Single sign-on (SSO) is an authentication method that lets an employee sign in once, with one identity and one password, and move between the company's applications without logging in to each separately. The main single sign-on benefits are fewer passwords, fewer help-desk calls and a leaver's access revoked everywhere in one action.
Because identity is verified in one central place, administrators grant, change and revoke access to every application from a single point, so no forgotten account stays open after someone leaves. Below we explain how SSO works, what its benefits and risks are, and six steps to roll it out.
More passwords, less control
Consider a typical working day at a small or mid-sized business: company email, a file-sharing area, the accounting or ERP screens, an HR portal, perhaps a CRM and a handful of cloud tools. Each has its own username, its own password and its own rules for resetting it. The more cloud apps you add, the wider this sprawl; we look at the cost side in cloud migration cost.
The outcome is predictable. People reuse passwords, jot them in a notebook or save them in the browser, and call IT when they forget.
For IT, the picture is worse: onboarding a new starter means visiting five admin panels, a department move means updating permissions in five places, and a leaver's accounts have to be tracked down and closed one by one. Miss a single system and a former employee may keep access to company data for weeks. We covered that scenario in detail in our article on email access when employees leave.
In Türkiye this is especially common in sectors with high staff turnover, businesses that rely on seasonal teams, and groups that run several companies with one IT team. The cause is rarely malice; it is sprawl. Nobody can see, from one list, which employee has an account on which system.
What identity attacks cost
Passwords remain the entry point attackers target most. International research points the same way:
According to the Microsoft Digital Defense Report 2025, more than 97% of identity attacks are password attacks, and phishing-resistant multifactor authentication (MFA) can stop over 99% of them. (Microsoft Digital Defense Report 2025)
The Verizon 2026 Data Breach Investigations Report (DBIR) shows that the use of stolen credentials held steady as an action in 36% of breaches. Sophos' 2026 identity security survey of 5,000 IT and security leaders in 17 countries found that 71% of organisations suffered at least one identity-related breach in the past year, with employees tricked into handing over credentials cited in nearly 43% of incidents. The most common trick is an email leading to a fake sign-in page; the warning signs are collected in how to spot phishing emails.
The cost is not limited to breaches; password resets eat into IT time as well. In FIDO Alliance passkey research surveying 400 decision makers at US and UK companies with 500+ employees, 77% of respondents rolling out passkeys reported reduced help-desk calls — a direct operational return from reducing the number of passwords people have to handle.
Basic protections are still far from universal. The UK government's Cyber Security Breaches Survey 2025/2026 found that only 47% of businesses use two-factor authentication. When every application has its own password, that protection has to be set up application by application — which is exactly why so many businesses never finish the job. A single identity makes it possible to apply protection once, completely.
How SSO works
There are two parties in SSO: the identity provider, which verifies who you are, and the applications that trust it. The employee signs in once at the identity provider; when they open an application, it does not ask for a password again but receives confirmation that "this person has been verified and has these permissions". In business settings, that exchange usually runs over standard protocols such as SAML 2.0 or OpenID Connect. We compare the two in SAML vs OIDC.
The key consequence of this design is that permissions become central. A person's department, role and the applications they may use are defined in one place and changed in one place. How that central model applies at mailbox level is shown in our guide to mailbox permissions and delegation.
Single sign-on benefits: with and without SSO
The benefits of SSO show most clearly in everyday IT work — when someone joins, changes department or leaves:
| Area | Without SSO | With SSO |
|---|---|---|
| Passwords per employee | One per application | One identity |
| New starter | A separate account in every system | One record, role-based access |
| Department move | Manual updates in each system | Changed once, reflected everywhere |
| Leaver | Accounts found and closed one by one | All access revoked in one action |
| Session visibility | Each app keeps its own log | Sessions monitored centrally |
| Password resets | A separate request per system | One password, one process |
What is the risk of SSO?
