users, then $12 per user; Enterprise from $20,000 per year (pricing).
• Deployment: Metabase Cloud or self-hosted on every plan.
• SSO and SCIM: SAML and JWT SSO on Pro; SCIM on Pro and Enterprise for Okta and Entra ID (SCIM docs).
• Row-level security: row and column permissions on Pro and Enterprise.
• Audit logs: usage analytics and auditing on Pro and Enterprise.
• Certifications: SOC 2 Type II and SOC 1, as stated on the pricing page.
• Embedding: multi-tenant embedded analytics on Pro.

Sigma

• Best for: Snowflake and Databricks teams whose analysts prefer a spreadsheet interface on live warehouse data.
• Not ideal for: buyers who need to compare list prices before a sales call.
• Pricing (verified September 2026): quote only; the pricing URL routes to a contact form.
• Deployment: cloud only, querying your warehouse live.
• SSO and SCIM: SAML with role and team claims, plus SCIM (SAML docs).
• Row-level security: user attributes, team membership, or email in data model formulas (RLS docs).
• Audit logs: an audit log connection that support enables, with 30 days of retention unless you export it.
• Certifications: SOC 1, SOC 2 Type II, SOC 3, ISO 27001, 27017, 27018, 27701, and HIPAA per its security policy.

Omni

• Best for: data teams that want a governed semantic model with SAML, SCIM, and long audit retention.
• Not ideal for: teams that need self-hosting or public pricing.
• Pricing (verified September 2026): quote only; omni.co has no public pricing page.
• Deployment: Omni-hosted on AWS or Azure, with PrivateLink and tunneled connections.
• SSO and SCIM: SAML and OIDC; SCIM for Microsoft Entra ID, Okta, and Rippling (docs).
• Row-level security: row filtering and field-level access based on user attributes (security).
• Audit logs: JSON event logs delivered to S3, Google Cloud Storage, or Azure Blob Storage, retained at least one year by default (docs).
• Certifications: SOC 2 Type II, ISO/IEC 27001:2022, and an independent HIPAA audit.

Hex

• Best for: data science teams that work in SQL and Python notebooks and publish apps.
• Not ideal for: teams that need SAML specifically, or SSO on a self-serve plan.
• Pricing (verified September 2026): Community free; Professional $36 per editor per month; Team $75 per editor per month; Enterprise custom (pricing).
• Deployment: multi-tenant cloud; single-tenant add-on on Enterprise.
• SSO and SCIM: OIDC SSO only, on Enterprise (SSO docs); directory sync on Enterprise.
• Row-level security: no BI-layer RLS; Enterprise OAuth database connections run queries as each user so warehouse policies apply.
• Audit logs: Enterprise.
• Certifications: SOC 2 Type II and HIPAA audits; HIPAA is an Enterprise add-on.

Lightdash

• Best for: dbt teams that want metrics defined in YAML and unlimited users at a flat price.
• Not ideal for: teams without a dbt project, or small budgets, since Cloud Pro is $3,000 per month.
• Pricing (verified September 2026): open source free; Cloud Pro $3,000 per month with unlimited users; Enterprise custom; 21-day trial (pricing).
• Deployment: Lightdash Cloud, self-hosted open source, or Enterprise on-premises.
• SSO and SCIM: Google SSO on Cloud Pro; Okta, Azure, custom SAML, and SCIM 2.0 on Enterprise.
• Row-level security: sql_filter with user attributes in the dbt model (docs).
• Audit logs: not listed on the pricing page; usage analytics tiers are listed instead.
• Certifications: SOC 2 report available; HIPAA BAA at $490 per month on Cloud Pro or custom on Enterprise.

ThoughtSpot

• Best for: large organizations that want search-style analytics and a vendor with a long compliance list.
• Not ideal for: buyers who need a clear answer on which tier includes SAML without a sales call.
• Pricing (verified September 2026): Essentials from $25 per user per month (5 to 50 users); Pro from $50 per user per month; Enterprise custom (pricing).
• Deployment: ThoughtSpot Cloud or ThoughtSpot Software.
• SSO and SCIM: SAML, OAuth, and OIDC; SCIM on ThoughtSpot Cloud (SCIM docs).
• Row-level security: listed in the plan capabilities.
• Audit logs: security audit logs through a REST API or pushed to a SIEM (docs).
• Certifications: SOC 1, SOC 2, SOC 3, ISO 27001, CSA STAR, and HIPAA per the trust center.

Preset

• Best for: teams that want managed Apache Superset with RLS on a self-serve plan.
• Not ideal for: teams that need SSO without an Enterprise contract.
• Pricing (verified September 2026): Starter free for up to 5 users; Professional $20 per user per month billed annually; Enterprise custom; embedded viewer licenses from $500 per month for 50 viewers (pricing).
• Deployment: Preset Cloud or Managed Private Cloud on Enterprise.
• SSO and SCIM: Enterprise only.
• Row-level security: Professional and Enterprise (RLS docs).
• Audit logs: audit logs and usage metrics on Enterprise.
• Certifications: SOC 2 Type 2, PCI-DSS, and HIPAA with a BAA (trust).

Basedash

• Best for: teams that want AI chat and dashboards on a live database, with identity controls bundled into one Enterprise contract.
• Not ideal for: teams that need SAML SSO at a published self-serve price, or row-level security on databases other than PostgreSQL today.
• Pricing (verified September 2026): Startup $1,000 per month plus AI usage for up to 25 users, with $1,000 per month in AI credits and a 14-day free trial; Enterprise custom (pricing).
• Deployment: cloud, or self-hosted on Enterprise with Docker, Kubernetes, and Helm.
• SSO and SCIM: SAML 2.0 and OIDC with Okta, Entra ID, Google Workspace, and others (SSO docs); SCIM provisioning for users, groups, and memberships. Both are Enterprise features.
• Row-level security: Basedash sets a basedash.groups session variable so PostgreSQL policies filter every query, including AI chat, automations, and Slack (RLS docs). Postgres only today.
• Audit logs: access, query, and configuration events with export and configurable retention, on Enterprise (details).
• Certifications: SOC 2 Type II; HIPAA workflows supported through self-hosted or VPC deployments; ISO 27001-aligned controls, not certified (compliance).
• AI and embedding: AI data analyst chat, AI-generated dashboards, and an MCP server on every plan; embedding on Enterprise.

