SSO means one sign-in unlocks many applications. Microsoft 365, Google Workspace, Okta, and others provide SSO. When it works, you don't notice it. When it fails, every app seems to break.

How it works

When you sign in to Microsoft (for example):

  • You authenticate with password + MFA
  • Microsoft issues a token
  • Other apps trust Microsoft and accept the token
  • You're in without seeing another sign-in

The apps' agreement to trust Microsoft is the "SSO integration".

1. Common SSO providers

  • Microsoft Entra ID (formerly Azure AD) — common
  • Okta — popular
  • Google Workspace — common for Google shops
  • Auth0 — for developer / custom apps
  • OneLogin

Your work account is usually with one of these.

2. SSO sign-in error

If you click a "Sign in with Microsoft" button and it fails:

  • Your account may not be licensed for that specific app
  • The SSO integration may not be set up
  • Your account may not be in the right group

Error messages often help:

  • "User not in tenant" — wrong Microsoft account
  • "Application not assigned" — your account not granted access
  • "SSO not configured for this provider" — admin setup issue

3. Mixed accounts

A common confusion:

  • Personal Microsoft account (Outlook.com)
  • Work Microsoft account ([email protected])
  • Same name, different identities

If the SSO is for your work account but you're signed in to personal, it fails. Sign out, sign back in to work.

4. Multiple work accounts

Some people have multiple work accounts (consulting, multiple positions):

  • Browser sign-in may default to the wrong one
  • Solution: use profiles in Chrome/Edge — one per identity

5. App-specific sign-in

Some apps need a separate sign-in even with SSO:

  • Some legacy systems don't support modern SSO
  • Some apps use SSO for the org but each user signs in within the app

Each separate sign-in is a separate account in that app — different password, different MFA.

6. After SSO, what about MFA?

MFA happens once at the SSO step. After that:

  • You sign in to apps without re-doing MFA
  • Until session expires
  • High-risk apps may require additional verification (Risk-based step-up auth)

7. Sessions and token lifetime

SSO tokens have a lifetime:

  • Typically 8-24 hours for most apps
  • After that, you sign in again

Some apps refresh tokens automatically; others don't.

8. Signing out

Sometimes signing out of SSO doesn't sign you out of every app:

  • "Sign out of all sessions" link in Microsoft account settings
  • Each app may need its own sign-out

For shared computers, always sign out properly.

9. SSO from devices

Different access:

  • Laptop with corporate sign-in: SSO works seamlessly
  • Personal computer with browser sign-in: SSO works in browser only
  • Mobile devices: each app needs to be configured
  • Hybrid: depends on the corporation's setup

10. Conditional access

Modern SSO supports conditional access:

  • Block sign-in from unfamiliar countries
  • Require MFA from outside the office
  • Block access from unmanaged devices

These rules silently block sign-ins that don't comply. If you can sign in from the office but not from home, conditional access is the likely cause.

When to ticket

Raise a ticket if:

  • A specific app isn't recognizing your SSO
  • You're being asked for MFA more than expected
  • Sign-in fails from a specific location or device
  • A new application needs SSO integration

Include the app name, what error you see, and where you're trying to sign in from.