One login, many services
Single sign-on, often shortened to SSO, lets a person authenticate once and then reach multiple applications without signing in to each separately. Instead of a different username and password for email, a calendar, a payroll system and a dozen other tools, the person signs in once to a central service and is then admitted to the rest.
Many people have used a consumer version of this idea when a website offers to let them sign in using an existing account from a large provider. Workplaces use a similar approach internally.
How it works in outline
Several roles are involved.
- The identity provider is the central service that holds your account and verifies who you are.
- The applications (sometimes called service providers or relying parties) trust the identity provider to do that verification.
- The user wants access to the applications.
The sequence is roughly as follows. You try to open an application. It does not ask for a password. It redirects you to the identity provider. If you have not already signed in, the provider asks for your credentials, possibly including a second factor. Once you pass, the provider sends the application a signed message, often called a token or assertion, stating that you are who you claim to be and sometimes including details such as your role. The application checks the signature, trusts it, and lets you in. Open standards exist for this exchange, so applications from different makers can work with the same provider.
The applications never see your password. They see only a signed statement from the provider they trust.
Benefits for users
- Fewer passwords. One strong credential replaces many. This lowers the pressure to reuse or simplify passwords, which is a common cause of account compromise.
- Faster access. Switching between tools requires less typing and fewer interruptions.
- Fewer resets. Forgotten passwords are a routine support burden, and reducing the number of passwords reduces the number of resets.
- Familiar experience. Sign-in looks the same across applications, which can make it easier to spot something unusual.
Benefits for administrators
- Central control. Accounts and permissions are managed in one place rather than inside every application separately, a core part of identity and access management.
- Faster onboarding. A new employee can be given the right set of applications by assigning roles once.
- Reliable offboarding. When someone leaves, disabling the central account can cut off access to many systems at once. Without SSO, administrators must remember every separate login, and a forgotten one can linger.
- Consistent policy. Requirements like multi-factor authentication can be enforced at one point instead of configured in each tool.
- Better visibility. Sign-in records are collected centrally, making it easier to review who accessed what and to notice unusual patterns.
- Support for least privilege. Role-based assignment helps apply least privilege consistently across tools.
The concentration risk
The same feature that makes SSO convenient also makes it a high-value target. If one login opens many doors, then an attacker who obtains that login, whether through phishing scams, a stolen session or a weak recovery process, may reach many services at once. This is the central trade-off, sometimes described as putting all your eggs in one basket.
Other risks to consider:
- Outages. If the identity provider is unavailable, people may be unable to reach any connected application. Organizations often plan for this with backup procedures.
- Provider dependence. Relying on one provider for sign-in can deepen reliance on that vendor, a theme discussed under vendor lock-in. When the identity provider is a cloud service, the division of security duties follows the shared responsibility model.
- Misconfiguration. A single wrong setting in the central system can affect every application connected to it.
- Incomplete coverage. Some older or specialized applications cannot join SSO and remain separate, so the number of passwords falls but does not reach zero.
- Session length. Staying signed in for convenience can leave open sessions on shared or lost devices.
Reducing the risk
Organizations that adopt SSO commonly treat the central login as the most protected account on the system.
- Require multi-factor authentication, ideally with methods resistant to phishing.
- Apply extra scrutiny and logging to administrator accounts.
- Set sensible session lengths and re-check sign-in for sensitive actions.
- Monitor for unusual sign-ins, such as impossible travel between distant locations.
- Keep backup and recovery procedures documented and tested.
- Plan for the identity provider being unavailable.
Passkey sign-in can also strengthen the central login, since it avoids the shared secret that attackers try to steal.
Is it worth it?
For most organizations of any size, the reduction in password sprawl and the improved control at departure are significant advantages, and many security frameworks encourage centralizing authentication. For a very small group using a few services, the added setup and cost may outweigh the benefit. The decision depends on how many applications are in use, how often people join and leave, what the provider costs, and how well the central login can be protected.
A note on terminology: single sign-on is sometimes confused with a password manager. A password manager stores separate passwords and fills them in; SSO changes how applications verify you so that separate passwords are not needed. Some environments use both.
This article is general information, not security or compliance advice. Consult qualified professionals for decisions about specific systems.