In many companies, the number of applications in use has grown considerably: email, file storage, time tracking, CRM, HR software, and line-of-business applications. Without single sign-on, each of them needs its own account with its own password. This leads to weak or reused passwords and to accounts that are forgotten when people leave. SSO moves sign-in to a central point where security rules can be enforced uniformly.
How does single sign-on work?
An identity provider, for example Microsoft Entra ID, is involved, along with the applications that trust this provider. In simplified form, the process looks like this:
- A person opens an application and is redirected to the identity provider.
- There they sign in, ideally with multi-factor authentication.
- The identity provider issues a digitally signed token that confirms the identity.
- The application checks the signature and grants access.
As long as the session with the identity provider is valid, the person can access further connected applications without entering anything again. Common standards are SAML 2.0 and OpenID Connect for web and cloud applications, and Kerberos in classic Windows networks.
Typical examples
- After signing in to the Windows device, Microsoft 365 and other cloud services are available without an additional password prompt.
- A line-of-business application offers a button for signing in with the company account.
- When a person leaves, a single account is disabled, and access to all connected applications ends.
What companies should keep in mind
- Always combine SSO with MFA: The central account is particularly valuable and needs the strongest protection.
- Set access rules centrally: Policies such as Conditional Access apply to all connected applications at once.
- Require SSO in procurement: Make support for SAML or OpenID Connect a requirement. Some vendors offer SSO only in higher-tier plans.
- Automate the account lifecycle: Have accounts in applications created and removed automatically, for example via the SCIM standard.
- Secure the remaining accounts: Document applications without SSO and manage their credentials in a password manager.
How it differs
SSO is not the same as using the same password everywhere. With SSO, the application never learns the password at all; it receives only the signed confirmation from the identity provider.
View security expertise