Every employee at a 30-person company today juggles, on average, around a dozen logins to different systems. Half the office stores passwords in a "passwords.xlsx" file on the desktop, the other half types the same "Firma2024!" everywhere. SSO isn't a cure-all, but for most SMEs of that size it's one of the three best IT investments you can make.
What does SSO actually mean? The acronym stands for Single Sign-On — an employee logs in once to a single system (typically Microsoft Entra ID, the rebranded Azure AD, or Google Workspace) and from there "jumps" into all other applications without typing separate passwords. It works through standard protocols: SAML 2.0 or OpenID Connect (OIDC). From the user's perspective, 90% of the "wait, what was the password again" moments simply disappear.
It is not the same as a password manager. A password manager keeps 15 separate passwords and feeds them at the right moment. SSO makes sure those 15 separate passwords don't exist at all — there is one company login, full stop. The two tools can and should coexist, but they are not substitutes.
When does an SME really need SSO
Not always. A five-person company with three SaaS tools lives perfectly well on a password manager. But if you recognise any of the situations below, the SSO math starts to work out:
- You are 20+ people and every new hire needs accounts in 10+ apps during week one.
- Offboarding takes hours because "I'm not sure where else they had an account".
- Your helpdesk (in-house or outsourced) spends a meaningful chunk of its time on password resets.
- You want to enforce MFA across the whole company but "it's impossible" — because MFA has to be configured separately in every application.
- You suspect that active accounts for former employees are floating around. You're usually right.
How it works in practice
For a typical 30-person company running on Microsoft 365, the natural choice is Entra ID — and crucially, the Microsoft 365 Business Premium bundle already includes everything you need to wire up applications over SAML. For a company on Google Workspace, the corresponding Workspace subscription plays the same role. This is what's called the IdP (Identity Provider) — a single source of truth about who works for you.
Every application you wire into SSO has to support SAML 2.0 or OIDC. Most business SaaS tools do — sometimes only from the Business+ plan upwards (Slack, Notion, Asana, Jira, HubSpot, Pipedrive, Comarch IBARD, the cloud consoles of popular ERPs). On-premise applications can often be plumbed through an Application Proxy. A handful of legacy apps speak nothing but their own login/password combo — you won't wire those in, but you can at least keep them in a password manager and restrict who has access.
The second piece worth deploying at the same time is SCIM. This is the protocol that makes creating an account in Entra ID automatically create the account in all wired-up applications, and disabling it tear those accounts down. Without SCIM you still have to remember to click through 12 admin panels every time someone joins.
A concrete example
At one of our clients — a 35-person manufacturer of construction fittings from Wielkopolska, running Comarch Optima in the cloud, Microsoft 365 Business Premium, Subiekt for warehouse and 11 SaaS apps (Slack, ClickUp, Mailchimp, HubSpot, Toggl, Adobe Creative Cloud and a handful of smaller ones) — the starting situation looked like this:
- Each employee held an average of 13 separate logins.
- A file called "company-passwords.xlsx" existed in 8 copies across various OneDrive folders.
- The helpdesk handled around 30–35 password reset tickets per month.
- Offboarding one of the accountants took a full week — and two weeks later it turned out she still had an active account in Mailchimp.
- MFA was enabled only in Microsoft 365; for the rest of the apps it was on the "we'll get to it" list.
After deploying Entra ID as the IdP, wiring 9 of the 11 apps through SAML and SCIM and enforcing MFA at the IdP level (Conditional Access):
- Active logins per employee dropped from 13 to 4 (3 legacy systems didn't support SSO).
- Password resets in helpdesk: 4–6 tickets per month instead of 30+.
- Employee offboarding: 20 minutes, one "disable user" click in Entra ID kills access everywhere.
- MFA enforced on all 9 wired apps automatically, through a single policy click.
- The audit pass surfaced 3 active accounts of former employees in SaaS tools nobody remembered. Closed.
The project took 6 weeks at roughly 4 hours of consultant time per week plus 2 hours per week on the client side. Licensing cost did not go up — the company already had Business Premium and just wasn't using Entra ID for anything beyond logging into Outlook.
Where it usually breaks
Technically, SSO is not a hard project — but it can break down organisationally:
- No application list. Before you wire anything, do an inventory. In a typical 30-person company you will find 5–10 apps that IT "didn't know about".
- Personal accounts instead of company ones. Someone signed up for a SaaS tool with a @gmail.com address "because it was faster". Those accounts need to be migrated before you wire them in.
- Shared logins. Accounts like "marketing@company.com" used by three people — SSO handles these badly. You have to migrate to per-person accounts with proper permissions.
- Apps that "almost" support SAML. Some vendors gate SSO behind a higher plan. That is typically +5–15 EUR per user per month on top. Check this before you start, so the budget doesn't quietly inflate.
- IdP outage = everything outage. If Entra ID is down, you can't sign in anywhere. That's why you want a so-called break-glass account — an emergency account with a long password kept in a safe, used only when the IdP is down.
What's next
SSO doesn't replace your password manager, MFA, MDM or backup policy — it works alongside them. But it is the foundation that everything else clicks neatly onto. Without SSO, every security policy rollout means patching holes separately in 15 different systems. With SSO, you have one place where those rules get defined once.
If you recognise the symptoms from the opening — password files on desktops, slow offboarding, dozens of resets per month — that's a good moment to sit down for half an hour and add up what it actually costs the company in working hours. The number usually comes out higher than you expect.
SSO isn't a gadget for the enterprise. It's a simple way to turn 15 logins per employee into one — and finally close the back doors left behind by former staff.