Single Sign-On and Identity Management: When a Growing Company Actually Needs It

A 60-person company often runs dozens of paid and free business applications, and each one has its own login. When a salesperson leaves on Friday, someone has to remember every system that person touched. When a new hire starts on Monday, three managers send three separate access requests. Nobody planned this. It accumulated one tool at a time.

Single sign-on (SSO) is the standard answer to this problem, and vendors will tell you it is always the right time to buy it. It is not. Identity consolidation has a real cost, a real rollout effort, and a point below which it does not pay for itself. This post lays out where that point sits and how to get there without a failed project.

What SSO and Identity Management Actually Are

SSO lets an employee sign in once with a central account and reach every connected application without a separate password for each. The central system, called an identity provider (IdP), holds the list of who works at the company and what they can reach. Microsoft Entra ID and Google Workspace both act as identity providers, which is why many companies already own one without using it that way.

Identity management is the broader discipline around that central account: creating it when someone joins, changing access when they change roles, and removing it when they leave. SSO is the sign-in piece. Provisioning, group-based access, and offboarding are the management piece. Most of the value shows up in the second half, not the first.

Three terms come up in vendor conversations:

• SAML and OIDC: The two common protocols that let an application trust your identity provider. An application either supports one of them on your plan, or it does not.
• SCIM: A protocol that lets the identity provider create and remove user accounts inside connected applications automatically. This is what makes offboarding reliable.
• MFA enforcement: With SSO, multi-factor authentication is set once at the identity provider instead of tool by tool.

Why Credentials Are the Problem Worth Solving

The reason to centralize identity is not convenience. It is that stolen and reused credentials remain the most common way attackers get in. The 2025 Verizon Data Breach Investigations Report found credential abuse was the most frequent initial access vector, at 22% of breaches, ahead of vulnerability exploitation and phishing. Different summaries of that report present the figure slightly differently, so treat 22% as the conservative number.

For a company with 80 separate logins per employee, that exposure is multiplied. Each application is a separate place where a reused password, a missed MFA setting, or a forgotten account can become the entry point. Each departing employee is a separate list of accounts to close. SSO shrinks the number of places a credential can fail from dozens to one, and that one is easier to protect properly.

The Signals That Say It Is Time

Plenty of companies buy SSO too early, then spend a year paying for something that covers six applications. A better approach is to wait for specific signals. If two or three of these apply, the business case is usually there.

1. Offboarding takes more than an hour of manual work. If departures require someone to log into each system and remove the user by hand, accounts get missed. Ex-employee accounts that stay active are a common finding in security reviews.
2. A customer or auditor has asked about it. Security questionnaires from enterprise customers and frameworks such as SOC 2 ask how access is granted, reviewed, and revoked. Central identity makes those answers short and provable.
3. You have more than 25 to 30 business applications with user accounts. Below that, a disciplined spreadsheet and a clear owner can keep up. Above it, the spreadsheet falls behind.
4. Password resets consume real help desk time. A steady flow of lockout and reset requests is a sign that employees are managing too many separate credentials.
5. MFA is inconsistent. If some tools enforce it, some make it optional, and some do not support it, you have uneven protection that no policy document fixes.
6. Headcount is growing by 20% or more a year. Rapid hiring multiplies provisioning requests. Role-based access set up once saves effort on every new hire afterward.

If none of these apply, the better investment is usually getting MFA turned on everywhere it is supported and keeping a current inventory of applications. That costs far less and covers most of the risk.

What It Costs: The Part Vendors Leave for the Quote

The headline price of an identity provider is rarely the full cost. Budget for four things.

The identity platform itself. If your company runs on Microsoft 365 or Google Workspace, you likely have a capable identity provider already, with premium features available on higher license tiers. A standalone identity product adds a per-user monthly fee on top.

The SSO surcharge on applications. Many software vendors reserve SAML single sign-on for their most expensive plan, a practice often called the "SSO tax." A Toolradar analysis of 1,112 tools that offer single sign-on found that 61% limit it to their highest-priced tier. A separate hand-check of 28 business software pricing pages in June 2026 found 16 of them, or 57%, did the same. The samples are small and methods differ, but the pattern is consistent. Moving a 10-person team on a $12 per user plan to a $30 per user enterprise plan just to get SAML adds roughly $2,160 a year for that one tool.

Implementation labor. Connecting each application, mapping groups to roles, and testing sign-in takes real hours. A first wave of 10 to 15 applications is typically a project measured in weeks, not days.

Ongoing ownership. Someone has to approve new applications, review access, and keep the directory accurate. Without a named owner, the system drifts back to the state it replaced.

