SSO and two-factor: securing your team's logins
Single sign-on and two-factor authentication are the two highest-value login controls a practice can put in place. Here's how they fit together.
Most security incidents begin with a compromised login. A reused password, a convincing phishing email or a leaked credential is often all it takes. Two controls address this directly: single sign-on (SSO) and two-factor authentication (2FA). They are not the same thing, they work well together, and both are worth setting up across your practice.
What single sign-on gives you
Single sign-on lets your team log in to multiple tools using one trusted identity provider, typically Google Workspace or Microsoft 365. Instead of separate passwords for every app, people authenticate once through a system your firm controls.
- Central control. When someone leaves, disabling their identity provider account removes access everywhere at once.
- Fewer passwords. Fewer credentials means fewer chances for weak or reused passwords.
- Consistent policy. Password rules, session limits and 2FA are enforced in one place.
What two-factor authentication adds
Two-factor authentication requires a second proof of identity beyond the password, usually a code from an app or a tap on a registered device. Even if a password is stolen, an attacker cannot log in without that second factor.
Choosing a second factor
Not all second factors are equal. In rough order of strength:
- Hardware security keys offer the strongest protection against phishing.
- Authenticator apps that generate time-based codes are a solid, widely used choice.
- SMS codes are better than nothing but can be intercepted, so prefer an app where possible.
Whatever you choose, make sure each person registers a backup method so a single lost or replaced phone does not lock them out of their work for a day.
How they work together
SSO and 2FA are complementary. SSO centralises identity; 2FA strengthens it. The most effective setup is to require SSO through your identity provider and enforce 2FA at that provider, so every connected tool inherits the protection automatically. Platforms that support SSO with Google and Microsoft, including Finye, slot neatly into this model rather than asking your team to manage yet another password.
Rolling it out without friction
Adoption matters as much as the technology. A few practical tips help it stick.
- Enrol everyone over a short, announced window rather than all at once with no warning.
- Help people register a backup factor so a lost phone does not lock them out.
- Make sure administrators themselves use the strongest factors, since their accounts are the most valuable.
Takeaway: route logins through a single identity provider, enforce two-factor authentication there, and your whole toolkit becomes dramatically harder to break into, with little day-to-day effort for your team.