Single sign-on (SSO) has transformed how employees access business applications by allowing one account to authenticate users across multiple services. However, this convenience also creates a concentrated security risk: if attackers compromise the central login, they may gain access to email, VPNs, customer-management platforms, file storage, and other sensitive systems. The 2025 University of Pennsylvania breach demonstrated how a compromised PennKey SSO account could provide access to several internal services and expose information belonging to 1.2 million individuals. SSO is not inherently insecure, but it must be treated as a critical security control rather than a simple convenience feature.
Strong password policies remain an important foundation for protecting SSO accounts. Current NIST guidance recommends passwords of at least 15 characters when they are used without additional authentication, while passwords used with multi-factor authentication (MFA) may be at least eight characters. Organizations should permit passwords of up to 64 characters and compare new passwords against lists of commonly used or previously compromised credentials. At the same time, businesses should reconsider frequent mandatory resets and rigid complexity rules, which can encourage predictable habits such as adding a number to an old password.
MFA should be enforced consistently for every user, application, and access scenario—not only for administrators or accounts considered high risk. SMS codes and basic one-time passwords provide more protection than passwords alone, but phishing-resistant technologies offer stronger defenses against modern credential theft. FIDO2 security keys, WebAuthn, and passkeys can help prevent attackers from capturing authentication data through phishing pages or infostealer malware. These methods are particularly valuable for privileged accounts and systems containing sensitive information.
Organizations must also protect the infrastructure supporting their SSO environment. Identity-provider administrator accounts should use separate privileged identities, phishing-resistant MFA, just-in-time access, and continuous monitoring. SAML certificates, token-signing keys, OAuth secrets, application credentials, and refresh tokens should be stored securely, rotated regularly, and restricted to authorized personnel. Security teams should review application registrations, delegated permissions, and user-consent grants to remove stale or excessive access that attackers could exploit for persistence.
When properly implemented, SSO can improve security by reducing password reuse, limiting password exposure across applications, centralizing access policies, and simplifying account deactivation when employees leave. It can also reduce help-desk requests caused by forgotten passwords and make compliance reporting easier. Nevertheless, SSO is not secure by default. Organizations should combine strong password screening, universal phishing-resistant MFA, hardened administrator accounts, controlled recovery procedures, careful application permissions, and regular monitoring to ensure that one compromised credential does not become a gateway to the entire enterprise.