SSO (single sign-on)
Also called single sign-on.
One login, managed by an identity provider, that gives a person access to many separate apps.
Last updated
What it is.
With SSO a user signs in once with a central account, such as their work account, and is let into each connected app without a separate password. The apps trust the identity provider to confirm who the user is, using a standard such as SAML or OpenID Connect.
Consumer apps offer a lighter version, such as Sign in with Google or Apple. In B2B software, SSO usually means the customer's own identity provider controls access to your product.
Why it matters
For buyers, SSO means fewer passwords, central MFA and instant offboarding. For vendors, it is often the line between a team plan and an enterprise plan. It also cuts support load from password resets.
In a product build
We design accounts so a user can belong to a tenant that enforces SSO, with a fallback admin login for lockouts. Login method, domain verification and just-in-time account creation are settings per tenant, and every sign-in is written to the audit log.
Common mistakes.
- 01
Adding SSO late to a user model that assumed one password per user.
- 02
Not verifying that a customer owns the email domain they claim for SSO.
- 03
Keeping user sessions alive for weeks, so a disabled account still works.
Work it out with a tool.
Related terms.
- SAML (Security Assertion Markup Language)An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app.
- OAuth 2.0A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
- RBAC (role-based access control)An access model where permissions are attached to roles, and people get access by being given a role.
- Audit logA record of who did what in a system, when and from where, kept so actions can be traced later.
- Multi-tenancyOne running copy of a software product serving many customers, called tenants, with each tenant's data kept apart.
Guides and pages
Browse the full glossary or read answers to common questions.
