{"head":{"title":"What Is SSO (Single Sign-On)? Definition | OceanLab","description":"Single sign-on lets people use one login for many apps, run by their company's identity provider. How SSO works, why buyers ask for it and mistakes.","canonical":"https://oceanlab.in/glossary/sso"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"SSO","path":"/glossary/sso"}],"slug":"sso","term":"SSO (single sign-on)","aka":["single sign-on"],"category":"Identity and security","short":"One login, managed by an identity provider, that gives a person access to many separate apps.","body":[["With SSO a user signs in once with a central account, such as their work account, and is let into each connected app without a separate password. The apps trust the identity provider to confirm who the user is, using a standard such as ",{"href":"/glossary/saml","text":"SAML"}," or OpenID Connect."],["Consumer apps offer a lighter version, such as Sign in with Google or Apple. In B2B software, SSO usually means the customer's own identity provider controls access to your product."]],"why":["For buyers, SSO means fewer passwords, central MFA and instant offboarding. For vendors, it is often the line between a team plan and an enterprise plan. It also cuts support load from password resets."],"example":["A bank's staff use a reporting product every day. With SSO through the bank's identity provider, a new analyst gets access by being added to a group, and the bank's MFA policy applies without the product building its own."],"inBuild":["We design accounts so a user can belong to a tenant that enforces SSO, with a fallback admin login for lockouts. Login method, domain verification and just-in-time account creation are settings per tenant, and every sign-in is written to the ",{"href":"/glossary/audit-log","text":"audit log"},"."],"mistakes":[["Adding SSO late to a user model that assumed one password per user."],["Not verifying that a customer owns the email domain they claim for SSO."],["Keeping user sessions alive for weeks, so a disabled account still works."]],"related":[{"href":"/glossary/saml","label":"SAML (Security Assertion Markup Language)","detail":"An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app."},{"href":"/glossary/oauth","label":"OAuth 2.0","detail":"A standard that lets an app get limited access to a user's account on another service, without ever seeing their password."},{"href":"/glossary/rbac","label":"RBAC (role-based access control)","detail":"An access model where permissions are attached to roles, and people get access by being given a role."},{"href":"/glossary/audit-log","label":"Audit log","detail":"A record of who did what in a system, when and from where, kept so actions can be traced later."},{"href":"/glossary/multi-tenancy","label":"Multi-tenancy","detail":"One running copy of a software product serving many customers, called tenants, with each tenant's data kept apart."}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"},{"href":"/tools/saas-pricing-calculator","label":"SaaS pricing calculator","detail":"Free tool"}],"links":[{"href":"/pricing/categories/auth","label":"Auth pricing","detail":"Login and identity service prices, with sources."},{"href":"/software","label":"Software by industry","detail":"Systems we build per industry, with guides and tools."}],"sources":[],"legal":false,"updatedAt":"2026-10-25"}