What Single Sign-On Is
Single sign-on (SSO) lets a person log in once and get into all of their work apps without a separate password for each one. NIST describes SSO as an authentication process by which one account and its authenticators are used to access multiple applications, generally through a federation protocol.
In everyday terms, your team signs in to one trusted login service, called an identity provider. When someone opens the CRM, the help desk or the project tool, that app asks the identity provider who the person is. If they are already signed in and allowed to use the app, they go straight in.
What an Identity Provider Does
The identity provider is the system that holds your team's accounts and checks who someone is. It stores user accounts and groups, enforces password and MFA rules, decides which apps each person may open, and keeps a record of sign-ins. Many businesses already have one without realizing it, because their email and office suite can act as an identity provider. Others use a dedicated identity service or run one themselves alongside their other business software.
How SSO Works Behind the Scenes
Apps and identity providers talk to each other using open standards. The two you will see most often are:
- SAML: an older, widely supported standard common in business software.
- OpenID Connect (OIDC): a newer standard built on the OAuth 2.0 framework, common in modern web and mobile apps.
You do not need to understand the protocols in detail. What matters is checking that the apps you rely on support one of them, and on which plan.
Problems SSO Solves for a Small Team
Offboarding in One Place
When someone leaves, every account they had becomes a risk. Without SSO, you have to remember each app and each shared password. With SSO, disabling one account in the identity provider closes access to every connected app at once.
Stronger Sign-In Everywhere
Multi-factor authentication (MFA) is much easier to enforce once. Instead of hoping each person turns on MFA in a dozen apps, you require it at the identity provider and every connected app benefits. CISA recommends phishing-resistant MFA, such as security keys or passkeys, as the most secure form of MFA, while noting that any MFA is better than none.
Fewer Passwords to Reuse or Share
People who juggle many passwords tend to reuse them or write them down. One strong sign-in replaces most of those, and reduces password reset requests.
One Place to See Who Has Access
An identity provider shows who can reach which app and records sign-in activity. That makes access reviews and security monitoring much simpler.
What to Watch Out For
- The identity provider becomes your most important account. Protect admin access with phishing-resistant MFA and keep a documented break-glass account in case of lockout.
- Some vendors only offer SSO on higher-priced plans. Check before you commit to a tool.
- Not every app supports SSO. Keep a password manager for the ones that do not.
- Old local accounts can linger. After connecting an app to SSO, remove or lock the separate logins it had before.
SSO vs a Password Manager
A password manager and SSO solve different problems, and most teams benefit from both. A password manager stores a separate, strong password for each account and fills it in for you. It makes passwords safer, but each app still has its own login, and removing a departing employee still means changing or revoking access app by app.
SSO removes the separate login altogether for every app that supports it. Access is granted and removed in one place, and MFA is enforced once. The practical approach is to connect every app you can to SSO, and keep the password manager for the tools that do not support it, such as some vendor portals and older systems.
How a Small Team Can Roll Out SSO
- List every app your team uses and note whether it supports SAML or OpenID Connect.
- Choose an identity provider. Many teams start with the one built into their email platform.
- Require MFA on the identity provider, starting with admins.
- Connect one low-risk app first and test sign-in, sign-out and removal of access.
- Move the remaining apps one at a time, and remove their old local logins.
- Create groups by role, such as office, field and admin, so new hires get the right apps on day one.
- Write a short offboarding checklist that starts with disabling the SSO account.
Most small teams can make this change gradually over a few weeks. Moving one app at a time keeps disruption low and gives people time to get used to signing in through one place.
SSO for Customer and Client Portals
SSO is not only for staff. A client portal or member area can let people sign in with an account they already have, or with a login managed by your organization. That reduces forgotten passwords and support requests, and it keeps access rules in one place.
How 1REALTOUR Helps
1REALTOUR sets up single sign-on for business teams: we choose and configure the identity provider, connect apps over SAML or OpenID Connect, enforce MFA and build clean onboarding and offboarding steps. We also add SSO to the custom portals and self-hosted business software we deploy. See our single sign-on service, and pair it with security monitoring to keep an eye on sign-in activity.
Share this article
