What would you use for SSO and device management across Mac, Windows, and Linux?

Start by separating the identity requirements from device management. You need a way to manage individual accounts and access to applications and servers, plus a way to configure and secure laptops. One product may cover both, but check the Linux details rather than assuming all three operating systems get the same features.

JumpCloud is a reasonable one to evaluate alongside your existing Google Workspace setup. Ask vendors to show how account removal, server access, and enrollment work on each OS, then compare the cost for your actual device and user counts.

Microsoft Entra ID and Intune are another route, particularly for Windows and macOS management. Since you're not currently a Microsoft shop, compare the licensing and migration work before committing. Check exactly what Linux management and server authentication would require too, because that part may need additional tooling.

For the Linux machines, don't assume traditional MDM will give you everything you want. Configuration management with Ansible is an option to look at for enforcing settings, while you handle user authentication separately. That does mean maintaining another tool, which matters when you're a team of one.

One terminology distinction will help when comparing products. LDAPS is a protocol for accessing a directory over a secure connection, not an SSO solution by itself. A directory can still be useful for individual Linux server accounts, but check how users authenticate and how access is removed when someone leaves.

Given the budget, I'd price this against the actual compliance and operational needs rather than buy a big suite just because it has both labels. List the controls you need, especially offboarding and device management, then see what each option covers and what would still be manual.

Waiting may save money, but there's a tradeoff if departures are already creating work and compliance is a goal.