Single Sign-On (SSO)

Single sign-on (SSO) lets users authenticate once with a central identity provider and then access multiple applications without separate usernames and passwords. It is typically implemented with standards such as SAML 2.0 or OpenID Connect (OIDC), with corporate directories like Microsoft Entra ID, Okta, or Keycloak acting as the identity provider.

SSO matters for governance because identity is the foundation of every access decision. When the data catalog, BI tools, and databases all authenticate through the same provider, there is one place to enforce password policy and multi-factor authentication, one place to disable a departing employee, and one consistent identity to which every audit log entry traces. Without SSO, organizations accumulate local accounts that outlive their owners — a classic audit finding.

For a Saudi DMO, SSO supports the NDMO framework's data security controls around access management and strengthens PDPL accountability: when SDAIA or an internal auditor asks who accessed personal data, the answer is reliable only if every login resolves to a verified corporate identity. SSO also pairs naturally with role-based access control — the identity provider's groups can map to catalog roles, so joiners, movers, and leavers automatically receive and lose the right access as their group membership changes.