How it works in plain terms
Normally each app keeps its own list of usernames and passwords. With single sign-on, the app hands the login job to an identity provider you already use, such as Microsoft Entra ID behind Microsoft 365, or Google's account system behind Google Workspace. When a staff member clicks Sign in with Microsoft on the CRM, they are sent to the familiar Microsoft page, prove who they are, and the identity provider tells the CRM it is really them.
The app never sees the password. It simply trusts the confirmation from the identity provider, using standards with names like SAML and OpenID Connect that you do not need to understand in detail. What matters is that one account, protected by one set of rules, becomes the key to everything the person uses for work.
Why it is safer
Separate passwords for twenty apps mean twenty chances for someone to choose a weak password, reuse their personal one or fall for a fake login page. Most of those apps will not have multi-factor sign-in turned on, because each one needs setting up and enforcing separately. Single sign-on concentrates that effort in one place. Turn on strong multi-factor sign-in for the work account and every connected app inherits it.
It also lets you apply smarter rules. With the right Microsoft 365 or Google licence you can require sign-ins to come from company-managed devices, block sign-ins from countries you never work in, or ask for extra verification when something looks unusual. Those rules then protect the CRM, the HR system and the project tool too, not just email.
Why it makes leavers easier
Offboarding without single sign-on is a hunt. Someone has to remember every app the leaver used, find who manages each one and remove the account, and it is common to miss a few. Months later a former employee can still log in to the quoting tool or a file share, which is a security risk and, if personal information is involved, a privacy problem.
With single sign-on, disabling the work account blocks sign-in to every connected app straight away. Many apps also support automatic provisioning, which creates and removes accounts in the app when you change them in your directory. Onboarding gets faster too, because a new starter added to the right group gets access to the right apps on day one.
What to check before connecting an app
Not every product supports single sign-on, and some only offer it on higher-priced plans. Check the vendor's documentation or ask directly, and factor any plan upgrade into the cost. Larger vendors usually appear in the Microsoft Entra or Google app galleries with step-by-step setup guides, which makes connecting them straightforward.
Before switching on, decide whether the app should still allow its own passwords as a backup. In most cases it is better to turn local passwords off once single sign-on works, except for one emergency administrator account kept in a password manager. Otherwise people keep using the old passwords and you lose the benefit.
A sensible order to roll it out
Start by making sure the identity provider itself is in good shape: every user with multi-factor sign-in, no shared accounts, administrator roles limited to the people who need them and leavers removed. Single sign-on spreads the strength of that account to every app, but it spreads weaknesses too. Then connect the apps that hold the most sensitive data or have the most users: CRM, accounting, HR and payroll, file sharing, project management. Test each with a couple of staff before switching everyone. Tell people what will change, because a login page that looks different is exactly what phishing training tells them to be wary of.
What it does not solve
Single sign-on does not cover apps that do not support it, personal accounts staff created themselves or shared logins to supplier portals. Keep a password manager for those. It also makes the one work account very valuable to attackers, so protecting it with phishing-resistant sign-in methods, sign-in alerts and a quick process for locking it when a device is lost becomes even more important.
Think of it as tidying the front doors of your business into one well-guarded entrance. That entrance still needs a lock, a camera and someone who notices when something looks wrong, but it is far easier to watch one door than twenty. Keep a simple record of which apps are connected, who owns each one and whether local passwords are disabled. Review it when you add a new tool and at least once a year. Apps get upgraded, plans change and an administrator sometimes re-enables password sign-in to fix a problem and forgets to turn it off again.
In short
- Single sign-on uses one work account, such as Microsoft or Google, to log in to many apps.
- Multi-factor sign-in on the work account then protects every connected app.
- Disabling one account blocks a leaver from every connected app at once.
- Secure the identity provider first, then connect the most sensitive apps.