Single sign-on (SSO)
SSO · single sign-on · identity federation · identity provider · SAML · OpenID Connect · authentification unique
A mechanism that lets you sign in once with an identity provider and then use several applications without typing a password again.
In practice
The user signs in with an identity provider (Microsoft Entra ID, Google Workspace, Okta, Keycloak and so on), which then sends each application a signed assertion using standard protocols such as SAML 2.0 or OpenID Connect. Fewer passwords means less reuse, a single place to enforce MFA and a single account to switch off when someone leaves. The flip side: the SSO account becomes a master key, which must be protected by strong MFA and closely monitored.
Fictional case: a 40-person agency used 25 SaaS applications, each with its own password. Since moving to SSO with MFA, offboarding means disabling a single account, and suspicious sign-ins show up in a single log.
How to protect yourself
- Enforce phishing-resistant MFA on the SSO account.
- Connect the applications holding sensitive data first.
- Monitor unusual sign-ins (country, time of day, device).
- Plan a break-glass access route in case the identity provider goes down.
