LMS RFP questions most templates forget: exit, SCIM, proctoring

The LMS RFP questions most templates forget cover six areas: how you get your data out when the contract ends, whether SCIM actually deprovisions people, where the platform can be hosted, which standards the vendor has tested rather than just listed, how exams are proctored and certificates verified, and what the AI does with your data. Ask each in writing, then make vendors prove the answers live.

LMS Advisor was built to pass exactly these checks: admins export records to CSV, Excel or PDF whenever they like, SCIM 2.0 provisioning handles joiners and leavers, it runs in our cloud or on your own server, and its Test Center proctors exams natively. We show our own answers throughout, including the ones that are no. For the features behind those answers, see our LMS software page.

Templates are a reasonable place to start. They just stop right where the expensive surprises begin. Below is the question bank we'd hand any US buyer running a selection this quarter, plus live demo tasks, a 1 to 5 scoring sheet, and our own answers where the honest answer is no.

Why do standard LMS RFP templates leave gaps?

Most published templates are written by vendors, about things vendors like to show. D2L's LMS RFP template (June 17, 2026) is one of the better ones. It has six sections, ending with AI. It asks about API access for data export, uptime SLAs, ISO 27001 and penetration testing, and whether customer data trains the AI model. What it doesn't ask: what happens to your records when you leave, whether the platform supports SCIM, whether it can be self-hosted, anything about cmi5, and anything about proctored exams or certificate verification.

iSpring's 15 questions to ask LMS vendors (last modified July 31, 2026) splits the process into an intro call, a demo and a final interview. The questions are sensible but broad, and none of the 15 touches exit terms, SCIM, proctoring, certificate verification, self-hosting or AI data use.

The gaps matter because LMS contracts are long. Docebo's pricing page says, as of September 2026, that "most customers choose to sign a 3-5 year contract," with a one-year minimum. Whatever you didn't ask before signing, you live with for years.

What should you ask about data export and exit?

Ask these first. Exit terms are cheap to negotiate while a vendor wants your signature and nearly impossible to fix afterward. In migrations, content can be rebuilt. What gets lost is history: the record showing a forklift operator passed their evaluation in March 2025.

Question	Why it matters	A good answer sounds like
What can we export at termination, in which formats, and does it cost extra?	"Your data is yours" in a sales deck isn't a contract term	A named list (users, enrollments, completions, attempts, scores, certificates with issue and expiry dates, audit logs) in CSV or via API, with any fee stated in the order form
Can we run that full export ourselves, anytime, without a support ticket?	If you can only export at the end, you find the gaps at the end	Yes, from the admin or the API, and you can test it during the trial
How long do we keep access after the contract ends, and when is data deleted?	Some vendors switch you off on the last day of the term	A read-only or export window of a stated length, then deletion with written confirmation
Can we download the original SCORM, xAPI and cmi5 packages we uploaded?	Teams lose source files. The LMS copy is sometimes the only one left	Yes, the uploaded zip comes back unchanged
What happens to certificate verification links after we leave?	Certificates already in employers' hands point at the vendor's domain	A clear plan: redirect, hand-over, or verification moved to a domain you control
Are xAPI statements and audit logs included in the export?	They often live in a separate store that "export" doesn't cover	Yes, with the format named, or a plain "no" you can plan around

Tie these answers to how long you actually need the records. Our LMS migration checklist covers what to archive before you switch anything off, and our roundup of the best LMS for compliance training compares how easily each vendor's audit evidence comes out.

What should IT ask about identity and hosting?

Generic templates stop at "which SSO types do you support?" Everyone says yes to that. The follow-ups are where vendors differ.

Single sign-on

• Do you support SAML 2.0, OpenID Connect, or both? Which identity providers have you set up with customers (Okta, Microsoft Entra ID, Google Workspace)?
• Do you support SAML single logout? If not, what happens to an LMS session when someone signs out of the IdP?
• How are local admin accounts protected? Can you enforce two-factor authentication or passkeys for anyone who doesn't sign in through SSO?

SCIM provisioning

SSO decides who can sign in. SCIM decides who exists. Okta's developer guide to SCIM describes it as an open standard with a defined schema for users and groups plus a REST API for create, read, update and delete operations. The protocol itself is RFC 7644, which works alongside the core schema in RFC 7643. Ask:

• Is your SCIM endpoint version 2.0, and which IdPs have you tested it with?
• Which attributes do you accept, and how do they map? Department to group, manager to manager view, location to branch.
• Do you support group push, so a directory group can drive course assignments?
• What happens when we set active=false? Is sign-in blocked immediately, are open sessions ended, is the license freed, and is the training history kept?

Test deprovisioning live, and watch the timing. Microsoft's Entra SCIM documentation says its provisioning service runs a sync roughly every 40 minutes, and it can deprovision either with a soft delete (setting active=false) or a hard DELETE request. Ask which one the vendor handles and what each does to training history. A leaver can also keep access until the next cycle unless the LMS ends their session. The license question has a cost angle too. Under Docebo's registered active user option, you deactivate users to free up licenses. If SCIM doesn't reliably deactivate people, you may pay for leavers.

