Single sign-on

What it means

Single sign-on lets a user log in once and work across several systems without further passwords. One trusted identity provider authenticates them and the other applications rely on it.

The benefit is not only convenience. Identity sits in one place, so two-factor authentication can be enforced centrally and logins tracked in the audit log.

SSO is not a password manager. A password manager remembers many different passwords for the user; SSO replaces them with a single check at the identity provider, and the individual applications never see a password at all. You know a similar principle from public services, where one bank identity logs you into several portals without separate registration.

How it works in practice

The clearest gain comes at offboarding: disabling one account removes access to every connected system at once. Without SSO one system is always forgotten.

In accounting and payroll systems holding sensitive data, central access management is the baseline. Who can reach what must be visible without touring the applications.

Small firms most often get SSO through the company accounts of the service they already use for email. When choosing a new SaaS tool we therefore suggest checking whether it can connect to those accounts, because SSO is often available only on a higher tier, and adding it later means moving the whole company to a more expensive plan.

What to watch out for

A single point of login is also a single point of failure. The identity provider account needs strong authentication and a fallback route in case the service is unavailable.

Applications that do not connect to SSO, shared logins and local admin accounts stay outside central blocking. If nobody keeps a list of them, a former employee can keep access for months. Companies that fall under NIS2 should be able to produce such a list of exceptions.