SSO creates a single key, and if that key is stolen it opens more doors. That is why SSO is not a security control in itself but a way of centralising security. The central identity must be protected with a strong password policy, multifactor authentication where possible, protection against automated guessing, and sessions that can be monitored and closed remotely. Protected properly, one well-guarded door is safer than ten weak ones.
Six steps to move to SSO
- Build an application inventory. List every system staff sign in to, who uses which, and which support standard sign-in protocols.
- Choose a single source of identity. Decide where an identity is "born": an identity provider, a platform that unifies email and files, or the HR record.
- Define roles through departments. Grant access by department and role rather than person by person, so a department move changes access automatically. Our guide to file sharing permissions applies the same principle to documents.
- Harden the central identity. Put in place a password policy, multifactor authentication, protection on sign-in screens against automated attempts, and a list of active sessions. For the details of a password policy, see business password security. We compare second-factor methods in multi-factor authentication for business.
- Rewrite joiner and leaver procedures. The answer to "what do we do when someone leaves?" should fit on one line.
- Roll out in stages. Connect the applications everyone uses — email and files — first, then add line-of-business systems. When choosing an email service, check single-identity support against your business email selection criteria.
A single identity makes the biggest difference in groups with several companies, where one employee may work for two entities with just one password. The group-specific steps are covered in email management for multiple companies.
How we do this at Digital Bridge
An SSO project is less a software installation than a redesign of how identity and permissions work. So we begin by mapping where you are today:
- Identity and access review: as part of our cyber security consultancy, we examine who has accounts on which systems, whether active accounts belonging to former staff remain, and how password policies are set.
- One identity for email and files: for organisations that want company email and document management under a single identity, we recommend the Smart360 family and plan the migration and domain settings with you.
- Connecting business applications: where ERP, HR or field applications need to work with the central identity, we build the connection through system integrations; in the custom web software we develop, central identity is planned from the needs-analysis stage.
- Logging and data protection: we address how records of who accessed which system, and when, are kept, alongside our data protection compliance consultancy for KVKK, Türkiye's personal data protection law.
One identity in Smart360: SmartID in practice
Smart360 is the business application family we develop ourselves. It brings together SmartMail for business email, SmartFiles for document management, SmartOperator, an AI customer agent for websites, and SmartPass for card access control and time and attendance, under one admin panel and one identity called SmartID; our project management software SmartPM is accessed with the same Smart360 account, with no separate password. Administrators manage users, departments, product access, domains and DNS, plans, billing, usage statistics and support requests from the same panel, so "where does this person have an account?" is answered on one screen. Here is what a single identity changes at three moments in an employee's life.
Joining. The administrator adds the new starter in the panel and selects their department. The employee signs in to SmartMail and SmartFiles with one password and moves between the products without being asked for it again. Because SmartFiles permissions can be granted to a department, access to that department's storage areas applies from the moment the person is added.
Changing department. When someone moves from sales to purchasing, their department is changed in one place and their access changes across all products together. In SmartMail, a person who leaves a department automatically loses access to that department's mailboxes; we explain how to design shared addresses this way in shared mailbox management. The old team's quote folder and shared inbox do not stay open simply because someone forgot to close them.
Leaving. A leaver's access is revoked across every product in one action. Mailbox passwords are generated by the system, stored encrypted with AES-256-GCM and never handed out to staff, so a departing employee holds no separate mailbox password they could still use.
To protect the central identity, Smart360 Security applies human verification on sign-in screens, so password-guessing attacks stop before they reach the server. Active sessions are listed with device details and can be closed remotely, and changing a password ends every session. Groups running several companies (tenants) manage them from one account without any company seeing another's data, and the mobile apps support multiple company accounts in the same app. The same idea of central management applied to physical access is covered in multi-site access control.
Next step
Before moving to SSO, run a simple test: take the list of people who left in the last six months and check whether each one's email, file and business-application accounts were actually closed. A single account still open is reason enough to move to one identity. To review your current set-up with us, from account inventory to a phased migration plan, get in touch. The other topics in identity, access and email security are gathered in our Business Email & Documents guide.