Single Sign-On

A typical small business uses many web applications: email, CRM, accounting, help desk, website admin, file storage, scheduling and more. Each has its own password, often reused or shared. When someone leaves, access has to be removed from each app by hand, and something is usually missed.

SSO puts one identity in charge. Staff sign in once, apps trust that sign-in, and access is granted or removed in one place. There is also one sign-in log to review, so unusual activity across all your apps can be spotted from a single screen.

• A central identity provider for your team, or configuration of the one you already use, such as Google Workspace or Microsoft
• Connections to apps that support standard protocols such as SAML and OpenID Connect
• Multi-factor authentication required for every account
• Groups and roles so each person sees only the apps they need
• A login portal that lists each person's apps
• Protection for internal tools that have no login of their own

For self-hosted tools and internal dashboards that lack built-in SSO, we can place them behind an authenticating proxy so nobody reaches them without signing in first.

Not all multi-factor methods are equal. CISA describes FIDO and WebAuthn authentication, such as passkeys and hardware security keys, as the only widely available phishing-resistant option, while noting that any MFA is better than none. We help teams move to passkeys or security keys for administrator and finance accounts first, and use authenticator apps where those are not practical. Text message codes are kept as a last resort. Recovery matters too: we set up backup sign-in methods and a documented reset process so a lost phone does not lock anyone out for days.

With SSO, adding a new employee means creating one account and placing it in the right groups. Removing someone means disabling one account, which ends their access to every connected app. We document both steps so your office manager can do them without calling IT.

Shared accounts and passwords

Some services still require a shared login. Those go into a team password manager with access controlled by the same groups, so a departing employee loses access to shared passwords as well. We also review which apps can be connected to SSO and which plan level each vendor requires, since some vendors include SSO only in higher tiers.