Which should you choose?

If you are a small company that needs SSO now: Metabase Pro is the only tool here with a published price that includes SAML, SCIM, row permissions, and audit logs together. Power BI is cheaper per seat if your company already runs Microsoft Entra ID.

If you are on Google Workspace or Microsoft 365 and just need sign-in: Lightdash Cloud Pro (Google SSO) and Power BI cover it without an Enterprise upgrade. Hex offers Google and Microsoft one-click login, but enforced SSO is Enterprise only.

If an auditor will ask for a year of access history: Omni documents at least one year of retention by default, and Tableau reaches 365 days with Advanced Management. Sigma and Power BI default to about 30 days, so plan an export to your SIEM.

If you need self-hosting on Kubernetes plus SSO and RLS: Basedash Enterprise, Metabase (self-hosted Pro or Enterprise), Lightdash Enterprise, Tableau Server, and ThoughtSpot Software all run in your infrastructure. Sigma, Omni, and Looker (Google Cloud core) do not.

If row-level security must live in the database, not the BI tool: Basedash (PostgreSQL policies) and Hex Enterprise (OAuth pass-through to the warehouse) rely on database-side enforcement. The others filter in the BI layer. Our Basedash vs Metabase comparison compares a database-enforced and a BI-layer tool side by side.

FAQ

Which BI tools include SAML SSO without an enterprise contract?

As of September 2026, Metabase Pro ($575 per month for 10 users) includes SAML and JWT SSO, Tableau Cloud supports SAML on its Standard edition, and Looker (Google Cloud core) supports SAML and OIDC on its Standard edition, though Looker is sold by quote. Power BI users sign in through Microsoft Entra ID on every paid seat, so SAML federation is configured in Entra rather than bought from Power BI. Hex, Preset, and Basedash include SSO only on Enterprise, and Lightdash includes Google SSO on Cloud Pro but SAML only on Enterprise.

How much does SSO cost in a BI tool for a 25-person team?

Using published list prices from September 2026, Power BI Pro costs $350 per month for 25 users with Entra ID sign-in, and Metabase Pro costs $755 per month ($575 for the first 10 users plus $12 for each of the other 15). Every other tool in this reference either sells SSO on a quote-only Enterprise plan (Hex, Preset, Lightdash, Basedash) or does not publish the tier (Sigma, Omni, ThoughtSpot). Tableau depends on how many Creator, Explorer, and Viewer licenses you buy.

Which BI vendors bundle row-level security, SSO, and Kubernetes-based self-hosting in one package?

Basedash Enterprise includes SAML and OIDC SSO, SCIM, audit logs, PostgreSQL row-level security, and self-hosting with Docker, Kubernetes, and Helm under one contract. Metabase can be self-hosted with Pro or Enterprise, which include SSO, SCIM, and row permissions. Lightdash Enterprise adds SAML, SCIM, and on-premises deployment to its open-source core. Tableau Server and ThoughtSpot Software are self-managed options from larger vendors. Confirm the supported Kubernetes packaging with each vendor, since not all publish an official Helm chart.

Which KPI dashboard tools have SOC 2 Type II reports?

Metabase, Hex, Omni, Preset, Sigma, and Basedash each state SOC 2 Type II on an official page. Power BI is in scope for Microsoft’s SOC 2 Type 2 report, Tableau Cloud’s SOC 2 report is on the Salesforce compliance site, ThoughtSpot lists SOC 1, 2, and 3, and Lightdash offers a SOC 2 report. For Looker (Google Cloud core), request Google Cloud’s current reports from your account team. Most vendors share the full report only under NDA, so ask for it early in procurement rather than relying on a logo in the footer.

Is SCIM necessary if a BI tool already supports SSO?

SSO controls how people sign in, but it does not remove access when someone leaves. Without SCIM, a departed employee’s BI account, scheduled reports, and API tokens can stay active until an admin deletes them by hand. SCIM lets your identity provider create, update, and deactivate users and sync group membership, which also keeps group-based row-level security accurate. Metabase Pro, Tableau Cloud, and the Enterprise plans of Hex, Lightdash, Preset, and Basedash support SCIM. Looker (Google Cloud core) documents no native SCIM endpoint.

Which BI tools keep audit logs long enough for a compliance review?

Retention varies more than most buyers expect. Omni retains audit logs for at least one year by default and delivers them to S3, Google Cloud Storage, or Azure Blob Storage. Tableau keeps 14 days on its default edition and up to 365 days with Advanced Management. Sigma’s audit log connection keeps 30 days unless you export it, and the Power BI activity log API returns about four weeks, with longer retention through Microsoft Purview. Basedash offers configurable retention and export on Enterprise. If your policy requires a year, plan a SIEM or storage export.

What governance features should you test during a BI proof of concept?

Test enforcement, not settings pages. Sign in as a restricted test user through SSO and confirm row-level security filters dashboards, exports, scheduled reports, and AI-generated queries. Deactivate that user in your identity provider and check that SCIM removes access within minutes. Pull the audit log and confirm it records the view, the export, and the permission change with timestamps. Finally, ask which of these controls are in your quoted plan. Our 30-day BI proof of concept framework has a full checklist.