In this guide 6 sections
You likely need single sign on when staff share logins, leavers keep access for days, password resets fill your help queue, or customers send security questionnaires you cannot answer. If you run four or five tools and one person manages them, it can wait.
Signs that point to single sign on
Start with the shared login. Simple. If the sales team uses one account for the CRM because licences cost too much, you cannot tell who exported the customer list. Single sign on gives each person an identity that every tool recognises.
Next, count the reset tickets. Be honest. When the helpdesk spends part of every Monday resetting accounts, passwords are costing real time. One login means one reset.
Then watch a leaver. Resign on Monday, gone by Monday? If the finance clerk still opens the accounting package on Thursday after resigning on Monday, your process depends on someone remembering twelve places.
- Shared accounts for paid tools
- Reset tickets every week
- Leavers keep access for days
- Staff keep passwords in spreadsheets or chat
- A customer questionnaire asks about SSO and MFA
What a customer questionnaire is really asking
Larger buyers send forms with lines such as: do you enforce multi-factor authentication, can access be revoked centrally, are logins logged. A small supplier that answers no loses deals quietly.
Read the form. Do it before deciding. If three of your last five questionnaires asked about SSO, the market has told you the answer. Single sign on with enforced MFA makes most of those lines a simple yes.
Your own product may need it too. Business customers often ask to sign in to a portal with their own company directory.
Signs it can wait
A team of eight using five tools, each with MFA switched on and a password manager, is in decent shape. A person who owns the admin consoles can remove a leaver in ten minutes.
Cost matters. A lot. Many vendors sell SAML single sign on only on their higher plans, so adding it can raise every subscription. Check each tool’s pricing page before you promise anything.
Better steps first: turn on MFA everywhere, retire shared accounts, and keep a list of every tool with its admin. That list is the base for SSO anyway.
What it needs from your identity provider
You need a directory to hold people, groups and MFA rules. Google Workspace, Microsoft Entra ID and Okta are common choices. The applications connect to it through SAML or OpenID Connect.
Check each tool for support before you buy. Some accept SAML only. Some need SCIM so that new starters appear automatically and leavers disappear. Internal apps can use OAuth or OpenID Connect libraries.
Plan roles as well. Signing in is one question and what a person may do inside is another. Map groups to roles so a manager’s group grants approval rights without a manual step.
- A directory with groups and MFA enforcement
- SAML or OpenID Connect support in each tool
- SCIM for automatic joiners and leavers
- A break-glass admin account stored safely
- A role map from directory groups to app permissions
A sensible way to roll it out
Pilot with one tool. One team. The CRM is a good first choice because many people use it daily. Fix the surprises there before moving on.
Keep a fallback. It matters. If the identity provider has an outage, someone still needs to reach the admin consoles. Store that emergency login offline and test it twice a year.
Write the offboarding steps afterwards: disable the directory account, revoke sessions, transfer files. Run them on the next leaver and time the result.
SSO readiness worksheet
A one-page worksheet. The first table lists every tool with columns for owner, plan, SAML or OpenID support, SCIM support, shared accounts and MFA status. The second block scores five signs, from shared logins to customer questionnaires, with yes or no. A closing box records the verdict, the pilot tool and a date.
Open a blank worksheet to printQuestions owners ask
Is single sign on the same as a password manager?
No. A password manager stores separate passwords for you. Single sign on replaces many logins with one identity that each tool trusts. Small teams often use both.
Does single sign on replace multi-factor authentication?
No. It gives you one place to enforce MFA. Without that rule, a stolen directory password opens every connected tool.
Can we add SSO to an app we built ourselves?
Yes. Most frameworks have libraries for OpenID Connect or SAML. The harder part is mapping directory groups to roles inside the app.
What happens if the identity provider goes down?
Staff may be locked out of everything. Keep an offline break-glass admin login and check your provider’s status page habits before choosing.