SAML is your old-school enterprise ID card. OAuth 2.0 is a valet key for your apps.
SAML (XML-based) is primarily for authentication. It tells an app "this user is who they say they are" after they log in at a central Identity Provider (like Okta). Classic web SSO flow.
OAuth 2.0 (JSON-based) is for authorization. It's about delegated access. It lets App A get limited permission to access your data in App B, without you giving App A your login password. OpenID Connect (OIDC) is the layer on top of OAuth that adds the authentication piece.
When to pick which:
* Use SAML for workforce SSO to internal apps. It's mature, but clunky.
* Use OAuth 2.0/OIDC for customer-facing apps, mobile, or modern APIs. It's more flexible for modern development.
Most cloud services support both now. OIDC is becoming the default for new projects.