[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-sso::en":3,"gloss-cluster-sso::en":20,"gloss-next-sso::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"sso","saas","Single Sign-On (SSO)","Single Sign-On (SSO) is an authentication scheme that lets a user log in once with a central identity provider (IdP) — like Okta, Azure AD\u002FEntra ID, Google Workspace, or OneLogin — and gain access to multiple connected applications without re-entering credentials for each one. Technically, SSO is implemented via one of two dominant protocols: SAML (Security Assertion Markup Language), an older but still enterprise-standard XML-based protocol, and OpenID Connect (OIDC), a modern JSON\u002FJWT-based layer built on top of OAuth 2.0. When a user tries to access your SaaS app, your app (the \"service provider\") redirects them to the company's IdP; the IdP verifies the user's identity (checking their corporate credentials, possibly with MFA) and sends back a signed assertion or token confirming who they are; your app trusts that assertion and creates a session — without ever seeing the user's actual password. SSO matters enormously to B2B SaaS builders because it is frequently a hard procurement requirement for mid-market and enterprise deals — a company with 500 employees will not let a vendor manage 500 separate passwords, both for security (centralized deprovisioning when an employee leaves) and compliance reasons (see SOC 2). Many SaaS vendors now charge SSO as a paid add-on (\"SSO tax\") precisely because enterprise buyers will pay a premium for it. Concrete worked example: an employee at Acme Corp clicks \"Log in with SSO\" on your app and enters their email `jane@acmecorp.com`. Your app looks up Acme Corp's configured SAML metadata, redirects to `https:\u002F\u002Facmecorp.okta.com\u002Fapp\u002Fyourapp\u002Fsso\u002Fsaml`, Jane authenticates against Okta (which she was already logged into), and Okta POSTs a signed SAML assertion back to your app's Assertion Consumer Service URL. Your backend validates the signature against Okta's public certificate, extracts Jane's email and group memberships from the assertion, and creates a session — all without your app ever storing or seeing Jane's password. SSO also underpins another enterprise requirement builders should design for early: SCIM (System for Cross-domain Identity Management) provisioning, which lets the customer's IdP automatically create, update, and deprovision user accounts in your app the moment an employee joins or leaves the company — closing the security gap where an offboarded employee's access to a third-party SaaS tool lingers because no one remembered to manually revoke it. Auth providers like Okta, Auth0, and WorkOS exist specifically to let smaller SaaS teams bolt on enterprise-grade SSO\u002FSCIM support without building SAML\u002FOIDC handling from scratch.","SSO lets a user log into multiple applications with one set of credentials, authenticating once through a central identity provider.",null,[11,14,17],{"slug":12,"name":13},"api-first","API-First",{"slug":15,"name":16},"oauth","OAuth",{"slug":18,"name":19},"soc-2","SOC 2",[21,25,29,32,33,36,39,43,46,49,52,55],{"slug":22,"category":5,"name":23,"updated_at":24},"activation","Activation","2026-08-24T02:46:36+00:00",{"slug":26,"category":5,"name":27,"updated_at":28},"aha-moment","Aha Moment","2026-08-24T02:46:37+00:00",{"slug":30,"category":5,"name":31,"updated_at":28},"annual-contract-value","Annual Contract Value (ACV)",{"slug":12,"category":5,"name":13,"updated_at":24},{"slug":34,"category":5,"name":35,"updated_at":24},"arpa","Average Revenue Per Account (ARPA)",{"slug":37,"category":5,"name":38,"updated_at":24},"arr","Annual Recurring Revenue (ARR)",{"slug":40,"category":5,"name":41,"updated_at":42},"auto-renewal-clause","Auto-Renewal Clause","2026-08-24T02:46:38+00:00",{"slug":44,"category":5,"name":45,"updated_at":42},"build-vs-buy","Build vs. Buy",{"slug":47,"category":5,"name":48,"updated_at":28},"burn-multiple","Burn Multiple",{"slug":50,"category":5,"name":51,"updated_at":42},"burn-rate","Burn Rate",{"slug":53,"category":5,"name":54,"updated_at":24},"cac","Customer Acquisition Cost (CAC)",{"slug":56,"category":5,"name":57,"updated_at":24},"cdn","Content Delivery Network (CDN)"]