Definition

Single sign-on (SSO) is an authentication process in which one account and its authenticators give access to several applications without signing in to each one, generally implemented with a federation protocol. In HR software, SSO lets employees reach their HR, payroll, and benefits tools after signing in once through the company identity provider.

Also known as: SSO, single sign on

How it works

With SSO, an organization designates a central identity provider that authenticates each user. Connected applications, often called service providers, trust that provider rather than storing separate credentials. NIST describes the approach as using one account and its authenticators to reach multiple applications, generally through a federation protocol.

When an employee opens an HR application, it redirects the sign-in request to the identity provider. If the employee already has an active session, access is granted without another login. Otherwise the employee authenticates once, and the provider passes a signed assertion back to the application.

For HR teams, SSO centralizes access control. Disabling the account at the identity provider removes access across connected tools, though user records may still need cleanup through provisioning standards such as SCIM.

Example

A 400-employee company connects its HRIS, benefits portal, and learning platform to its identity provider. Employees sign in once each morning, and IT disables one account at termination to cut off access to all three.

How it differs from similar terms

Single Sign-On vs SCIM. SSO handles authentication, meaning how a user proves identity at sign-in. SCIM handles provisioning, meaning how user accounts are created, updated, and removed across applications.

Free checklist

Buyer's checklist: HRIS Software

Everything to check before you sign with a HRIS provider, on one printable page.

  • 9 questions to ask every vendor, with how to verify each answer
  • 11 capabilities to confirm in a demo
  • 6 pricing questions about fees outside the quote
  • A scorecard of the 5 products we rank highest, with what we verified

Facts as of Oct 24, 2026 · LeadChange Research Team

What it checks

  1. Employee record model
  2. Payroll integration
  3. Onboarding and document management
  4. Time off and absence rules
  5. Reporting and data access
  6. Integration breadth and API
  7. Permissions and privacy controls
  8. Employee and manager self-service

and 1 more question in the full checklist

Sample question

Employee record model

Ask to see a rehire and a mid-year transfer, and view the full change history on the record.

We keep your email with this request only: it is never shared or sold, and we send you nothing unless you tick the box.Privacy notice

Your checklist

Next: see the products that fit your team, ranked without regard to who pays us.

Frequently asked questions

What does single sign-on mean?

Single sign-on is an authentication process where one account and its authenticators grant access to multiple applications without separate logins. NIST notes it is generally implemented with a federation protocol, so applications rely on a central identity provider to confirm who the user is.

Why does SSO matter for HR software?

HR systems hold sensitive employee data, so centralized authentication helps IT enforce consistent sign-in policies and remove access in one place. Employees also manage fewer passwords. Buyers typically ask whether an HR vendor supports SSO with their identity provider and whether it is included in the plan.

Does SSO create or delete user accounts?

No. SSO authenticates users who already have accounts. Creating, updating, and deactivating those accounts across applications is a provisioning task, commonly handled with a standard such as SCIM alongside SSO. Disabling a user at the identity provider blocks sign-in, but leftover accounts in each application may still need cleanup.

What is an example of single sign-on?

Signing in to your HR system with your work Google or Microsoft account is single sign-on. BambooHR, for example, lists SAML, Google and Microsoft sign-in, and Deel supports SAML 2.0 through identity providers such as Okta, OneLogin and Azure.

Is a Google account a form of single sign-on?

It can be. When an application offers sign-in with Google and accepts your Google Workspace identity, Google acts as the identity provider and you use one account across those applications. Whether an HR tool supports it depends on the vendor: check its listed sign-in options.

Is single sign-on worth it for HR software?

For most companies, yes: one company login replaces separate passwords for HR, payroll and benefits tools, and turning off one account removes access everywhere it is connected. Check the plan, though: some vendors include SAML single sign-on only on higher tiers, as Bonusly does on its Organization plan.

Compare HRIS options

See every HRIS product we rank, with verified prices and features.

Compare HRIS tools