Single Sign-on (SSO).
Single sign-on (SSO) means that employees or customers sign in once and can then use several applications without entering a password again. Sign-in is handled by a central identity service that all connected applications trust.
Single Sign-on (SSO) — Explained in Detail
With single sign-on there is one central place where sign-in happens: the identity provider, often called IdP. In many companies that is Microsoft Entra ID (formerly Azure AD) or Google Workspace. Every connected application, such as the CRM, time tracking or an internal portal, does without its own password management and redirects to this identity provider at sign-in. If the person is already signed in there, they come back without any further input and are signed in to the application too.
Technically, two standards are mainly behind it. SAML 2.0 is the older, XML-based standard that is widespread in enterprise software. OpenID Connect builds on OAuth 2.0, works with JSON and is common in modern web and mobile applications. Both achieve the same goal: the application receives a signed confirmation of who the person is and which groups or roles they have, without ever seeing a password.
The benefit is twofold. For employees, everyday life with a dozen passwords disappears. For the company, security can be controlled centrally: two-factor authentication or passkeys are required once at the identity provider and apply to all applications. And when someone leaves the company, a single account is disabled instead of searching ten systems for access one by one. SMEs often underestimate this last point until a former employee's access is still active months later.
SSO has limits too. The identity provider becomes a single point of failure: if it is unavailable or an account there is compromised, all connected systems are affected. Strong protection of exactly that account is therefore mandatory. Moreover, not every piece of software supports SSO, or it offers it only in expensive plans. With your own software, such as a web app or a CRM, SSO can instead be planned in from the start.
SSO for employees and for customers
SSO usually refers to employee sign-in: a company connects its internal tools to the existing Microsoft or Google account. That is distinct from customer sign-in, for example in a customer portal. There it is more about convenient sign-in options such as 'Sign in with Google', a magic link, an email code or passkeys.
With business customers a third case arises: larger customers want their own employees to sign in to your portal with their company account. This is called federated SSO, and for business software it is often an explicit requirement in tenders.
Example: a fiduciary office with six tools
An example: a fiduciary office with twelve employees works with Microsoft 365, accounting software, time tracking, a document archive and a custom client portal. Every system has its own accounts, and when someone leaves, an access is regularly forgotten. Now every system that supports it is connected to Microsoft Entra ID; the client portal receives an OpenID Connect integration for this.
Two-factor authentication is now required in only one place. When someone leaves, disabling one account is enough. For tools without SSO support a list is kept so they are not overlooked at departure. How we implement sign-in and permissions in custom software is described on the page custom software Switzerland.
Related Page
OAuth 2.0Frequently Asked Questions About Single Sign-on (SSO)
Generally yes, because password reuse disappears and strong sign-in methods such as 2FA or passkeys apply centrally to all applications. In return the central account becomes more valuable, so it must be particularly well protected.
Both enable SSO. SAML is older, XML-based and widespread in traditional enterprise software. OpenID Connect is based on OAuth 2.0 and JSON, is easier to implement and is common in modern web and mobile apps. Many identity providers support both.
As soon as several employees use several applications and Microsoft 365 or Google Workspace is already in use, usually yes: the identity provider is already there, and the biggest gain is cleanly disabling access. The limitation is tools that offer SSO only in their most expensive plan.
More Terms Starting with "S"
Schema Markup
Schema Markup (Schema.org) is a semantic vocabulary for structuring website content. It helps Google...
SEO (Search Engine Optimization)
SEO (Search Engine Optimization) encompasses all measures to make a website more visible in the orga...
Server-Side Rendering (SSR)
Server-Side Rendering (SSR) means that HTML pages are generated on the server and sent fully rendere...
Ready for Your Project?
Apply this knowledge to your website — DLM Digital will help you.