Single sign-on (SSO) is a login system that lets an employee sign in once and then open all of the company's applications without signing in again. The system that checks the login is called an identity provider, or IdP. Each application accepts the identity provider's confirmation, instead of keeping its own passwords.
Here is how it works. When you open an application, such as the company's email or its HR portal, the application does not ask for your password. It sends you to the identity provider. The identity provider checks your password, and usually a second proof through multi-factor authentication (MFA). Then it gives your browser a signed message, called a token, which states who you are and which groups you belong to. The application checks the signature and lets you in. For the next few hours, every other application that you open receives a token in the same way, without asking you again. The two common formats for these tokens are called SAML and OpenID Connect.
Take, for example, a sales executive at a medicine distributor in Lucknow. At 9 a.m., she signs in on her laptop with her password and a tap on her phone. During the morning, she opens email, the order system, the CRM in which her visits to chemists are recorded, and the expense app. She types no other password. When she leaves the company in March, an IT employee disables her one account in the identity provider. At that moment, she loses access to all four applications together.
That last point is why SSO matters for security, and not only for convenience. Without SSO, each application keeps its own password, and a leaver's old accounts can stay open for months. With SSO, there is one place to check every login and one place to switch it off. The list of users and groups usually comes from the directory services. Identity governance and administration (IGA) decides which applications each person should have.
Every login also leaves a record. The identity provider sends its login logs to the SIEM, where the security team can search for unusual sign-ins. The identity provider can also refuse a login because of the device or the place it comes from. This is one part of zero trust, the idea that every login is checked every time. For instance, it can refuse a login from a laptop that the company has not enrolled through unified endpoint management (UEM).
SSO is meant for a company's own employees. A login for an app's customers is a different product, called customer identity and access management (CIAM).