What Is Single Sign-On (SSO)?

Definition

Single sign-on (SSO) lets a person sign in once with one company account and then open many business apps without separate passwords. NIST describes it as "an authentication process by which one account and its authenticators are used to access multiple applications in a seamless manner, generally implemented with a federation protocol."

How It Works

SSO puts one identity provider (IdP), such as Microsoft Entra ID, Google Workspace, or Okta, in charge of logins. Apps like payroll, CRM, file sharing, and accounting trust the IdP instead of keeping their own passwords.

A user opens an app, which redirects them to the IdP.
The IdP checks the password, MFA, and any device or location rules.
If the checks pass, the IdP sends the app a signed assertion or token (SAML or OpenID Connect) saying who the user is.
The app lets the user in without ever seeing their password.

The security payoff is central control. MFA, conditional access, and logging are set once and apply everywhere. Disabling one account at offboarding removes access to every connected app at the same moment, instead of someone hunting through a dozen separate admin panels.

The trade-off is concentration. The SSO account becomes the key to everything, so it needs phishing-resistant MFA, tight help desk procedures for password and MFA resets, and monitoring of sign-ins. A single compromised SSO identity can reach every app behind it.

Real-World Example

The FBI and CISA advisory on Scattered Spider (AA23-320A, last revised July 29, 2025) shows attackers going straight for SSO. The group registered look-alike domains that append the target's name with words like "-sso," "-helpdesk," or "-okta" to make phishing pages more convincing. It also made "spearphishing calls to convince IT help desk personnel to reset passwords and/or transfer MFA tokens," after which, the advisory says, "the threat actors perform account takeovers against the users in SSO environments." One reset at the help desk opened every app behind that identity.

Why It Matters for a Small Business

Small businesses often run a long list of cloud apps, each with its own password and its own forgotten admin account. SSO cuts that sprawl, makes MFA consistent, and turns offboarding into one step. It also means the owner can answer a cyber insurance question like "is MFA enforced on all cloud apps?" with confidence. The catch is that SSO raises the stakes on the help desk: whoever can reset an SSO password or MFA method can open everything, so reset requests need real identity checks.

How to Spot It / How DTS Handles It

Warning signs: separate passwords for every app, former staff still in some apps after they were removed from email, MFA on email but not on payroll or file sharing, and password resets granted over the phone without verification.

DTS can help with connecting business apps to Microsoft 365 or Google Workspace sign-in where the apps support it, turning on MFA and conditional access centrally, and setting verification steps for reset requests. See our Microsoft 365 security service, or our managed IT service.

Related Terms

Identity provider (IdP): the service that runs SSO logins.
SAML: a common protocol behind SSO.
Multi-factor authentication (MFA): the control SSO applies everywhere at once.
Conditional access: sign-in rules enforced at the IdP.
Account takeover: what a stolen SSO identity becomes.
Phishing: the usual first step against SSO users.
Offboarding and access review: one disable, every app.
Zero trust: identity-centered access built on SSO.

Sources

NIST CSRC Glossary, Single Sign-On (from NIST SP 800-209 and SP 800-95): https://csrc.nist.gov/glossary/term/single_sign_on
FBI and CISA, Cybersecurity Advisory AA23-320A: Scattered Spider (November 16, 2023; last revised July 29, 2025): https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a

Last updated October 14, 2026.