Both IT and the line of business should view the growing value of single sign-on as an accelerating curve. The more credentials a user has, the more difficult it is to remember them. When the business reduces the number of credentials, users are more likely to follow sound credential management.
That same aggressive value curve is driven by convenience. The less you interrupt users, the more productive (employee or contractor) and happy (consumer) they are. Ideally, there is an initial fingerprint, facial recognition, or some other claim when entering the application or starting a session and nothing more. Regardless of how many services or resources users draw from, theyâ€re not interrupted from their tasks. In the same paradigm, the more the app or web service interrupts the user with an authentication prompt, the less satisfying and counterproductive it is. For these reasons, technical decisions or implementations that donâ€t accomplish SSO for commonly accessed resources are the most damaging.
Limiting authentication to Active Directory (AD)
While AD (as well as Azure AD) has become the primary identity provider, most organizations have essential resources that go beyond it. While younger or smaller organizations may find that AD supplemented with Microsoftâ€s federation solutions are enough to deliver single sign-on, the majority of them are more heterogeneous than that.
Depending exclusively on trust model technologies
The adoption of SAML and OIDC has been widespread. But complicated environments are usually unable to provide full coverage. Surprisingly, a number of SaaS-based services either donâ€t support federation or charge more for it than organizations are willing to pay. Conversely, record/play technologies or a centrally managed access gateway fill in the gaps of single sign-on coverage.
Misunderstanding your usersâ€ authentication experience
Often, IT organizations donâ€t know the different personae of users who access throughout the week. Without a clear picture, they canâ€t prioritize which resource to add to their single sign-on infrastructure. Furthermore, services that departments or lines of business consume are not typically included in SSO planning.