What is an SSO (Single Sign-On)?

SSO works by having applications trust a central identity provider (IdP) rather than each maintaining its own password database. Standard protocols — SAML for enterprise web apps, and OpenID Connect (built on OAuth 2.0) for more modern systems — define how the IdP issues a signed assertion or token proving the user's identity, which the relying application verifies and uses to establish a session. This removes the need for users to juggle separate passwords per app and lets an organization centrally enforce policies like multi-factor authentication, password rotation, and instant deprovisioning when an employee leaves. For enterprises, SSO is often a hard requirement before adopting new software, since it plugs directly into existing identity governance (Okta, Azure AD, Google Workspace) and satisfies audit requirements around centralized access control. From a security standpoint, SSO both reduces attack surface (fewer passwords to phish or leak) and concentrates risk (compromising the IdP compromises everything downstream), which is why IdP-side hardening matters disproportionately.