Single Sign-On (SSO)

Single Sign-On (SSO) is an authentication method that lets a user sign in once with one set of credentials and then access multiple independent applications without logging in again. An identity provider authenticates the user and passes a trusted token to each connected service, which removes repeated logins and centralizes identity verification across a company's SaaS stack.

How SSO works

• A user requests access to an application (the service provider).
• The application redirects the user to a central identity provider (IdP) such as Microsoft Entra ID, Okta, or Google Workspace.
• The IdP authenticates the user, often combined with multi-factor authentication.
• The IdP issues a signed token (typically via SAML or OpenID Connect) that the application trusts.
• The user gains access, and the same session is reused across every SSO-connected app.

Examples and use cases

A 200-employee scale-up connects Slack, Notion, HubSpot, and AWS to a single IdP. An engineer logs in once in the morning and reaches all four tools without re-entering passwords. When that engineer leaves, disabling the central identity blocks every downstream app at once, which closes the offboarding gap that manual password management usually leaves open.

The hard part for IT is not turning SSO on. It is knowing which apps actually sit behind SSO and which ones (often shadow purchases) do not. That visibility gap is where access risk and license waste accumulate.

Related concepts

• Multi-Factor Authentication (MFA)
• SAM and OpenID Connect (OIDC)
• Identity Provider (IdP)
• Live article: SSO, SCIM and SAML: key technologies for automated user provisioning
• Live article: How Corma integrates with Google SSO

FAQ

Is SSO the same as MFA?

‍No. SSO controls how many times you log in, while MFA controls how strongly each login is verified. They are complementary, and most secure setups use both together.

Does SSO cover every SaaS app?

‍Not automatically. Apps that do not support SAML or OIDC, and apps bought outside IT, stay outside SSO. Discovering those gaps is a prerequisite to full coverage.

What happens to access when an employee leaves?

‍Disabling the central identity revokes SSO-based access everywhere at once, but any non-SSO app still needs separate deprovisioning.

Corma maps which apps sit behind your IdP and which do not, then automates access across the gap. See Corma for IT teams or request a demo.