Mid-market companies are more pressed than ever to do more with their technology with fewer resources. Juggling multiple software-as-a-service (SaaS) applications, managing users for all of them, and maintaining security visibility. These are just some of the tech challenges facing smaller and mid-sized companies. Fortunately, one technology can help ease the pain.
Single sign-on (SSO) is just what it sounds like: a single set of credentials, such as a username and password, that lets a user access multiple online services. With SSO, instead of having to keep track of passwords for each service, say one for accounting and another for company documents, the user can log into both with one sign-on. The key that makes it work, and work securely, is a trusted third party, called an identity provider, or IdP.
SSO is undoubtedly more convenient for users. But it can also be more secure, thanks to that trusted IdP. SSO also helps IT teams enforce additional cybersecurity measures such as multi-factor authentication (MFA) and strong passwords. There’s more. SSO gives IT pros centralized identity and access management (IAM) and visibility into which applications users can access. In short, SSO represents a win for both users and IT teams.
SSO is industry agnostic, too. It provides effective security for companies of all industries, including legal, finance, accounting, healthcare, and manufacturing.
What is SSO?
At a high level, SSO is a way for companies and IT pros to manage user identities and user access to services. On a practical level, it’s also a way for users to access many services with just one username and password. The IT department manages access for them, based on authentication through an IdP as a trusted mediator. An IdP is itself a service. Prominent providers include Microsoft Entra ID, Okta, Ping Identity, and OneLogin.
How Does SSO Work?
SSO works by authenticating a user through an IdP. From the user’s perspective, they simply launch their application of choice. If the user isn’t already logged in, the IdP verifies the user’s identity (typically via username and password, plus any MFA requirements). The IdP then sends the requested application confirmation of the user’s identity to log the user in.
The magic happens behind the scenes. To log the user in to the requested application, the IdP generates a digitally signed token. The token attests to the application that the user is who they claim to be. The application verifies the token’s signature and validity, then grants access. This communication happens via specialized protocols. Trusted protocols include Security Assertion Markup Language (SAML) and OpenID Connect (OIDC).
What is an Identity Provider in SSO?
An SSO IdP acts as a trusted third party to verify identity, allowing users to log in to multiple services with a single set of credentials. A commonly used IdP is Microsoft Entra ID. According to Microsoft, the benefits of an IdP include better user experiences, enhanced security, and centralized identity management. Authentication via an SSO IdP also gives IT pros greater visibility into users and the apps they use. And it helps them enforce security policies.
For example, centralizing authorization through an IdP lets security teams monitor all sign-in activity in one place. Teams can enforce their own MFA policies across apps. They can impose conditional access for all logins. And in the event of a breach or to offboard an employee, an IdP lets teams disable user access across all apps.
To identify effective security policies, we recommend conducting a cybersecurity assessment and creating a cybersecurity strategy.
What Are the Benefits of SSO?
For the user, the benefits of SSO start with fewer passwords to remember (or write down and lose). Logging on to all the services they use also makes them more productive. They sign on once at the beginning of the day to access everything they need to work.
SSO reduces the workload of help desk support staffers, too. Fewer passwords mean fewer support calls to reset passwords and more time to handle more complex issues. SSO also helps support staff handle employee onboarding and offboarding more quickly and efficiently. That means new hires can start work more quickly, and departing employees leave behind fewer security gaps.
For security pros, SSO provides a central location to control access to online resources, such as SaaS applications, saving them time. It helps them deliver a more consistent (and secure) MFA experience by enforcing the company’s MFA policy uniformly across apps. And it improves their ability to monitor and trigger alerts across applications. That’s because it reduces their reliance on individual applications for authentication telemetry that might indicate misuse or a data breach. No need to monitor separate applications individually; teams can keep their eyes on everything in one place.
It all adds up to a more secure, convenient, and manageable experience for users and IT pros alike.
How SSO Improves Security Visibility
Without SSO authentication, external resources, such as SaaS applications, necessarily function as stand-alone islands. Each has its own authentication standard. For a user, that might look like one application requiring an eight-character password that includes numbers. Another application might require 12 characters, including select special characters. Annoying for users, and a potential security headache for IT teams.
In contrast, with SSO, login activity flows through a centralized IdP platform. That lets SSO authentication apply one set of security standards for logins across applications. Those standards can include any MFA requirements an IT department chooses.
IdP platforms also help IT pros monitor suspicious activity across applications, giving them broader visibility. Signals they can see in one place include sign-ins occurring impossibly far apart and other signs of account compromise. IdP platforms with machine learning capabilities can detect risky sign-ins based on usual patterns. They can detect suspicious consent activity, for example, when a user tries to grant an unauthorized application access to a trusted resource, and anomalous access attempts of all types.
In addition to generating alerts of their own, IdP platforms can integrate with existing managed detection and response (MDR) systems for even broader visibility.
SSO, SAML, OIDC, SCIM, LDAP, and Federated SSO Explained
Here’s a quick rundown of common SSO-related terms, starting with the difference between SSO and SAML. Single sign-on (SSO) is an access model that allows a user to access multiple online services with a single login. Security Assertion Markup Language (SAML) is a data protocol enabling secure SSO logins. OpenID Connect (OIDC) is another trusted protocol, one optimized for web and mobile applications.
Lightweight Directory Access Protocol (LDAP) is an older protocol that supports legacy on-premises applications. It enables applications to access and manage directory information used for authentication, but it is not optimized for modern online applications. Some organizations with a mix of on-premises and web applications use LDAP as well as modern cloud SSO technologies.
Not to be confused with SSO, System for Cross-Domain Identity Management (SCIM) is a protocol for exchanging identity attributes, such as names, email addresses, usernames, roles, and group membership. It helps teams automate user provisioning and deprovisioning, simplifying identity lifecycle management. Taking SSO to the next level, federated SSO enables SSO across computer systems and trusted organizations.
