What is Single Sign-On (SSO)?
Single Sign-On (SSO) means employees log in once and then have access to all their systems without having to enter more passwords. One SSO login in the morning opens email, Teams, the finance system, CRM and the rest of the toolbox.
The gain is twofold. For employees: a working day without twenty different passwords. For security: fewer passwords mean fewer weak and reused credentials, fewer "forgotten password" tickets in the helpdesk and a significantly smaller attack surface. And when an employee leaves, all access is shut off in one place, instead of in twenty systems where you typically forget three.
How does Single Sign-On work technically?
Behind SSO sits an identity provider, in most Danish businesses Microsoft Entra ID. When an employee opens an app, the app sends the user to the identity provider, which confirms their identity (and requires MFA if the policy says so). The identity provider then issues a signed "proof of access" (a token) that the app trusts.
The language between app and identity provider consists of open standards: SAML (widespread in older and enterprise systems) and OpenID Connect/OIDC (the standard in modern cloud apps). Think of it as a passport: the app does not need to know the user itself, because it trusts the issuer's signature, just as passport control trusts the passport authority. The protocols are documented in detail on learn.microsoft.com.
SSO and MFA: security without friction
SSO without MFA is dangerous: Then one stolen password is suddenly the key to everything. But the combination is strong: Because there is only one login, that one login can be made very strong (MFA with number matching or passkeys, Conditional Access rules on device and location) without bothering users twenty times a day. One strongly protected login beats twenty weak ones. It is also the practical path into a Zero Trust architecture: all access goes through one control point where the policy is enforced.
Which systems support SSO?
More than most people think. Entra ID has a gallery of thousands of pre-integrated apps, including Salesforce, Zoom, Adobe, Slack and most Danish HR and finance systems in their cloud editions. Apps outside the gallery can typically be connected via SAML or OIDC, and even older internal web apps can often join via application proxy. Be aware that some SaaS vendors require a higher licence tier for SSO. That should be a factor when you choose new systems. Certificates play a role in SAML setups and must be renewed on time, which ties in with PKI management.
How MI Support IT can help
We set up SSO via Entra ID in your Microsoft 365 environment, connect third-party apps via SAML/OIDC and make sure MFA and Conditional Access come along, so the one login is also the secure login. If you want fewer passwords and more control, contact us.