What is single sign-on (SSO)?
Single sign-on means that a user signs in once and can then reach several systems with the same account.
Sign-in is handled by a central identity service that the organisation already uses. The connected systems trust that service and need no passwords of their own.
For the user it is simpler, with fewer passwords to keep track of. For the organisation it is safer, because accounts, two-step verification requirements and leavers are all managed in one place.
When someone leaves, closing their account in the identity service is enough. Access to every connected system ends at the same time.
How it works
When the user opens a system, they are sent on to the identity service. Sign-in happens there, often with multi-factor authentication. The identity service then sends back a signed statement confirming who the user is, and the system lets them in.
The statement can also carry details of groups and roles. The system can then grant the right permissions without keeping a list of its own.
Why it matters
Every separate account is a risk. Passwords get reused, forgotten or left behind after someone leaves. With single sign-on there is one account to protect, under the rules the organisation already has. It also makes it easier to introduce multi-factor authentication everywhere.
What to keep in mind
The identity service matters more when everything goes through it. Protect it well and have a plan for what happens if it cannot be reached.
Check that roles and groups carry over to the system, so that access control rests on the same information as in other systems.
What it means for you
Require new tools, AI tools included, to use your existing sign-in. They then fall under the same rules as the rest of your systems.
Common questions
Is single sign-on safer than separate passwords?
As a rule yes, especially together with multi-factor authentication. There are fewer passwords to steal and closing an account is simpler. Read more about multi-factor authentication.
What happens if the identity service stops working?
Then nobody can sign in to the connected systems. The identity service therefore needs to be resilient, and administrators may need a fallback route.
Sources: NIST on single sign-on
Related terms
Read more
All terms Updated