SSO (Single Sign-On)

The security control that simultaneously reduces risk and eliminates the single largest source of IT helpdesk tickets.

Password-related issues account for 20-50% of all IT helpdesk tickets, costing organisations an estimated $70 per password reset and consuming millions in annual support costs at large enterprises. Single Sign-On eliminates this burden whilst dramatically improving security posture — a rare win-win in cybersecurity. Organisations implementing SSO report 50-80% reductions in password-related support calls, 40% fewer successful phishing attacks, and measurable improvements in employee productivity. With the average enterprise employee accessing over 30 applications daily, SSO has evolved from a convenience feature to a critical component of enterprise security architecture and operational efficiency.

What It Is

Single Sign-On is an authentication method that allows users to access multiple applications and services with a single set of credentials. Rather than maintaining separate usernames and passwords for every tool — email, CRM, HR system, cloud storage, project management — employees authenticate once and gain seamless access to all authorised resources. Think of it as a master key for a hotel: instead of carrying separate keys for your room, the gym, the business centre, and the car park, one keycard grants access to everything you are authorised to use.

Behind the scenes, SSO works through federated identity protocols. When a user signs in, the SSO system generates a secure token that is passed between applications, verifying the user's identity without requiring them to enter credentials again. The most common protocols are SAML (Security Assertion Markup Language), used primarily for enterprise applications; OAuth 2.0 and OpenID Connect, dominant in consumer and cloud applications; and Kerberos, common in Windows enterprise environments. These protocols establish a circle of trust between the identity provider and the applications, enabling seamless and secure access.

SSO is typically implemented through an Identity Provider (IdP) — a centralised service that manages user identities and authentication. When a user attempts to access an application, the application redirects to the IdP for authentication. If the user has already authenticated with the IdP during their session, they are granted access immediately without seeing a login screen. This centralised approach also means that when an employee leaves the organisation, deactivating their account in the IdP instantly revokes access to all connected applications.

Why It Matters for Business

The business case for SSO is compelling from both security and productivity perspectives. Security first: the average cost of a data breach reached $4.88 million in 2024, and compromised credentials remain the number one attack vector. SSO enables organisations to enforce stronger authentication policies — multi-factor authentication, conditional access based on location and device, and session timeouts — at a centralised level rather than trying to enforce them across dozens of individual applications. This centralised control dramatically reduces the attack surface and ensures consistent security posture across the entire application portfolio.

From a productivity standpoint, the impact is significant and measurable. Research by Forrester Consulting found that the average employee spends 12.6 minutes per week simply logging into applications — time that is entirely eliminated with SSO. Across a 10,000-person organisation, that translates to over 100,000 hours of recovered productivity annually, worth approximately $5-8 million in labour costs. Additionally, SSO enables faster onboarding: new employees can be productive immediately rather than waiting days for individual application accounts to be provisioned.

SSO also delivers a governance benefit that is often overlooked. Without centralised authentication, organisations struggle to answer basic questions: Who has access to what? Which applications contain sensitive data? Are departed employees' accounts properly deactivated? SSO provides a single pane of glass for identity governance, enabling audit compliance, access reviews, and security monitoring that would be impossible with decentralised authentication across hundreds of applications.

Enterprise Use Cases

Microsoft Entra ID (formerly Azure Active Directory) is the most widely deployed enterprise SSO solution, serving over 95% of Fortune 500 companies. A typical enterprise deployment integrates Entra ID with Microsoft 365, Salesforce, Workday, ServiceNow, and hundreds of other SaaS applications, enabling employees to access their entire digital workplace through a single authentication. Companies like Procter & Gamble and Unilever have publicly discussed how SSO implementation streamlined access for over 100,000 employees across dozens of global offices, reducing helpdesk tickets by 60% and improving security compliance scores.

In the healthcare sector, SSO is critical for clinical workflows where every second matters. The NHS in the United Kingdom deployed SSO across its clinical systems, allowing doctors and nurses to access patient records, prescribing systems, and imaging platforms with a single authentication event — often using proximity badge authentication for speed. The programme reduced clinician login time by an average of 45 seconds per session, which across millions of daily interactions translates to thousands of hours of recovered clinical time. Similar deployments at Kaiser Permanente and the Mayo Clinic have demonstrated comparable results.

Financial services firms use SSO not only for employee access but also as part of customer-facing identity strategies. Banks like HSBC and JP Morgan Chase implement SSO patterns for their corporate clients, enabling treasury teams to access multiple banking services — payments, trade finance, foreign exchange — through a single authenticated session. This improves customer experience whilst maintaining the rigorous audit trails required by financial regulators.

Vendor Landscape

Microsoft Entra ID dominates the enterprise SSO market with approximately 45% market share, particularly strong in organisations using Microsoft 365. Okta, the leading independent identity provider, holds roughly 20% share and is favoured by organisations with diverse, multi-vendor application portfolios. Ping Identity (acquired by Thoma Bravo) serves large enterprises with complex hybrid environments. Google Workspace provides built-in SSO capabilities, popular with technology-native organisations. Auth0 (acquired by Okta) targets developer-centric SSO implementations, whilst Cisco Duo and IBM Security Verify serve specific enterprise segments.

Pricing varies significantly by vendor and scale. Microsoft Entra ID P2, which includes advanced features, costs approximately $9 per user per month. Okta's enterprise tier ranges from $6-15 per user per month depending on features. Organisations should evaluate total cost of ownership including integration effort, ongoing management, and the breadth of pre-built application connectors — a vendor with connectors for your specific application portfolio will deliver significantly faster time-to-value.

Strategic Considerations

SSO is a foundational security investment that should be prioritised in virtually every organisation. However, implementation requires careful planning. The identity provider becomes the single point of failure — if it goes down, employees cannot access any applications. Ensure high availability architecture with a minimum of 99.99% uptime SLA and test failover procedures regularly. Plan the rollout in phases, starting with the most critical and widely used applications. Engage business stakeholders early, as SSO implementation often reveals shadow IT applications that have been procured without IT oversight. Finally, always pair SSO with multi-factor authentication — SSO without MFA is like having a master key but leaving the door unlocked.