Single Sign-On (SSO)

Why it matters

In a school the real problem SSO solves is not password fatigue, it is leavers. A teacher who resigns mid-session typically holds separate logins for the student system, the exam module, email and the learning platform, and one of them quietly stays live. Deprovisioning usually falls on a single IT coordinator with no central list of accounts.

In practice

• One identity provider — in schools most often Google Workspace or Microsoft Entra ID — sits in front of every application, connected using SAML or OpenID Connect.
• Connected applications never see the password; they accept a signed assertion that the identity provider has already authenticated the user.
• Disabling the account at the identity provider ends access to every connected system at once, which is the main day-to-day operational gain.
• Roles and permissions normally still live inside each application: SSO answers 'who is this?', not 'what may they do?'.
• Parents and students often sit outside institutional SSO because they hold no school-issued account, so those portals usually keep their own login.

Common mistakes

• Enabling SSO but leaving the old local logins active, so the bypass survives every offboarding.
• Skipping multi-factor authentication on the identity provider, turning one stolen password into access to everything.
• Sharing a single staff-room or office account, which defeats SSO's audit trail entirely.