Hosting and data location

• Where is our data stored, and can we choose a US region?
• Can the platform run on our own servers? Who installs updates, runs backups and restores?
• If we self-host, which parts still call out to your services (licensing, AI, email, video)?

Self-hosting isn't free: you take on patching, backups and uptime. But for public agencies, defense suppliers and teams whose security review keeps stalling on SaaS, it's a legitimate option most RFPs never raise.

Our own answers, as a worked example: SAML 2.0 SSO, SCIM 2.0 provisioning, Google sign-in, passkeys and two-factor authentication, yes. SAML single logout, no. LMS Advisor runs in our cloud or on your own server, and the security and data ownership page lists what you control in each setup.

How do you tell real standards support from a checkbox?

"Supports SCORM, xAPI and LTI" is on nearly every feature list and tells you almost nothing. Ask about the parts of each standard that are commonly skipped.

• SCORM 1.2 and 2004. Do multi-SCO packages with sequencing rules play as designed, or only the first resource? Does resume work on a long course?
• xAPI. Is there a built-in Learning Record Store, and can you report on the statements in it, or does it only store them? Can statements be forwarded to an external LRS you already own?
• cmi5. Is it supported at all? Has the implementation been run through CATAPULT, the ADL-funded test suite that checks cmi5 conformance for both content and LMSs? cmi5 defines launch, authentication, session management, reporting and course structure on top of xAPI, so partial support shows up fast.
• LTI 1.3. Is the LMS a tool (launched from Canvas or Moodle), a platform (launching other tools), or both? Is grade passback supported? Has it passed 1EdTech certification, which puts certified products in the TrustEd Apps Directory?

Our answers, limits included. SCORM 1.2 and 2004 packages run, but multi-SCO sequencing packages launch only their entry resource. xAPI statements go to a built-in LRS that stores statements and state while packages run. It isn't a reporting LRS, so forward statements to an external LRS for xAPI analytics. cmi5 is supported. LTI 1.3 works as a tool provider with grade passback, not as a consumer. The standards and interoperability page has the detail, and our SCORM vs xAPI vs cmi5 guide explains which standard to pick for new content.

What should you ask about exams, proctoring and certificates?

Skip this if you only run internal courses with a quiz at the end. If you certify people, a wrong answer here becomes a second contract with a proctoring vendor.

1. Can people who aren't LMS learners take an exam, without a course enrollment or a full account?
2. Is proctoring built in, or is it a third-party service with its own login, data processing agreement and per-attempt fee?
3. Which events count toward a violation limit, and what happens when a candidate's connection drops mid-attempt?
4. What evidence does a reviewer see for one attempt, and can they record a decision and a reason?
5. Does the AI identify people, or only flag frames (no face, more than one face) for a human to review?
6. Is a certificate issued automatically on pass, and is there a public page where an employer can verify it?
7. Can certificates expire and trigger recertification, and does that apply to exam certificates, course certificates or both?

That last question catches people out, including with us. In LMS Advisor, expiry and recertification apply to course certificates. Exam certificates don't expire. Proctoring is native to the Exams module and configured per exam, and the online proctoring page walks through the controls.

What should your security team ask about AI?

D2L's template asks whether customer data trains the AI model. That's one of the questions your security team will want answered, not all of them. EDUCAUSE's HECVAT, a vendor security questionnaire that EDUCAUSE offers to colleges and universities at no cost, added privacy and AI questions in version 4. It's worth reading even outside higher ed.

• Which model providers process our data, and under which agreements?
• Can we choose the provider, and can we switch AI off entirely? Per feature or only globally?
• Is our content, learner data or exam data used to train any model?
• Does AI-generated content (courses, questions, grades) publish automatically, or does a person approve it?
• Is there a log of AI calls an admin can review? Which features does it cover?

Our answers: an admin chooses Anthropic or OpenAI as the provider, and AI can be switched off. AI drafts are never published automatically. Suggested grades wait for an instructor to approve them. The AI usage log covers authoring and generation calls, not every AI feature. Proctoring audio clips, where you turn them on, are transcribed with OpenAI Whisper.

What does an honest "no" look like in an RFP response?

Every vendor has gaps. What you want to learn is whether they'll tell you. A good "no" is specific, names any workaround and skips the "on our roadmap" dodge. Some of ours:

• Attestations. We don't hold SOC 2, ISO 27001 or other certifications. If your policy requires one for any SaaS vendor, our cloud option won't pass that gate. Some teams in that position self-host so the platform runs under their own controls, if your policy allows it. Our security page describes what we do have.
• SAML single logout. Not supported.
• LTI consumer. Not supported. We're an LTI 1.3 tool, not a platform.

Score that kind of answer above a yes to everything that can't be shown.

Which demo tasks should every vendor perform live?

Anyone can type yes into a spreadsheet. Send these tasks a week ahead, with your own files, and watch the product do them.

