SSO works by creating an authentication token when a user signs in to a service with their SSO login. This token is stored in the user's browser or the SSO solution's central authentication service (CAS) server. When a user accesses another app or website, the SSO service checks the token to confirm the user's identity and grant access without requiring them to log in again.