What is single sign-on (SSO)?
Single sign-on (SSO) is an authentication method in which a person signs in once, through the company’s identity provider, and then opens many applications without a separate password for each. The identity provider checks the password and second factor, then hands each application a signed statement of who the user is and which groups they belong to. The two common standards are SAML (Security Assertion Markup Language) and OpenID Connect.
AI tools hold chat histories, uploaded files, and connections to business systems. SSO puts access to all of it under the identity controls the company already runs. Multi-factor authentication is enforced in one place, group membership can drive role-based access control and permission-aware retrieval, and every entry in the AI audit log belongs to a named person.
Single sign-on in practice
A 400-person accounting firm rolls out an internal assistant for drafting client memos and searching engagement files. The assistant accepts only SSO logins, and each user’s groups decide which client folders it will search for that user. When seasonal staff leave after tax season, IT disables their accounts in one place, and access to email, the document system, and the assistant ends together.
What to watch for
- Confirm that disabling an account also ends open sessions and revokes the user’s API keys, since SSO by itself governs only new sign-ins.
- Find any AI tool, administrator login, or integration that bypasses SSO, and protect it separately.
- Check that SSO comes with the plan being purchased, since some vendors reserve it for higher tiers.