Single sign-on
SSO / SAML single sign-on / federated sign-in
Single sign-on is a sign-in setup where one account at an identity provider, with its authenticators, opens many separate applications. It shapes how fast a departed employee is locked out, because NIST notes that ending a session at the identity provider does not necessarily end sessions already open in each app.
NIST defines single sign-on as an authentication process in which one account and its authenticators are used to access multiple applications, generally through a federation protocol. The identity provider checks the person and sends each app an assertion, a verifiable statement about the account. The app verifies the assertion, starts its own session and grants access.
Microsoft names two standard protocols. SAML 2.0 is a mature, XML-based standard common in enterprises, and OpenID Connect is built on OAuth 2.0. Its identity service also offers password-based SSO, which stores a username and password and replays them to the app. Linked SSO adds a link to the app in a portal, and Microsoft says it does not provide true single sign-on.
The sessions are separate. NIST says the session at the app will in most cases far outlive the assertion that opened it. Ending the person's session at the identity provider will not necessarily end sessions already open at each app. The two sides can pass end-session events to each other only where the protocol or a shared signaling system supports it.
The accounts are separate too. When an app creates accounts at first sign-in, NIST notes it only learns an account exists when that account is first used. Without a termination signal from the identity provider, the app could build up accounts nobody can reach through the identity provider anymore. Microsoft describes provisioning, increasingly built on the SCIM standard, as the way to deactivate accounts in connected apps when people leave. Where an app has no provisioning connector, Microsoft says accounts must be created manually, such as in the app's own admin portal.
SAML connections also rely on a signing certificate. In Microsoft Entra ID that certificate is valid for three years by default, and Microsoft advises a renewal process to prevent an outage when it expires.
In practice
A 40-person firm connects its email, customer records system and file storage to one identity provider using SAML. A sales manager resigns, and IT disables the manager's account at the identity provider that afternoon. The customer records tab still open on the manager's home laptop keeps working until that app's own session ends. A scheduling tool added only as a portal link still accepts the manager's old password until someone deletes that account. The figures are a worked example.
Why it matters to you
An identity provider gives the business one place to control access and apply consistent sign-in policies. Staff do not need separate authenticators at each app, so a multi-factor requirement is set where they sign in. NIST also has the identity provider tell each app the assurance level of the session. That one switch reaches only federated apps, and it removes app accounts only where provisioning is in place.
What to ask or check
- 01Does the software connect to your identity provider through SAML or OpenID Connect, or only through a stored password or a portal link?
- 02When your identity provider disables someone, how does the app end sessions that person already has open?
- 03Does the app support SCIM or another provisioning connector, so the business has leavers deactivated automatically?
- 04Who at the business owns the SAML signing certificate for each app, and when does it expire?
What people get wrong
That disabling a person at the identity provider locks them out of every connected app at once. NIST SP 800-63C says ending the identity provider session will not necessarily end sessions at downstream apps, and app accounts can outlive the account they came from.
Red flags
- An app sold as SSO-ready whose option is a link in a portal, which Microsoft says does not provide true single sign-on.
- A SAML signing certificate with no named owner and no recorded expiry date.