If desired, they can choose to use SSO on any nonwork apps they use. For your work-related apps, however, it would be best if your RIAs use SSO for all of them.