SSO Setup for Small Teams 2026: One Login for Every App You Use

Your team uses Slack, Gmail, Notion, GitHub, your CRM, your accounting tool, and half a dozen more apps. Each one has its own login. Each one has its own password, and each one is a door someone can walk through when a person leaves. Single sign-on, or SSO, closes all those doors down to one. Your team signs in once, and that one sign-in opens every app.

This SSO setup small teams 2026 guide is written for a team of 5 to 25 people with no IT department. It covers what SSO is in plain language, why 2026 is the year to set it up, the exact steps, what each provider costs right now, and the mistakes that trip up most small teams. Prices come from vendor pricing pages read in October and November 2026, so check the vendor page before you sign, because list prices move.

What is SSO and how does it work?

SSO means one login for every app. You prove who you are one time, to one system called an identity provider. That system then vouches for you to every app your team uses. You stop typing passwords into Slack, then Notion, then GitHub, then your CRM. You type one password, or touch one fingerprint, and the rest opens on its own.

Two standards do the heavy lifting behind the scenes. SAML is the older one. It passes signed XML messages between the identity provider and the app. OIDC, short for OpenID Connect, sits on top of OAuth 2.0 and uses JSON tokens instead. Most apps built in the last ten years support OIDC. Older business apps often only speak SAML. A good identity provider handles both, so you do not have to care which one an app uses.

The flow takes about two seconds and looks like this. A person clicks login on an app. The app sends them to your identity provider. The person signs in there, usually with a password plus a second factor such as an authenticator app or a passkey. The identity provider sends a signed token back to the app. The app checks the signature and lets the person in. The person never types a password into the app itself, which is the whole point: the app never sees a password it can leak.

That last part is easy to miss and it matters. When every app holds its own password, every app is a place that password can be stolen from. With SSO, only the identity provider holds the login, and you can guard that one place properly with strong MFA, login rules, and alerts. One well-guarded door beats twenty doors with twenty different locks.

Why do small teams need SSO in 2026?

Passwords stopped working as a system years ago, and 2026 is when the vendors started forcing the change. The average employee now juggles dozens of work logins. People cope by reusing passwords, and reuse means one breach opens everything. A password manager helps, and our password manager guide for small teams shows how to pick one, but a manager still stores secrets. SSO removes most of the secrets in the first place.

Offboarding is the sharper reason. When someone leaves, you need their access gone from every tool, right away. Without SSO you are clicking through Slack, GitHub, Notion, AWS, Stripe, QuickBooks, and a dozen more, one by one. Something always gets missed, and a missed login is an open door to your code, your customer list, and your money. With SSO you disable one account and every connected app locks them out in seconds. Founders who have lived through a messy departure know exactly how much that one switch is worth.

Compliance is creeping downmarket too. SOC 2, ISO 27001, and even cyber insurance questionnaires now ask about central identity. If you want to sell to larger companies or handle regulated data, you need a real answer, not a shrug. SSO plus enforced MFA is the answer most auditors want to hear. Our cybersecurity tools guide for small business covers the rest of the stack that sits around it.

Then there is the calendar. Microsoft made passkeys the default sign-in method in Entra ID on 1 September 2026, and it retires its own SMS and voice authentication on 1 February 2027 for most users, and on 1 July 2027 for administrators. Okta turned on FIDO2 passkey authenticators by default in September 2026. NIST published SP 800-63B-4, its new digital identity guidance, which treats synced passkeys as phishing-resistant and drops the old rule that forced periodic password rotation. The direction is clear: passwords are on the way out, and the identity provider is where the new login lives. Setting up SSO now puts you on the right side of all three changes at once.

Phishing is the push behind it. Microsoft Threat Intelligence has reported click-through rates of up to 54% on AI-written phishing campaigns, against roughly 12% for old-style lures. A password, no matter how long, can be typed into a fake login page. A passkey cannot, because there is nothing to type. SSO plus passkeys takes the most phished thing in your business, the password, mostly out of the picture.

How do you set up SSO in 10 steps?

Plan for two to four weeks, and do it in small batches. A single sign-on small business rollout is mostly admin clicks, not code. The work is mostly clicking through admin screens, not writing code. The order below is the order that avoids rework.

