SSO (Single Sign-On)

Definition

Single sign-on lets a user authenticate once with a central identity provider – in an SMB, usually Microsoft Entra ID or Google Workspace – and then reach every connected application without separate passwords, using standards such as SAML and OpenID Connect. The application trusts the identity provider's assertion instead of keeping credentials of its own.

Why it matters to an MSP

SSO is the mechanism that makes IAM policy enforceable. Every application connected to the identity provider inherits its MFA, conditional access, and device-compliance rules automatically, so you configure security once instead of app by app, and disabling one account cuts off every connected service at the same moment – the only reliable way to make employee offboarding complete. Without it, each SaaS tool is an island with its own password, its own MFA setting (usually off), and an account that outlives the employee – which is how shadow IT persists and how a forgotten login becomes the entry point for a BEC incident. The answer to shadow IT is not prohibition but putting sanctioned tools behind SSO, where they're visible and governed.

Password resets typically make up 20–30% of help desk ticket volume, and SSO with self-service reset removes most of them. Microsoft 365 Business Premium includes Entra ID P1, so conditional access and SSO to thousands of gallery apps are usually already licensed. The catch is the "SSO tax": many SaaS vendors gate SAML support behind enterprise tiers that can double per-seat cost, so audit the client's application list before promising everything goes behind SSO. Cyber insurance questionnaires now ask whether MFA covers all cloud applications; SSO is how you answer yes honestly. For the full design, see identity and access for SMB.

Related terms: IAM, MFA, Shadow IT, Zero Trust