SSO
Single Sign-On — one identity provider (like Okta or Google Workspace) handles authentication for all the apps a company uses, instead of each app having its own password.
SSO lets a company use one identity provider (IdP) — typically Okta, Google Workspace, Microsoft Entra ID (formerly Azure AD), or Auth0 — to authenticate users into all their applications. Instead of each app having its own username-password pair, apps trust the IdP to say "yes, this person is who they claim to be".
The technical mechanism is usually SAML (Security Assertion Markup Language) or OIDC (OpenID Connect). SAML has been the enterprise standard for over a decade; OIDC is newer, JSON-based, and increasingly common in consumer-facing apps.
Why enterprises require SSO: - **Central offboarding**: when someone leaves the company, disabling them in the IdP disables access to every SSO-connected app. Without SSO, you have to remember to remove them from each app individually — an audit and security nightmare. - **Consistent password policy**: MFA, password rotation, and access reviews are set once in the IdP, not per-app. - **Compliance requirements**: SOC 2, ISO 27001, HIPAA, and many procurement processes explicitly require SSO for tools handling company data.
Many SaaS products gate SSO behind a much more expensive "enterprise" tier — a well-documented pattern called the "SSO tax". This is being pushed back on (see sso.tax) because SSO is a security-hygiene feature that shouldn't cost 5-10x more; it should be table stakes.