Step 1: list every app

Write down every app your team uses, who uses it, and whether it supports SAML, OIDC, or neither. Check the app settings page or its help docs. Mark the critical ones first: email, code hosting, your CRM, cloud infrastructure, finance, and HR. Apps that support neither protocol need a workaround, usually a password manager entry, or a replacement. Finding that out in week one beats finding it out after you have already told the team SSO is live. Your CRM is often the app with the most sensitive customer data, so if you are still choosing one, read our CRM software guide for small business before you wire it into SSO.

Step 2: pick your identity provider

Use the comparison in the next section. The short version: if you already pay for Google Workspace or Microsoft 365, your identity provider is already in the building and SSO costs nothing extra. If you use neither, Cloud Identity Free or Entra ID Free gets you started at $0.

Step 3: create the tenant

Sign up for the identity provider with a dedicated admin email such as admin@yourdomain.com, never a personal inbox. Turn on MFA for that admin account on day one. Add a second admin as backup, because a tenant with one admin is a tenant one forgotten phone away from lockout.

Step 4: verify your domain

Add your company domain in the identity provider and prove you own it with a TXT record in your DNS settings. This takes five minutes and one DNS change. It lets the provider issue logins for yourdomain.com addresses.

Step 5: add your people

Import the team. Most providers sync straight from Google Workspace or Microsoft 365. If you use neither, upload a CSV with name, email, department, and role. Put people in groups such as Engineering, Sales, Finance, and Admins. Groups are how you hand out app access later without clicking through one person at a time.

Step 6: connect your first app

Start with one low-risk app, such as email or GitHub. In the identity provider, add a new application, pick SAML or OIDC based on what the app supports, and copy the metadata URL or certificate into the app SSO settings. Test it with your own admin account first, then with one volunteer, before you touch anyone else.

Step 7: turn on MFA for everyone

Require MFA at the identity provider, not inside each app. One switch then covers every connected app. Prefer authenticator apps or passkeys. Give people a 7-day window to enroll, with a short how-to and a drop-in help session, so nobody gets locked out on a Monday morning.

Step 8: roll out department by department

Turn SSO on for one group at a time. Engineering first, since they use the most tools and will find the rough edges fast. Give each group a week. Fix what breaks before you move to the next group.

Step 9: switch off password logins

Once every critical app works through SSO, turn off password sign-in inside those apps. This is the step people skip, and skipping it leaves the back door open. If a password login still works, SSO is decoration, not security.

Step 10: write down offboarding and test it

Write a one-page runbook. When someone leaves, the admin disables their identity provider account. That single action cuts access everywhere. Test it on a spare account every quarter: disable it, then check that Slack, email, GitHub, and the CRM all refuse the login within a minute.

Which SSO provider fits your team?

Start from what you already pay for. The cheapest SSO is the one bundled into a subscription you already have. The table below uses list prices from vendor pricing pages read in October and November 2026.

SSO provider comparison for small teams, 2026

Provider	Price per user a month	Free option	Best for
Google Workspace SSO	$7 (Business Starter, SSO included)	Cloud Identity Free, $0	Teams already on Gmail and Google apps
Microsoft Entra ID	Free tier $0; P1 $7; P2 $10	Free tier with SSO and basic MFA	Teams already on Microsoft 365
Okta Workforce Identity	Starter $6; SSO a la carte $2	None, $1,500 annual minimum	Teams that want the deepest app catalog
JumpCloud SSO	$11 annual, $13 monthly	30-day trial only for new accounts	Teams that want identity plus device management
Cisco Duo Essentials	$3	Free tier with basic MFA	MFA layer in front of another identity provider

Google Workspace SSO

If your team lives in Gmail, Drive, and Docs, this is the easy pick. Business Starter costs $7 per user a month on the annual plan and SSO comes with it, along with 2-step verification and security keys on every plan. Google says its SSO covers more than 200 pre-integrated cloud apps, plus custom SAML apps for anything outside that list. If you do not need Gmail or Drive for some people, Cloud Identity Free gives you the directory, SAML SSO, and 2-step verification at $0, and Google hands out 50 free licenses by default. Contractors are the classic use: give them a free Cloud Identity account so they can reach Jira or Slack without a paid Gmail seat. The Google Workspace pricing page lists the current plans.

Microsoft Entra ID

If your team lives in Microsoft 365, Entra ID is already there. The free tier includes SSO and basic MFA for every tenant. P1 costs $7 per user a month on annual billing and adds Conditional Access, dynamic groups, and self-service password reset. P2 costs $10 per user a month and adds identity protection and privileged identity management. Microsoft raised both prices in July 2026, from $6 and $9, so older articles quoting the old numbers are out of date. P1 is already included in Microsoft 365 Business Premium and E3, and P2 is included in E5, so check your current plan before you buy anything. The Microsoft Entra ID pricing page lists the current tiers.