How to Implement SSO
Here’s the easiest way to implement SSO, including support for MFA.
1. Establish a Strong Identity Foundation
SSO can only be as secure as the identity foundation on which it’s built. That’s why step one for implementing SSO is to set up an identity provider for SSO authentication. We recommend Microsoft Entra ID as a secure, trusted identity platform, but you can work with any authoritative IdP.
Once you’ve chosen an IdP, you’ll need to configure your company’s identity directory within it, known as the tenant. From there, you can populate the tenant with user accounts, including passwords.
2. Prioritize High-Value Applications
Set up your most important applications for SSO first. That includes key productivity apps such as those within Microsoft 365. It also includes VPN, remote access, and collaboration tools. Not only does your company rely on such apps for vital operations, but they also handle sensitive information. All of which makes establishing secure logins to these apps mission-critical.
This step also includes configuring protocols such as SAML and OIDC to enable connections between applications and your IdP.
3. Add MFA, Conditional Access, and Monitoring
Now it’s time to define security policies. Policies should specify who has permission to access which apps and the MFA requirements for SSO. Also consider implementing conditional access, for example, user access contingent on approved behaviors and locations. You can also define trusted devices and integrate identity-monitoring tools in this step.
Finally, integrate SSO with any MDR solutions you already have in place. For example, you can route Microsoft Entra Identity logs to your MDR tools, adding SSO, MFA, conditional access, and identity monitoring signals to the MDR mix to enhance detection of security risks.
4. Govern and Optimize Over Time
Once you have SSO authentication up and running, you’ll need to govern it, enhancing and expanding it as you go. Maintenance to-dos include ongoing provisioning validation (i.e., adding new users) and regular reviews of application permissions to add or remove access as company personnel and needs change.
You’ll also need to roll out coverage to any new apps and services your company adds to its tech stack. And you’ll have to ensure continued alignment with your company’s cybersecurity compliance needs, industry-specific regulatory compliance, any cyber insurance requirements, and your company’s Zero Trust targets.
SSO Security Risks and Best Practices
There’s no doubt that when implemented properly, SSO authentication enhances security. But it does also require vigilance and adherence to best practices to mitigate attendant risks. For example, companies must take extra care to safeguard access to IdP accounts to avoid compromise by bad actors. And all the same security best practices apply to IdP account access as to individual SSO access.
Good login security starts with multifactor authentication. But beware of weak or easily compromised MFA factors such as email accounts with insecure passwords. MFA fatigue may also lead users to take shortcuts with MFA. For example, if given the choice, users may opt for less secure email or text messages rather than more secure authentication apps.
Granting permissions to users who don’t need access to a given service also poses risks. That includes access still in place for ex-employees. Automated provisioning and deprovisioning of user accounts help here, as does regularly reviewing who has access to what applications. Don’t forget to review your tech stack for unmonitored app consent and add any apps you missed to SSO.
For enhanced security, institute conditional access. That means making access dependent on more than just a traditional login. Conditional access takes into account such factors as when and where a user logs in. Did someone just try to log in from Bangalore five minutes after logging in from Los Angeles? Conditional access helps reduce the risk of session hijacking and token theft.
How to Choose an SSO Solution
Where to get SSO solutions may come down to the tech you already have. For example, Microsoft Entra ID is included with Microsoft 365 licensing. Google is also in the game with its Cloud Identity. Okta and JumpCloud are two popular stand-alone identity solutions.
Just be sure that your chosen solution supports trusted protocols such as SAML, OIDC, and SCIM. It should also include MFA and conditional access functionality and integrate with your existing SaaS applications.
Also look for automated user provisioning and deprovisioning. Evaluate how well the solution integrates with your environment, taking into account your team’s skills and availability. Finally, consider the level of support you’ll require from the provider and how often you might need it.
Xantrion can help you choose and implement an SSO solution. We provide hands-on assistance in San Francisco, San Jose, Sacramento, Los Angeles, and San Diego.
FAQs About SSO
What does single sign-on (SSO) mean?
SSO stands for single sign-on. It is both a user experience and an access model for online resources such as software-as-a-service applications. With SSO, a user logs in to a pre-approved set of resources and applications using a single set of credentials. Behind the scenes, security policies grant access to individual resources based on user identity and factors such as location.
What is the difference between SSO and SAML?
SSO stands for single sign-on. It’s a way for users to access a range of online resources with a single login. Security Assertion Markup Language (SAML) is a data protocol that enables SSO.
How does SSO work with SAML?
Single sign-on (SSO) uses the Security Assertion Markup Language (SAML) protocol to send a user authentication attestation to an online application. The application then verifies the attestation before granting the user access based on predefined SSO permissions.
What is the difference between SCIM and SSO?
Single sign-on (SSO) is a way for users to log in to multiple applications with one set of credentials. System for Cross-Domain Identity Management (SCIM) is a standard for exchanging user and group identity data between systems to automate provisioning and deprovisioning.
How is MFA used with SSO?
Multifactor authentication (MFA) works with single sign-on (SSO) in the same way as other login methods. After entering their credentials, the user is prompted to complete identity verification via an authentication app or other method. The key difference with SSO is that the same MFA policies apply across all apps under management.
What is the easiest way to implement SSO?
Implementing single sign-on (SSO) starts with setting up an identity provider such as Microsoft Entra ID. From there, add mission-critical applications to the SSO and establish user and security policies, including MFA and conditional access. Implementation also requires ongoing governance to adapt to changing compliance and business needs. A trusted cybersecurity management provider such as Xantrion can help at each stage.
