Topic starter
20/08/2026 5:27 pm
TL;DR: Single sign-on centralises authentication through an identity provider, using standards such as OpenID Connect or SAML to reduce password handling and simplify application access, according to INTIGRITI. The governance shift is that IAM teams move risk from user passwords to IdP trust, token handling, and federation configuration.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “Single Sign-On: Getting started with SSO”.
Key questions
Q: How should organisations govern SSO when the identity provider becomes the trust anchor?
A: Treat the identity provider as a shared control plane.
Q: Why does single sign-on change the risk profile of enterprise access?
A: SSO reduces repeated password use, but it concentrates authentication assurance in one upstream provider.
Q: What are the signs that an SSO implementation is failing in practice?
A: An SSO implementation is failing when users cannot complete authentication reliably, administrators cannot verify trust settings, or logging and attribute mapping break during testing.
Practitioner guidance
- Harden the IdP trust boundary Review tenant configuration, client registration, redirect URIs, token validation, and signing key handling as one control surface rather than separate admin tasks.
- Inventory every SSO-connected application Map which applications rely on the identity provider, which protocol they use, and which teams own their federation settings and offboarding paths.
- Reduce the blast radius of IdP compromise Use strong MFA, conditional access, and least-privilege admin separation around the identity provider so a single account or token issue cannot cascade across the estate.
Bottom line: SSO reduces password sprawl, but it does not reduce the importance of identity governance. It concentrates authentication risk in the IdP and the federation settings that support it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
20/08/2026 6:15 pm
SSO shifts identity risk from password volume to federation trust. The security gain is real, but it is only realised if the IdP and the token path are controlled as a single governance surface. That changes the practitioner problem from user credential sprawl to trust concentration across every relying application.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: Should organisations choose OpenID Connect over SAML for SSO?
A: Choose the protocol that best fits the application estate and governance model rather than treating one as universally better. OpenID Connect is often easier for modern applications, while SAML remains important in many enterprise environments. The real decision is whether the team can enforce policy, assurance, and lifecycle controls consistently across the chosen standard.
👉 Read our full editorial: Single sign-on reduces password sprawl, but trust shifts to the IdP