# Single sign-on. One login with MFA for every app.

Source: https://vetosec.at/en/solutions/single-sign-on/

Every app has its own password, and when someone leaves an account easily stays open. With single sign-on your team signs in once, and you disable one account instead of twenty.

- **1 account** per person
- **MFA** admins included
- **Self-hosted** in your infrastructure

## What changes for you

- **Offboarding in one click**: Disable one account and file cloud, VPN, business software and admin consoles are closed. No more forgotten access for former staff.
- **MFA everywhere**: The second factor applies to every connected app, via app or hardware key. A stolen password alone is no longer enough.
- **Self-service password reset**: One password instead of many. Reset by self-service instead of a phone call.
- [**Traceable**](https://vetosec.at/en/services/gap-analysis/): Who signed in where and when is logged. That helps with audits, ISO 27001 and NIS2.

## What runs behind it

- **Hosted by you**: The sign-in service runs in your infrastructure or a data centre in the EU. No dependency on a cloud account.
- **Highly available**: If sign-in fails, everything stops. That is why it runs redundantly and is monitored.
- **Also for older software**: Modern apps via OpenID Connect or SAML, older ones via LDAP or a proxy in front.
- [**Connected to remote access**](https://vetosec.at/en/solutions/fernzugriff-vpn/): The same sign-in opens access to the company network, checking person and device.

[How we build in general](https://vetosec.at/en/how-we-build/)

## What it looks like

- Central sign-in: One sign-in page for every app, in your design.
- Passkey: Sign in with a passkey or hardware key, with no password to steal.

## Proof of Concept

**Try single sign-on before you switch.**

We connect two or three of your apps in a test environment. You see what sign-in feels like for your team.

Request a PoC

## Service or project

**We run it for you, or your team takes over.**

As a managed service for a fixed monthly price, with updates, backup and monitoring. Or as a project with handover of network plan, runbook and all credentials.

## For IT leads

Technical details: Authentik · OIDC · SAML · LDAP

- **Identity provider**: Authentik, self-hosted, in containers on hardened Linux.
- **Protocols**: OpenID Connect, OAuth 2.0, SAML 2.0 and LDAP. Apps without SSO support via a proxy in front.
- **MFA**: TOTP, WebAuthn, passkeys and FIDO2 hardware keys, administrators included.
- **Directory**: Own user directory or connection to an existing Active Directory.
- **Availability**: Run redundantly and monitored.
- **Audit**: Sign-in events logged centrally and analysed in the SIEM.
- **Lifecycle**: Self-service password reset. Disabling one account closes every connected app.

## Further reading

More on the topic

- [**Single sign-on**](https://vetosec.at/en/it-security/single-sign-on/): Single sign-on (SSO) is one central login for many applications: staff sign in once, ideally with a second factor, and reach every app they are allowed to use.
- [**Two-factor authentication (2FA)**](https://vetosec.at/en/it-security/zwei-faktor-authentifizierung/): Two-factor authentication asks for a second proof alongside the password at login, such as a code from an app or a security key you plug in.
- [**Berechtigungskonzept für KMU: Eine einfache Struktur, die funktioniert**](https://vetosec.at/en/articles/it-wissen/berechtigungskonzept-kmu-vorlage/): A simple, workable access-control model for SMEs.

## Frequently asked questions

### What is single sign-on?

Single sign-on means one central login for many apps. The apps trust the sign-in service instead of managing their own passwords.

### Do we need this if we have Microsoft 365?

Not necessarily. It pays off with many self-hosted apps or when sign-in should stay in your own infrastructure.

### Which technology do you use?

Authentik as identity provider with OpenID Connect, SAML and LDAP, MFA via TOTP or WebAuthn, running in containers on hardened Linux.

### Who do you offer this to?

For regulated companies, professions bound by confidentiality and anyone processing sensitive data, and for companies of about 30+ staff with critical systems.

## Related

- [Solutions](https://vetosec.at/en/solutions/): Nextcloud, SSO, backup, clusters
- [Managed services](https://vetosec.at/en/services/managed-services/): fixed price per service
- [How we build](https://vetosec.at/en/how-we-build/): security and backup standards

## Single sign-on and identity management with Authentik in Austria

vetosec sets up single sign-on and MFA with Authentik for businesses in Austria.

Updated: October 19, 2026

Provider: vetosec, Dipl.-Ing. Samuel Ziegler, BSc, Berndorf, Lower Austria, Austria. Contact: https://vetosec.at/en/contact/