The surcharge is the item that changes decisions. Before committing, price the whole stack of applications you intend to connect, not the identity platform alone. Sometimes the right answer is to connect the eight tools that matter and leave the rest on password plus MFA.

A Practical Rollout Framework

Companies that succeed with identity consolidation tend to follow the same order. Companies that struggle usually start by buying a product.

1. Inventory every application. Pull the list from expense reports, corporate card statements, and browser extension data, not from memory. Include free tools that hold company data.
2. Rank by risk. Mark the applications that hold customer data, financial data, or administrative control. These go first.
3. Check SSO support and plan requirements. For each high-risk application, find out whether SAML or OIDC is available and which plan includes it. Get the real price difference.
4. Clean up the directory. Remove inactive accounts, fix naming, and define groups that match how the company actually works. Connecting a messy directory to ten applications spreads the mess.
5. Enforce MFA at the identity provider. Choose the strongest method your team can realistically use. CISA has published guidance recommending phishing-resistant MFA, based on FIDO and WebAuthn standards, for high-value accounts, and NIST's 2025 revision of its digital identity guidelines (SP 800-63-4) addresses phishing-resistant authenticators, including passkeys.
6. Pilot with one department. Pick a group that is tolerant of change, connect three to five applications, and collect problems before the company-wide launch.
7. Automate provisioning where possible. SCIM turns offboarding from a checklist into a single action. Test it by disabling a dummy account and confirming access disappears everywhere.
8. Set a review cadence. Schedule a quarterly review of who has access to what, with a named owner who signs off.

What Goes Wrong

Four failure patterns appear again and again.

Locking out the administrator. If the identity provider has a problem and the only recovery path runs through it, the company is locked out of everything. Keep at least two emergency administrator accounts, protected with strong controls and stored offline.

Treating SSO as a replacement for MFA. SSO concentrates access. A single account now opens many doors, so a weak password on that account is a larger risk than before. SSO without strong MFA is worse than no SSO.

Leaving shadow applications outside the system. Tools that employees sign up for with a personal login never join the directory. The inventory step has to repeat, because new tools appear every month.

Skipping the offboarding test. The promise of SSO is that departures close everything. If nobody has verified that on a real departure, the promise is unproven.

Where Fractional IT Leadership Fits

Choosing an identity direction is a technology leadership decision, not a help desk task. It involves vendor pricing, contract timing, security policy, and the sequencing of work across departments. At Elevaire Systems, fractional IT leadership owns that decision layer: the inventory, the business case, the vendor negotiation over plan tiers, and the rollout plan.

Your managed service provider continues to do what it does well. It handles tickets, device management, and day-to-day administration, and it will likely carry out much of the technical configuration. The fractional CIO makes sure the project is scoped correctly, priced honestly, and aimed at a result the business can verify, such as a measured reduction in offboarding time or a clean answer to a customer's access control question.

Frequently Asked Questions

How much does single sign-on cost for a 50-person company?

The identity platform typically runs a few dollars to a few tens of dollars per user per month, depending on the tier, and some of that may already be included in your Microsoft 365 or Google Workspace license. The larger variable is the per-application surcharge for SAML support, which can add hundreds or thousands of dollars a year per tool. Price the applications you plan to connect before choosing a platform.

Do we need SSO if we already use Microsoft 365 or Google Workspace?

You already have an identity provider, so the question is whether to extend it to your other applications. For many 25 to 75 person companies, connecting the five to ten most important applications to the existing directory is enough. A separate standalone identity product becomes worth considering when you have many applications, complex access rules, or compliance requirements that your current licenses do not cover.

How does SSO work alongside our existing MSP or internal IT team?

It adds to their work rather than replacing it. Your MSP or IT staff usually handle the hands-on configuration, user support, and device management. A fractional CIO sets the direction: which applications to connect, which plan upgrades are justified, who owns access reviews, and how success will be measured.

How long does an SSO rollout take?

A first phase covering 10 to 15 applications generally takes six to twelve weeks, including inventory, directory cleanup, a pilot, and company-wide launch. Companies with a clean directory and modern applications move faster. Companies with legacy systems that do not support SAML or OIDC take longer or leave those systems outside the first phase.

Is SSO required for SOC 2 or cyber insurance?

Neither strictly requires SSO. Both require that you can show controlled, reviewed, and revocable access, and strong MFA on important systems. SSO is often the simplest way to demonstrate those controls, but a smaller environment can meet them with well-documented manual processes.

How do we get started this month?

Build the application inventory. List every tool with user accounts, mark the ten that hold the most sensitive data, and record whether each one supports SAML and on which plan. That single exercise tells you how large the project is, what it will cost, and whether the business case holds up.