Documentation / Platform glossary / Single sign-on
Single sign-on lets a person authenticate once with their organization's identity provider and then reach multiple applications without authenticating again. Each application stops holding credentials and instead trusts an assertion from the provider, which changes where account control actually sits.
The mechanism has three parties. The user wants access. The service provider — the application — needs to know who they are. The identity provider holds the authoritative account and performs authentication. When the user reaches the application unauthenticated, the application redirects to the provider, the provider authenticates and returns a signed assertion, and the application establishes a session from it. SAML and OpenID Connect are the two standards that carry this exchange.
The consequential detail is what the application no longer does. It does not store a password, cannot verify credentials itself, and depends entirely on the provider's assertion. Account lifecycle moves to the provider: an employee disabled in the directory loses access without anyone touching each application individually.
That centralization is the main benefit and the main risk in the same breath. Deprovisioning becomes reliable, and the provider becomes a high-value target whose compromise reaches everything that trusts it — which is why enforcing multi-factor authentication at the provider matters more once SSO is in place, not less.
SSO answers who you are, not what you may do. Authorization remains the application's responsibility, though a provider may supply group or role claims that inform it. Treating a valid assertion as sufficient for access is a common and serious mistake.
For an enterprise, per-application credentials are an operational and audit problem: password reuse, orphaned accounts after departures, and no single place to enforce authentication policy. SSO resolves all three by making the directory the control point.
That is why SSO support is often a procurement requirement rather than a preference. A platform without it does not fit the identity program the organization already operates.
QueryTek supports enterprise single sign-on so an authenticated person arrives in the correct tenant workspace with permissions applied there, and honours provider-side account lifecycle. Supported providers and configuration are handled through onboarding rather than public documentation.
