Single sign-on (SSO)
Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each. Cyber Essentials does not require it, but it affects testing: at Cyber Essentials Plus, cloud services that share an authentication service have MFA checked once for that service.
- Term
- Single sign-on
- Also known as
- SSO, Sign in with Microsoft, Sign in with Google
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term single sign-on mean in Cyber Essentials?
Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
How does single sign-on apply to Cyber Essentials?
In plain terms
SSO is like one staff pass that opens every door in the building, instead of a separate key for each room. You sign in once with your work account and the other apps trust that sign-in. It is convenient, it means fewer passwords to manage, and when someone leaves you can switch off one account instead of twenty. The flip side is that the one account becomes very valuable, so it needs strong protection.
What Cyber Essentials asks
The scheme does not mention SSO by name. Its rules still apply to every cloud service: "authentication to cloud services must always use MFA", and a No to A7.16 (administrators) or A7.17 (users) is an automatic fail. With SSO, that usually means MFA is enforced at the shared login.
The Cyber Essentials Plus test specification recognises this. Test case 4 says: "Where multiple cloud services share an authentication service this test only needs to be performed once for each authentication service."
Every cloud service still belongs on your list at A2.9, whether or not it uses SSO, because cloud services cannot be excluded from scope.
Common mistakes
- Apps that also allow a separate username and password alongside SSO. Those logins need MFA too, or should be switched off.
- Admin accounts created inside an app before SSO was set up, which still sign in directly.
- Assuming a leaver is fully removed when their SSO account is disabled, while they still hold a direct login to one app.
See CE Plus test 4 and the Microsoft 365 and Entra ID setup guide. Related: identity provider, multi-factor authentication, cloud service.
Related terms
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
- Cloud serviceA cloud service is an on-demand, scalable service hosted on shared infrastructure, reached over the internet through an account, that stores or processes your organisation's data.
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
Frequently asked questions
Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
Single sign-on relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.