1. Upload your worst SCORM package. Complete half of it, close the browser, reopen it, and check that it resumes where you stopped.
2. Deprovision a user. Create a test user in your IdP, let SCIM provision them, assign a course, then deactivate them. Confirm they can't sign in, their open session ends, and their completion record is still there.
3. Verify a certificate. Issue one, then open the verification link on a phone in a private browser window. See what an employer would see.
4. Export records. Pull completions, scores, dates and certificate IDs for one course, open the file in Excel, and check the dates and time zones.
5. Break a proctored exam. Take an attempt as a candidate, switch tabs, step out of the camera frame, then look at the evidence trail the reviewer gets.
6. Turn AI off. Ask the vendor to switch AI off and show what changes for admins and learners.

A vendor who asks to skip task 2 or task 4 has told you something.

How should you score the answers?

Separate gates from scores. A gate is a hard requirement (US data storage, SCIM, a specific attestation, self-hosting). A vendor that fails a gate is out, however well it demos. Everything else gets a 1 to 5 score.

Score	Meaning
1	Not supported, and no reasonable workaround
2	On the roadmap, or possible only with custom development or paid services
3	Supported in writing, or supported with a manual workaround, but not shown
4	Supported and shown in the demo with the vendor's data
5	Shown live with your files and your IdP, and backed by the contract where relevant

Two rules keep scoring honest: an undemonstrated yes caps at 3, and a roadmap item caps at 2. Weight the areas to match your program (a certification body might put exams first, an HR team identity and exit) and agree the weights before the first demo, not after you have a favorite.

How LMS Advisor would answer this RFP

Here are our answers in one place, so you can see what a specific response looks like and score us against the same sheet as everyone else.

Question area	LMS Advisor's answer
Data export and exit	Filterable reports export to CSV, Excel or PDF from the admin at any time, without a ticket. The REST API and webhooks feed your own systems, and courses export between installs. Self-host and the database sits on your server.
Identity	SAML 2.0 SSO, SCIM 2.0 provisioning, Google sign-in, passkeys and two-factor authentication. No SAML single logout.
Hosting	Our cloud, or your own server, including ordinary cPanel or VPS hosting, with in-app migrations, backups and system-health tools for self-hosted installs.
Standards	SCORM 1.2 and 2004 (multi-SCO packages launch only their entry resource), xAPI with a built-in LRS that stores statements and can forward them, cmi5, and LTI 1.3 as a tool with grade passback, not a consumer.
Exams and certificates	A Test Center with its own candidate portal, so candidates need no course enrollment. Native proctoring set per exam, with violation limits and an evidence trail. Certificates issue automatically and have a public verification page. Course certificates can expire, exam certificates don't.
AI	Anthropic or OpenAI, chosen by an admin, and AI can be switched off. Drafts are never published automatically, and an instructor approves suggested grades.
Attestations	None held. Self-hosting is the route when your policy lets the platform run under your own controls.

If your gates are SCIM, self-hosting, proctored exams or data you can pull out yourself, LMS Advisor belongs on the shortlist. If a vendor attestation is a hard gate for SaaS, our cloud option is out, and we'd rather you know that before the demo. To test the rest, book a demo and bring your own SCORM package and a test IdP user. We'll work through as many of the six demo tasks as your setup allows and tell you plainly where we don't fit.

Frequently asked questions

How many questions should an LMS RFP include?

Our rule of thumb is roughly 40 to 80 questions, each tied to a real requirement, rather than the hundreds a merged set of templates can grow to. Cut any question every vendor will answer yes, and replace it with a demo task.

Should we send a formal RFP or just run demos?

Use both, in that order. A short written RFP screens out vendors that fail your gates, and scripted demos with your own files show how the rest actually behave.

Which security questionnaire should we use for an LMS vendor?

Use your organization's standard vendor questionnaire first, since your security team already knows how to review it. If you don't have one, EDUCAUSE's HECVAT is a good reference even outside higher ed, and version 4 added privacy and AI questions. Either way, add the SCIM and exit questions from this post.

How long should an LMS contract be?

Match the term to how sure you are after the pilot. Multi-year terms are common (Docebo says most of its customers sign for 3 to 5 years), but a one-year first term with agreed renewal pricing limits your risk. Whatever the length, put the export and exit terms in the contract.

What should we ask if we plan to self-host the LMS?

Ask what the server needs (operating system, PHP or other runtime, database), how updates and database migrations are applied, and how backups and restores work. Then estimate the staff time for patching and monitoring, the real cost of self-hosting.

How does LMS Advisor answer these LMS RFP questions?

LMS Advisor answers yes on SAML SSO, SCIM 2.0, self-hosting, cmi5, native proctoring and verifiable certificates, and no on SAML single logout, LTI consumer mode and third-party attestations. Records export to CSV, Excel or PDF from the admin whenever you need them. We'll run the demo tasks in this post with your own files so you can score us on evidence, not on a spreadsheet yes.