Okta Workforce Identity

Okta is the identity provider most enterprises compare everything else against, and its app catalog is the deepest of the five. The Starter suite costs $6 per user a month and includes SSO, standard MFA, and the universal directory. SSO on its own costs $2 per user a month as an add-on. The catch for small teams is the $1,500 annual contract minimum: at $6 a seat, that floor covers about 20 people, so a 10-person team pays the same as a 20-person team. Core Essentials at $14 and Essentials at $17 add lifecycle management and adaptive MFA. Pick Okta when your app list is long and odd, and you want provisioning that just works. The Okta pricing page lists the current suites.

JumpCloud SSO

JumpCloud bundles identity with device management, which suits teams with a mix of Windows, Mac, and Linux laptops and no separate device tool. SSO costs $11 per user a month on annual billing, or $13 month to month. Device management on its own is $9, and the combined device identity package is $13. One honest warning: the old free tier for up to 10 users now applies only to accounts created before 1 February 2024. New accounts get a 30-day trial and then pay. If an old blog post promises JumpCloud free for 10 users, that promise expired for new signups.

Cisco Duo Essentials

Duo Essentials costs $3 per user a month and is an MFA tool first, with SSO as a bonus. It works best as the second factor in front of another identity provider, not as a full directory on its own. Pair it with Cloud Identity Free and you get SSO plus solid MFA for $3 per user a month, which is the cheapest working stack in this guide.

SSO setup small teams 2026: what does it cost?

For most small teams the answer is $0, because SSO is already inside a subscription they pay for. The real cost only appears when you start from nothing, and even then it stays small. Work out the numbers for a 15-person team with email, GitHub, Slack, Notion, AWS, and QuickBooks.

SSO cost for a 15-person team, 2026

Option	Monthly cost	Annual cost	What you get
Google Workspace Business Starter	$105	$1,260	Email, SSO, MFA, Drive, Docs
Microsoft Entra ID P1	$105	$1,260	SSO, MFA, Conditional Access, dynamic groups
Okta Workforce Identity Starter	$90 list, $125 billed	$1,500	SSO, MFA, directory, deepest app catalog
JumpCloud SSO	$165	$1,980	SSO, MFA, directory, device management
Cisco Duo Essentials	$45	$540	MFA only, needs an identity provider
Cloud Identity Free plus Duo	$45	$540	SSO and MFA, no email included
Entra ID Free tier	$0	$0	SSO and basic MFA, no Conditional Access

The math is kind to teams that already pay for email. Google Workspace Business Starter at $1,260 a year covers email and SSO in one bill, and Entra ID P1 at the same $1,260 adds Conditional Access for Microsoft shops. Okta Starter looks like $1,080 a year at 15 users times $6, but the $1,500 annual minimum lifts the real bill to $1,500, which works out to $125 a month, not $90. JumpCloud at $1,980 is the priciest of the five, but it also replaces a separate device management tool, so compare it against that combined spend, not against SSO alone.

The cheapest working stack is Cloud Identity Free plus Duo at $540 a year, or Entra ID Free at $0 if your team already runs on Microsoft 365 and can live without Conditional Access for now. Start free, prove the setup works, and pay for the tier that adds the one feature you actually miss. That is a better order than buying the top tier on day one and finding out half its features sit unused.

Passkeys plus SSO: the 2026 upgrade

Passkeys replace passwords with a key pair that lives on the device. The private key never leaves the phone or laptop. The public key sits on the server. When a person signs in, the server sends a challenge, the device signs it with the private key, and the server checks it with the public key. There is no password to phish, no password to reuse, and no password to reset.

Passkeys do not replace SSO. They make the first login stronger. SSO still does the token exchange that opens each app after that first login. Together they give you phishing-resistant sign-in plus central control, which is the combination auditors and insurers now ask for.

Two kinds exist, and the difference matters. A synced passkey lives in iCloud Keychain, Google Password Manager, or a password manager, and it follows the person across their devices. A device-bound passkey stays on one device or one hardware security key and never leaves it. Microsoft recommends device-bound passkeys for admins and synced passkeys for everyone else, and NIST guidance agrees: synced passkeys count as phishing-resistant at AAL2, but the top assurance level, AAL3, needs a key that cannot be exported.

