Single sign-on lets people use one set of credentials, held by one identity provider, to reach every application they are entitled to, instead of a separate password for each.
The short answer
SSO means a user authenticates once with a central identity provider, which then vouches for them to each application. The application never sees the password. For a company it means one place to enforce MFA, one place to revoke access when someone leaves, and one audit trail of who signed in to what.
The security value is not convenience. It is that access is granted and removed in one place, which is what makes offboarding reliable.
How SSO works
SAML and OIDC
Two protocols do almost all of this. Both let an identity provider vouch for a user; they differ in age and in what they were designed for.
| SAML 2.0 | OpenID Connect | |
|---|---|---|
| Format | XML assertion | JSON web token |
| Built for | Browser-based enterprise applications | Web, mobile and API clients |
| Built on | Its own specification | OAuth 2.0 |
| Common in | Established B2B SaaS and internal tools | Newer applications and consumer sign-in |
SSO and MFA are not alternatives
SSO decides where authentication happens. MFA decides how strong that authentication is. SSO without MFA concentrates risk, because one password now opens every application at once.
What SSO does not cover
Systems outside it
Direct database access, SSH into production and legacy admin panels usually sit outside the identity provider.
Tools bought by teams
Anything signed up for on a card, without IT involvement, has its own password and its own offboarding gap.
Service accounts
Machine identities and API keys are not people and do not pass through the sign-in flow at all.
How Osto handles access
Osto’s IAM module manages identity and access across the stack, and ZTNA closes the gap SSO leaves. Internal resources sit behind a private domain and stay unreachable unless the Osto endpoint agent is installed and MFA is satisfied, which covers the systems that were never wired into an identity provider in the first place. Sign-in events also land in the same platform as endpoint and cloud activity, so a suspicious authentication can be correlated with what happened next.
Free security assessment
Cover the systems SSO never reached
Osto gates internal resources behind ZTNA with agent and MFA enforcement, and manages identity across the stack.
Get a free security assessment Book a platform walkthroughDeploys in hours · No dedicated security team required · One platform, everything
Frequently asked questions
What does SSO stand for?
Single sign-on. A user authenticates once with a central identity provider, which then vouches for them to each connected application without asking for credentials again.
Is SSO more secure than separate passwords?
Generally yes, because MFA is enforced in one place, access is revoked in one place, and applications never receive the password. It does concentrate risk in the identity provider, which is why phishing-resistant MFA on that account matters.
What is the difference between SSO and federation?
SSO describes the user experience of authenticating once. Federation is the trust relationship between an identity provider and a service provider that makes it possible. SAML and OIDC are federation protocols.
Do auditors ask about SSO?
Yes. Security questionnaires and auditors ask whether SSO is enforced, which systems sit outside it, and how access is removed when someone leaves. The systems outside SSO are usually where findings come from.