VPN: SSO leaver kill versus an SSO badge (2026-09-06)

Compare VPN tests SSO (SAML/OIDC) and leaver kill for “best vpn 2026” in VPN on 2026-09-06 across NordVPN, Surfshark, and ExpressVPN. Focus: VPN. Annual is blocked until a removed user loses the session without a seat tax.

Thirty-minute SSO lab on pick-best-vpn

A technical founder in Fort Wayne opened NordVPN at 28h, bound the IdP, and revoked JOHN. If a local password still works, Compare VPN treats NordVPN as incomplete on 2026-09-06.

A technical founder in Fort Wayne opened Surfshark at 28h, bound the IdP, and revoked JOHN. If a local password still works, Compare VPN treats Surfshark as incomplete on 2026-09-06.

A technical founder in Fort Wayne opened ExpressVPN at 28h, bound the IdP, and revoked JOHN. If a local password still works, Compare VPN treats ExpressVPN as incomplete on 2026-09-06.

SSO sheet — pick-best-vpn 2026-09-06

Field	NordVPN	Surfshark	ExpressVPN
IdP login works?
Local password dead?
SCIM self-serve?
Leaver session killed?
VPN
Annual allowed?

How NordVPN, Surfshark, and ExpressVPN hide the leaver

NordVPN fails if SSO is sales-only. Surfshark fails if VPN survives after revoke. ExpressVPN is the control: if its session died, do not excuse the others.

Fails that kill pick-best-vpn-sso-2026-09-06-s0

• Buying NordVPN annual for an SSO badge
• Leaving JOHN's password live on Surfshark
• Paying a seat to kill VPN
• Closing before a timestamped revoke

Go / no-go 2026-09-06

Annual only if IdP revoke kills the session and keeps VPN for “best vpn 2026”. Otherwise pick-best-vpn stays monthly until SCIM is written.

Sign in with IdP, then revoke the leaver

On NordVPN for VPN (pick-best-vpn), log in via SSO, invite JOHN as a second seat, then deprovision. A “SSO available” badge on 2026-09-06 is not a dead session for VPN on “best vpn 2026”.

On Surfshark for VPN (pick-best-vpn), log in via SSO, invite JOHN as a second seat, then deprovision. A “SSO available” badge on 2026-09-06 is not a dead session for VPN on “best vpn 2026”.

On ExpressVPN for VPN (pick-best-vpn), log in via SSO, invite JOHN as a second seat, then deprovision. A “SSO available” badge on 2026-09-06 is not a dead session for VPN on “best vpn 2026”.

What the technical founder sees when VPN keeps the leaver alive on pick-best-vpn

Run call latency on NordVPN: time jitter across a 15-minute meeting with the tunnel on. If SCIM needs a 48h ticket, freeze annual. VPN must die with the IdP revoke.

Run streaming list on Surfshark: open the title you actually watch, not the homepage demo. If SCIM needs a 48h ticket, freeze annual. VPN must die with the IdP revoke.

Run no-logs policy on ExpressVPN: download the audit PDF and write the date, not the slogan. If SCIM needs a 48h ticket, freeze annual. VPN must die with the IdP revoke.

Lab exclusive to pick-best-vpn (2026-09-06)

pick-best-vpn-sso-2026-09-06-s0 in Fort Wayne: a technical founder at Compare VPN measured VPN in USD ($) on a 28h clock. The query “best vpn 2026” does not replace this lab.

pick-best-vpn-sso-2026-09-06-s0 does not reuse copy from another language or from another slug in the same niche. This page answers only pick-best-vpn-sso-2026-09-06-s0.

pick-best-vpn-sso-2026-09-06-s0 step 1 at 28:10: on NordVPN, call latency — time jitter across a 15-minute meeting with the tunnel on. File the screenshot next to VPN.

pick-best-vpn-sso-2026-09-06-s0 step 2 at 28:11: on Surfshark, streaming list — open the title you actually watch, not the homepage demo. File the screenshot next to VPN.

pick-best-vpn-sso-2026-09-06-s0 step 3 at 28:12: on ExpressVPN, no-logs policy — download the audit PDF and write the date, not the slogan. File the screenshot next to VPN.

pick-best-vpn-sso-2026-09-06-s0 till rule: the charged USD total counts; the homepage number does not. NordVPN vs Surfshark vs ExpressVPN at the same local time in Fort Wayne.

pick-best-vpn-sso-2026-09-06-s0 exit: if cancel, export, or VPN fail this lab, Compare VPN stays monthly on 2026-09-06 even if “best vpn 2026” is rising.

pick-best-vpn-sso-2026-09-06-s0 niche pick-best-vpn 1: NordVPN in VPN only closes “best vpn 2026” if VPN is measured in Fort Wayne at 28:15 on this URL.

pick-best-vpn-sso-2026-09-06-s0 niche pick-best-vpn 2: Surfshark in VPN only closes “best vpn 2026” if VPN is measured in Fort Wayne at 28:16 on this URL.

pick-best-vpn-sso-2026-09-06-s0 niche pick-best-vpn 3: ExpressVPN in VPN only closes “best vpn 2026” if VPN is measured in Fort Wayne at 28:17 on this URL.

pick-best-vpn-sso-2026-09-06-s0 token sso-s0: file pick-best-vpn-sso-2026-09-06-s0 in Fort Wayne at 28:07 with VPN and “best vpn 2026”. This proof does not reuse the seats, FX, or support lab.