What Is Single Sign-On (SSO) and How Does It Work?
✦ Key takeaways
- SSO lets you access many apps with one login and a central identity.
- It relies on a trusted identity provider that issues tokens proving who you are.
- It reduces password count and makes MFA and instant access revocation easier.
- It differs from a password manager: SSO is one real identity, not stored passwords.
Single Sign-On (SSO) is a mechanism that lets you access several different applications and services with one login and a single central identity. Instead of having a separate account and password for every tool at work — email, the invoicing system, the analytics dashboard, the chat app — you log in once with a trusted authority, which then unlocks the other apps without re-entering your password. This is what happens when you see a "Sign in with Google" or "Sign in with your work account" button.
To understand how it works, picture three parties: the user (you), the identity provider, which is the central authority that verifies you and holds your identity, and the service provider, which is the app you want to enter. When you try to open the app, it redirects you to the identity provider to verify you. If you're already signed in, the identity provider issues an encrypted token attesting that you are you, and the app accepts it and grants access — without ever seeing your password.
Invoice & Quotation Maker
Professional invoices that auto-calc & print/PDF in a minute.
This trust rests on open standards like SAML and OpenID Connect (built on OAuth 2.0). These standards define the shape of the tokens and how they're exchanged securely between the identity provider and the apps, so your password never travels to each individual service; it stays only with the identity provider.
The table shows the roles:
| Party | Role | Example |
|---|---|---|
| User | Requests access | An employee opening the analytics dashboard |
| Identity provider | Verifies and issues the token | Company identity system / Google account |
| Service provider | Accepts the token and grants access | The invoicing or chat app |
SSO's security benefits are significant, even though it looks like mere convenience. First, it reduces the number of passwords a user must remember, which usually cuts down on reusing a weak password across many sites. Second, you can enforce multi-factor authentication (MFA) at one central point instead of configuring it in every app. Third, when an employee leaves, IT can revoke access to all apps instantly by disabling a single identity — an important operational and security advantage for organizations.
It's important not to confuse SSO with a password manager. A password manager stores separate passwords for each site and fills them in for you, but each service still has its own independent account. SSO, by contrast, gives you a single real identity recognized by all connected apps. Both improve security, but they solve two different problems, and they can be used together.
The flip side is that the identity provider becomes a sensitive point: if your SSO account is compromised, it could open the door to every connected app. That's why protecting the identity account with strong MFA is non-negotiable, and periodically reviewing which apps are connected is wise.