Short answer: Single sign-on lets you log in once to one identity provider — Google, Microsoft, Okta — and then access many other services without signing in again. It is not 2FA and does not replace it. Instead, it concentrates your 2FA: you secure the identity provider properly, and every connected service inherits that protection. Which is powerful, and also means that one account becomes the single thing worth attacking.
What SSO actually does
When you click “Continue with Google” on a third-party site, you are using SSO. The site never sees a password. Instead:
- The site redirects you to Google.
- Google checks you are signed in — asking for your password and second factor if not.
- Google returns a signed assertion saying “this is Nasim, verified”.
- The site trusts that assertion and logs you in.
The underlying standards are SAML (common in enterprise) and OpenID Connect, built on OAuth 2.0 (common for consumer sign-in). The details differ; the model is identical.
Why organisations use it
- One place to enforce security. Require a passkey or hardware key at the identity provider, and every connected application is protected by it — including the ones that offer only weak 2FA themselves.
- Instant offboarding. Disable one account and access to fifty applications ends at once. Without SSO, offboarding is a checklist nobody finishes.
- Fewer passwords, fewer leaks. Users cannot reuse a password across apps if there is no password per app.
- Visibility. Central logs of who signed into what, and conditional policies based on device and location.
That first point is the strategic one. Plenty of business tools support only TOTP or nothing at all. Put them behind SSO and they effectively acquire phishing-resistant MFA without changing anything about the tool.
Where 2FA fits
People sometimes think SSO replaces two-factor authentication. It does the opposite — it makes 2FA more important, and more effective.
SSO is about how many times you authenticate. 2FA is about how strongly.
Without 2FA at the identity provider, SSO is a liability: one stolen password opens every connected application at once. With strong 2FA there, SSO becomes the most efficient security investment available — you harden one account and lift the floor everywhere.
This is why you keep meeting the message “2FA is managed by your organisation” in tools like Slack and Zoom. It is not missing; it lives upstream.
The risk: one account to rule them all
Concentration cuts both ways. If your Google or Microsoft account falls, everything behind it falls simultaneously.
So the identity provider account deserves treatment appropriate to that role:
- A passkey or hardware security key, not a code you can be talked into typing.
- Two keys registered, one stored separately.
- No SMS fallback — the weakest enabled method is your real security level.
- Recovery codes stored offline — see where to store them.
- Session policies — reasonable timeouts, because a stolen session skips authentication entirely (session hijacking).
Consumer “sign in with” is SSO too
Every “Continue with Google / Apple / Facebook” button is consumer SSO, with the same trade-offs on a smaller scale.
Advantages: no new password to leak, the site never stores credentials, and you inherit your provider’s 2FA.
Disadvantages: the provider learns where you have accounts, losing that account cascades, and switching providers later is awkward.
Practical guidance: use “Sign in with Apple” or Google for low-stakes services if the underlying account is well protected. Use a separate password and 2FA for anything financial. And audit the list occasionally — Google’s Security → Third-party apps, Apple’s Settings → Sign in with Apple — revoking sites you no longer use.
One trap worth naming: if you sign into a service with Google and later lose your Google account, you may have no route into that service at all. Where a site offers to also set a password, doing so is sensible.
Related terms, quickly
- Federated identity — the broad concept of one provider vouching for you elsewhere. SSO is how it feels in practice.
- OAuth — an authorisation protocol (“let this app read my calendar”), often confused with authentication. OpenID Connect is the authentication layer built on it.
- Directory (Active Directory, Entra ID, Okta, JumpCloud) — where user accounts live and policies are set.
- Conditional access — rules that vary requirements by device, location or risk. Genuinely useful, and a reason enterprises prefer SSO to per-app 2FA.
Frequently asked questions
Is SSO more secure than separate logins?
Generally yes, provided the identity provider has strong 2FA. It eliminates password reuse, centralises enforcement and makes offboarding reliable. Without strong 2FA upstream, it is worse than separate logins.
Why can’t I enable 2FA in my work Slack or Zoom?
Because your organisation uses SSO and authentication happens at the identity provider. That is where your security lives — and where any 2FA changes must be made.
Is “Sign in with Google” safe for personal use?
Yes for most services, if your Google account has a passkey or authenticator app and no SMS fallback. Avoid it for banking and crypto, where a dedicated login with its own 2FA is preferable.
What happens if the identity provider is down?
You may be locked out of everything behind it. Enterprises keep break-glass administrator accounts with their own credentials for exactly this. Individuals should keep at least one alternate route into critical services.
Does SSO stop phishing?
Not by itself. It reduces the number of login pages you use, which helps you recognise the real one. Actual phishing resistance comes from using passkeys or security keys at the provider.
Should a small business use SSO?
If you use Google Workspace or Microsoft 365, you already have the provider. Connecting your main SaaS tools to it is usually straightforward and worth it — see 2FA for small teams.
The bottom line
SSO answers “how often do I log in”; 2FA answers “how hard is it to fake me”. They work together, and the combination is strongest when you accept the implication: one account now carries the weight of many, so it gets the hardware key, the offline recovery codes, and no weak fallbacks.
Not sure which method to put on that account? Start with passkeys vs 2FA.
One Response