A computer-implemented method for managing encryption keys for single-sign-on applications, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising: receiving, from an identity service, a notification of a request to access encrypted data on a cloud service, the notification including a session key for encrypting and decrypting a master key for decrypting cloud service keys; deriving, based on at least one authentication element received from a user, the master key, wherein deriving the master key comprises: applying a hashing function to the authentication element received from the user, wherein the authentication element is an authentication factor and the applying the hashing function comprises using a key derivation function to convert the authentication factor to a cryptographic key; authenticating the user based on the authentication element; in response to authenticating the user, retrieving a private key for encrypting and decrypting the master key; and using the private key to decrypt the master key; decrypting, using the master key, a cloud service key for decrypting data on the cloud service; storing the master key, encrypted using the session key, in a client key store; receiving, from the identity service, an additional notification of an additional request to access encrypted data on an additional cloud service, the notification including the session key; without again obtaining the authentication element from the user, decrypting the master key by using the session key; decrypting, using the master key, an additional cloud service key for decrypting data on the additional cloud service. receiving, from an identity service, a notification of a request to access encrypted data on a cloud service, the notification including a session key for encrypting and decrypting a master key for decrypting cloud service keys; deriving, based on at least one authentication element received from a user, the master key, wherein deriving the master key comprises: applying a hashing function to the authentication element received from the user, wherein the authentication element is an authentication factor and the applying the hashing function comprises using a key derivation function to convert the authentication factor to a cryptographic key; authenticating the user based on the authentication element; in response to authenticating the user, retrieving a private key for encrypting and decrypting the master key; and using the private key to decrypt the master key; applying a hashing function to the authentication element received from the user, wherein the authentication element is an authentication factor and the applying the hashing function comprises using a key derivation function to convert the authentication factor to a cryptographic key; authenticating the user based on the authentication element; in response to authenticating the user, retrieving a private key for encrypting and decrypting the master key; and using the private key to decrypt the master key; decrypting, using the master key, a cloud service key for decrypting data on the cloud service; storing the master key, encrypted using the session key, in a client key store; receiving, from the identity service, an additional notification of an additional request to access encrypted data on an additional cloud service, the notification including the session key; without again obtaining the authentication element from the user, decrypting the master key by using the session key; decrypting, using the master key, an additional cloud service key for decrypting data on the additional cloud service. <EOS>