The rollout order is simple. Turn on passkeys in your identity provider first. Let people register their laptop and phone during their next login. Keep authenticator apps as the fallback for a month, then tighten the policy. For Microsoft shops the timing is set by the vendor: passkeys became the default sign-in in Entra ID on 1 September 2026, and Microsoft-provided SMS and voice authentication shuts off on 1 February 2027 for most users. If your team still signs in by texted code, that date is your deadline, not a suggestion.

What are the 5 mistakes that break an SSO rollout?

Most SSO rollouts fail on boring admin details, not on tech. All five mistakes below are avoidable, and all five cost real time when they are not.

Mistake 1: skipping the inventory

You connect five apps, then find the sixth does not support SAML or OIDC. Now you have a gap, and the team keeps a password for that one app, which is the app that gets breached. List every app first. Note the protocol each one supports. Replace or work around the odd ones before you announce anything.

Mistake 2: using a personal admin account

When the tenant owner leaves, you lose control of the whole identity system. Always use a dedicated admin email owned by the business, with a second admin as backup. The tenant belongs to the company, not to a person.

Mistake 3: no break glass accounts

If the identity provider itself goes down, or MFA breaks for the admin team, you need a way back in. Create two emergency accounts with long passwords stored offline, in a physical safe or a sealed envelope. Exclude them from MFA and conditional access rules. Test them every quarter. An untested backup is not a backup.

Mistake 4: never testing offboarding

Teams write the offboarding runbook and never run it. Then a real departure happens and they find out the CRM still lets the person in. Disable a test account once a quarter. Check every critical app refuses the login within a minute. Fix whatever stays open.

Mistake 5: leaving password login switched on

This is the most common one. SSO works, everyone is happy, and nobody turns off the old password login inside each app. Attackers do not care about your SSO setup. They try the password door, and if it still opens, your SSO bought nothing. Switch password login off on every app once SSO is proven, and check it again after every app update, because updates sometimes switch it back on.

The bottom line

SSO setup for small teams in 2026 is a two to four week job, and for most teams it costs nothing extra, because SSO already sits inside Google Workspace or Microsoft 365. A 15-person team that starts from zero pays $540 a year with Cloud Identity Free plus Duo, or $1,260 with Google Workspace Business Starter, which also covers email.

Pick the provider that matches the email system you already use. Follow the ten steps in order, roll out one department at a time, and switch password logins off when SSO is proven. Then add passkeys, because Microsoft retires SMS and voice authentication on 1 February 2027 and passkeys are already the default in Entra ID. Do those things, test offboarding every quarter, and the next person who leaves costs you one click instead of a day of chasing logins.

Start with the free tier this week. Inventory your apps, create the tenant, and connect one app. That first working login is the proof the rest of the rollout is real, and it takes less than an afternoon to get there.

The 54% versus 12% phishing gap is why passkeys, not a longer password, are the 2026 upgrade. A password can be typed into a fake login page, a passkey cannot, so turn passkeys on in the identity provider first and keep authenticator apps as the fallback for a month.

Frequently asked questions

Do I still need a password manager if I have SSO?

Yes, for now. A password manager stores secrets, SSO removes the need for most of them. They solve different problems. Use both during the changeover. Over time SSO plus passkeys shrinks the password manager down to a vault for the few apps that still do not support SSO.

What happens if the identity provider goes down?

You use break glass accounts. Create two emergency admin accounts with long passwords stored offline, in a physical safe or a sealed envelope. Exclude them from MFA and conditional access rules. Test them every quarter so you know they work before you ever need them.

Can I start SSO for free and upgrade later?

Yes. Google Cloud Identity Free, Microsoft Entra ID Free, and the JumpCloud 30-day trial all let you start at zero cost. Moving to a paid plan later is mostly a settings change, not a data move. Pick the free tier that matches the email system you already use.

How long does SSO setup take for a small team?

Two to four weeks for a 15-person team. Week one is inventory and provider setup. Week two is connecting the critical apps. Week three is turning SSO on department by department. Week four is switching off password logins and writing down the offboarding steps.

How do I handle contractors and freelancers with SSO?

Give each contractor a company email address and put them in a Contractors group. Scope their app access to only what the job needs. When the contract ends, disable the one account and every connected app locks them out at once. Never share passwords or use one shared login for outside help.