Single Sign-On (SSO) for Business Apps

Why SSO is worth it

• Fewer passwords. Staff use one account, so there are fewer weak or reused passwords and fewer reset requests.
• Stronger security. Multi-factor authentication and conditional access (for example, blocking logins from unmanaged devices) apply to your custom app without building them yourself.
• Clean leavers process. Disable someone in Microsoft Entra ID or Google Workspace and their access to every connected app ends.
• Customer requirement. If you sell software to larger businesses, SSO is often on their security questionnaire.

How it works

With SSO, your app no longer checks passwords. When someone clicks "Sign in with Microsoft", the app redirects them to the identity provider (IdP). The IdP authenticates them, applies MFA and policies, then sends them back with a signed token or assertion saying who they are. The app checks the signature and logs them in.

Two standards dominate:

Microsoft Entra ID (formerly Azure Active Directory), Google Workspace, Okta and others support both. For internal apps on Microsoft 365, OIDC with Entra ID is usually simplest, and the same sign-in can grant access to Microsoft Graph for calendars, files and email.

Provisioning, roles and leavers

SSO answers "who is this?" Your app still decides "what can they do?" Common approaches:

• Group mapping. Entra ID or Google groups map to app roles (Finance, Manager, Engineer), so access is managed in the directory.
• Just-in-time creation. A user record is created the first time someone signs in, with a default role.
• SCIM provisioning. The directory creates, updates and deactivates users in your app automatically using the SCIM 2.0 standard, so leavers are removed even if they never log in again.

Keep a break-glass admin account that does not depend on SSO, protected by strong MFA, in case the IdP connection fails.

Adding SSO to custom software

For most modern stacks it is well-trodden ground: Laravel Socialite or a SAML package for PHP, Auth.js or openid-client for Node.js and Next.js, or a hosted identity service. The work involves registering the app with each IdP, handling sign-in and sign-out, validating tokens properly (issuer, audience, expiry, signature), mapping groups to roles, linking existing accounts to SSO identities, and testing edge cases like users who change email. If you sell to many organisations, each customer needs its own IdP connection, which is a multi-tenant design question to settle early. Our UK GDPR guide covers related security expectations.

Common SSO mistakes to avoid

• Trusting email addresses alone. Match users on the identity provider's stable, unique ID (such as the sub or object ID claim), not just email, which can change or be reused.
• Skipping token validation. Every token or assertion must be checked for signature, issuer, audience and expiry. Use well-maintained libraries rather than hand-written parsing, especially for SAML's XML signatures.
• Accepting any tenant. A multi-tenant Microsoft app registration can let users from any organisation sign in. Restrict access to your tenant, or to approved customer tenants, explicitly.
• Forgetting sessions. Disabling someone in the directory stops new logins, but an existing app session may stay open. Keep session lifetimes sensible and use SCIM or periodic checks to end access promptly.
• Leaving local passwords enabled. If SSO is the policy, turn off password login for those users, or attackers will use the weaker route.
• No break-glass plan. If the identity provider is unavailable or misconfigured, you need a secured emergency admin route.
• Poor logging. Record sign-ins, failures and role changes in your audit log, so security reviews and investigations are possible.

None of these are difficult to get right if they are designed in from the start. They are much harder to fix once hundreds of users depend on the system.

When to talk to dijitul

dijitul adds SSO to bespoke business apps, intranets and SaaS products, usually with Microsoft Entra ID or Google Workspace, along with role mapping and audit logs. If you are building new software, we include it from the start. Start with a free chat and get a fixed-price quote. See intranet development and web application development.

Related