# Single sign-on

**What is single sign-on (SSO)?**

Single sign-on (SSO) is one central login for many applications: staff sign in once, ideally with a second factor, and reach every app they are allowed to use.

The biggest security gain is offboarding. Without SSO, access must be removed app by app and some gets forgotten. With SSO you disable one account and every connected app is closed.

SSO uses standards such as OpenID Connect or SAML; older software can often connect via LDAP or a proxy. The sign-in service is called an identity provider and can run in the cloud or in-house.

Because everything depends on sign-in, the identity provider must be highly available and well protected.

## Related terms
- [Two-factor authentication (2FA)](https://vetosec.at/en/it-security/zwei-faktor-authentifizierung/)
- [Passkeys](https://vetosec.at/en/it-security/passkeys/)
- [Permission model and least privilege](https://vetosec.at/en/it-security/berechtigungskonzept/)
- [Zero trust](https://vetosec.at/en/it-security/zero-trust/)

## Source
https://vetosec.at/en/it-security/single-sign-on/ (vetosec, schutz)