In this guide · 7 sections
Short answer
SSO means one company login for many apps. SAML and OIDC are the protocols apps use to trust that login. SCIM creates and removes app accounts automatically. A 15-person company should use "Sign in with Microsoft or Google" wherever it's free, and pay for SAML or SCIM only for its most sensitive apps.
SSO, SAML, OIDC and SCIM in plain English
Microsoft's single sign-on overview describes SSO as signing in once with one account to access multiple apps. The company account (the identity provider, or IdP) vouches for the user; each app (the service provider) trusts it.
| Term | What it does | Everyday example |
|---|---|---|
| SSO | One login for many apps | Staff open Xero, Canva and the HR system without separate passwords |
| Identity provider (IdP) | The system that holds the accounts and MFA | Microsoft Entra ID (Microsoft 365) or Google Workspace |
| SAML | An older, widely used standard for passing the login to an app | The "Log in with SSO" button on business software |
| OIDC / OAuth | A newer standard used by "Sign in with Microsoft / Google" | Signing in to Zoom or Slack with your work Google account |
| SCIM | Automatically creates, updates and removes app accounts | A new hire gets a Slack account; a leaver loses it the same minute |
SAML or OIDC answer "is this the right person?". SCIM answers "should this person have an account here at all?". You can have SSO without SCIM, but then leavers' app accounts still exist even though they can no longer log in through SSO.
What your Microsoft 365 or Google Workspace plan already includes
You probably already pay for an identity provider. The question is which features your plan includes.
| Feature | Microsoft 365 | Google Workspace |
|---|---|---|
| SSO to SaaS apps | Entra ID Free: "unlimited SSO across any SaaS app" | Pre-integrated SSO for over 200 apps, plus custom SAML apps |
| MFA on that login | Yes; Conditional Access needs Entra ID P1 | Yes, 2-Step Verification |
| SCIM provisioning to apps | Needs Entra ID P1 (included in Business Premium) | Automated provisioning for many popular apps |
| Standalone price of the upgrade | Entra ID P1 from US$7 per user a month, yearly | Varies by edition |
Microsoft's Entra pricing page lists unlimited SSO in the free tier and P1 from US$7 per user a month, and notes P1 is included in Microsoft 365 Business Premium. Microsoft's SCIM provisioning docs list an Entra ID P1 licence as a prerequisite. On Google, see About automated user provisioning and set up a custom SAML app.
The SSO tax: why some apps charge more for it
On the app side, SAML SSO and SCIM are often only available on a vendor's business or enterprise plan. Critics call this the "SSO tax", and sites such as sso.tax track vendors that gate SSO behind much higher prices or minimum seat counts.
The workaround for small companies: most apps offer "Sign in with Google" or "Sign in with Microsoft" on every plan. That is OIDC, not SAML, but it gives most of the benefit: staff use their company account and its MFA, and suspending that account blocks new sign-ins. What you don't get is forced use (staff could still set a separate password) or automatic account removal.
Why it matters most when people leave
For a small company, the strongest argument for SSO is offboarding, not convenience. Without it, a leaver's access is spread across a dozen apps with separate passwords, and someone has to remember to remove each one.
With SSO (and ideally SCIM)
- Disable one account and sign-in to every connected app stops
- SCIM removes or deactivates the app accounts too
- MFA is enforced once, centrally
- One place to see who has access to what
Without SSO
- Each app has its own password, often reused
- Leavers may keep access to apps nobody remembered
- MFA must be set up app by app
- Shared logins are common and hard to revoke
Our employee offboarding checklist covers the full leaver process, and admin account best practice covers protecting the identity provider itself, which becomes the key to everything once SSO is in place.
When should a 15-person company bother?
Signs you're ready for SSO and SCIM
If you tick two or three, start with the free step: switch every app that supports it to "Sign in with Microsoft / Google". Pay for SAML and SCIM on the apps that hold sensitive data. Enterprise customers often ask about this in vendor reviews; our security questionnaire guide shows how to answer honestly.
Do it yourself or get help?
Switching apps to "Sign in with Google / Microsoft" is a DIY job: each app's settings usually have the option, and staff log in once to link their accounts. SAML set-ups take more care, because a wrong certificate or setting can lock everyone out of an app; always keep one admin who can log in without SSO.
Our Microsoft 365 / Google Security Lockdown (S$590) secures the identity provider first, with MFA, admin roles and sign-in policies. For a regular, written view of who can access which apps, the Access Review & Leaver Tool (S$1,200) builds a dashboard of accounts and a one-click leaver checklist.
Frequently asked questions
SSO is the outcome: one login for many apps. SAML is one of the technical standards used to achieve it, by passing a signed message from your identity provider, such as Microsoft Entra ID or Google Workspace, to the app. OIDC is another standard that does a similar job, used by most Sign in with Microsoft or Google buttons.
SCIM is a standard for automatically creating, updating and removing user accounts in apps. When you add a new hire to your identity provider, SCIM can create their accounts in connected apps; when someone leaves, it deactivates them. Without SCIM, SSO blocks sign-in but the app accounts and their data access may still exist.
Yes. Every Microsoft 365 tenant includes Microsoft Entra ID Free, which Microsoft's pricing page says covers unlimited SSO across SaaS apps. Features such as Conditional Access and automatic SCIM provisioning to apps need Entra ID P1, which is included in Microsoft 365 Business Premium or sold separately from US$7 per user a month, as of October 2026.
It is a nickname for SaaS vendors charging much more for plans that include SAML single sign-on, often their enterprise tier with minimum seat counts. Small companies can usually avoid it by using Sign in with Google or Microsoft, which most apps include on every plan, and paying for SAML only on their most sensitive tools.
For a small company it gives most of the benefit: staff use their company account and its MFA, and suspending the account blocks new sign-ins. SAML set-ups usually also let you force SSO, so nobody keeps a separate password, and pair with SCIM to remove accounts automatically. Use SAML where the data is sensitive.