What is SSO and Why Does It Matter?

What is SSO?

SSO in IT stands for Single Sign-On. In the simplest terms, it means that you log into your organization’s systems with one user identity. Most people have already met something SSO-like in the wild: the “continue with Google,” “continue with Microsoft,” or “continue with Apple” button on a consumer site. Same idea, one identity opening many doors — the difference is that at work, your organization owns that identity.

Why Is It So Important?

Why is this important for building scalable organizations? It’s the glue that connects your various SaaS and IT systems. It’s what lets you get employees onboarded quickly. It’s what reduces the potential for having your systems compromised by poor password hygiene.

SSO also underpins the necessary infrastructure for graceful tool integration and information sharing. When you have a bunch of systems and applications with different login names and passwords, getting them to talk to each other is impossible. This is one of the first obstacles organizations face when they need to start scaling.

One Identity Is Only as Strong as How You Protect It

Consolidating every login behind one identity raises the stakes on that identity. It’s still the right trade — but only if you protect it properly.

Multi-factor authentication is the baseline, and not all of it is equal. Codes sent by SMS and six-digit codes from an authenticator app can both be phished: an attacker who can talk someone into reading out a number is in. Passkeys and hardware security keys can’t be phished the same way, because the credential is bound to the site it was created for and never leaves the device.

So if you’re putting SSO in place now, turn on phishing-resistant MFA at the same time. Done together it’s one project. Done two years apart it’s two — and the second one almost always gets scheduled right after an incident.

For how identity fits into the wider picture, see Identity.

Little Pain Now or Big Pain Later

I won’t lie… getting your head around SSO upfront might feel like a distraction or a burden. However, it’s going to be a lot worse if you do it one or two years later. When you have to mangle user identities, write complicated migration scripts, reset applications, and deal with all the conflicting data to automate a process or system. Having a clear SSO strategy in place as you add applications to your technology stack will be an excellent tool to help choose the right tools for the business now and in the future.

My Feedback to SaaS Vendors: STOP Placing SSO in Your Top Tier Offerings Only

I’d like to now take a rare moment to get on my soapbox.

What I really don’t agree with, however, is vendors who put SSO in the highest tier of their offerings, usually the “enterprise” tier. The customer is forced to buy features they don’t need, To those doing this, STOP IT 🙏 PLEASE

This practice reduces the opportunity to create more secure environments. Ideally, SSO should be included in all offerings. However, as a vendor who is a responsible member of the global technology community, SSO should always be available as a standalone feature for anyone who asks for it.

It also raises big red flags when a vendor can’t offer SSO in its lower tiers. Is that because of poor architecture? Inflexible billing platforms? SSO should be like an airbag: a standard feature on all models.

SSO for Everyone

Your business should have an SSO strategy. Having it in place now will save so much pain later. If you have any questions about this and want to understand it better, reach out and book 30 minutes with me to get an understanding of how this can help your organization!