SSO for Small Businesses

Single sign-on (SSO) lets employees log in to many company cloud services with one set of credentials, and lets an administrator switch off a leaver's access from one place. It suits companies of 10 to 50 people that use around ten cloud services. The cost starts at zero extra if you use features already included in Microsoft 365 or Google Workspace, and runs from a few hundred to around a thousand yen per user per month for a dedicated IDaaS (cloud identity service), based on official prices as of November 2026 (details in the tables below). Some IDaaS products set a minimum number of users, so a few are not available to a 10-person company. This article explains what SSO can and cannot do, compares the options, estimates costs by company size, and covers a five-step rollout and common failure patterns, written for companies without a dedicated IT person.

SSO designates one place that issues company identities, and each cloud service trusts that place's confirmation when it lets someone in. That place is called the IdP (identity provider). An employee logs in to the IdP once in the morning and then reaches accounting, time tracking, chat and business systems without typing another password.

The need is highest in companies like these.

- About ten cloud services, each managed with a separate login
- A leaver's account has been left active at least once
- Some staff reuse the same password across services
- Business partners increasingly ask about access control and MFA (multi-factor authentication)
- No dedicated IT person; account management falls to general affairs or the owner as a side duty

On the other hand, with three or four services and five or fewer staff, a password manager and consistent MFA are often enough before SSO. SSO is not a cure-all; the order of measures depends on company size and the problems you actually have.

The first is missed deletion of leavers' accounts. When each service has its own administrator and you must stop ten services one by one at exit, forgetting a single one leaves a path into company information after the person has left. The full exit procedure is in the offboarding IT checklist. With SSO, services connected to it can be cut off with one action at the IdP, but unconnected services still have to be stopped individually.

The second is password reuse. The more passwords people must remember, the more they reuse one. A password leaked from one service being used to break into others is a typical incident. If SSO reduces the passwords used for work to effectively one, the motivation to reuse them shrinks.

The third is inconsistent MFA across services. Each service has its own setup screen and method, and making everyone configure all of them is a heavy burden. If MFA is required at the IdP, there is one place to configure. The thinking behind MFA is covered in account, password and MFA management for small businesses.

There are four realistic kinds of options for a small business. Prices below were checked on each vendor's official page and are per user per month unless noted. Dollar-priced products are shown in dollars without conversion.

1. Microsoft Entra ID (for companies on Microsoft 365). A Microsoft 365 subscription comes with Entra ID as the IdP. Business Basic and Standard include the free tier, and Microsoft's US page lists MFA, unlimited SSO and password self-service for it. If you need Conditional Access (controls such as blocking sign-in from unknown devices outside the company), the paid P1 is the candidate, and Business Premium includes P1. Standalone, Microsoft's Japanese page shows the equivalent of 1,049 yen per month (annual billing, excluding tax) and the US page shows $7 (annual billing). For the differences between Microsoft 365 plans, see this article.

2. Google Workspace sign-in integration (for companies on Google Workspace). The Google Workspace admin console can connect SAML-compatible apps. Google's official help for Cloud Identity says that using Google as the IdP for SAML apps is available in both the free and paid editions, while automatic user provisioning and deprovisioning is Premium only. As of November 2026, Google's official page lists Workspace at 800 yen (Business Starter), 1,600 yen (Standard) and 2,500 yen (Plus) per user per month, excluding tax. The range of integrations available at no extra charge may vary by Workspace edition, so check Google's help before adopting. We could not confirm a standalone Cloud Identity price, so treat it as a matter to ask Google about. For choosing between the two suites, see Google Workspace vs Microsoft 365.

3. Japanese IDaaS (HENNGE One, GMO Trust Login and others). These suit companies whose mail platform is not limited to Microsoft 365 or Google, or that want Japanese-language screens and support. HENNGE One's official new plans from October 2026 price the Identity Edition at 400 yen (IdP), 600 yen (IdP Pro) and 1,000 yen (IdP Ultra) per ID per month, excluding tax. However, the minimum for new contracts is stated as 200 IDs, so companies of 50 or fewer are likely to fall outside the conditions. GMO Trust Login's official pricing page lists SSO Pro at 300 yen and SSO Pro plus SaaS management at 500 yen (yen, excluding tax, 12-month contract), with a minimum of 30 users. The page did not make clear whether the unit is per user or per ID, so confirm that in a quote.

4. Okta (a leading overseas IDaaS). On its official page, the Workforce Identity Starter suite is $6 per user per month (SSO included, annual billing) and Essentials is $17; Professional and above are quote-based. The annual contract minimum is stated as $1,500. Because it is an overseas product, the admin console and support are mainly in English, which is worth weighing alongside cost.

The table below simply multiplies the official unit prices. It excludes the fee for Microsoft 365 or Google Workspace itself and shows only the extra amount needed for SSO. Amounts exclude tax and are not converted; Okta stays in dollars.

Three points follow from the table. First, if you already use Microsoft 365 or Google, you can probably start SSO at no extra cost. Second, dedicated IDaaS looks cheap at a few hundred yen per user per month, but minimum contract sizes or annual minimums make some products impractical or relatively expensive for a 10-person company. Third, adding features such as Conditional Access for everyone pushes even a 10-person company past 10,000 yen a month; giving them only to the people who need them keeps the cost down.

The approach with the fewest failures is to start from the mail and groupware platform you already use. If you are on Microsoft 365, try Entra ID first; if you are on Google Workspace, try Google's sign-in integration. Before adding a new contract, find out how far you can get within what you already pay for.

- Microsoft-centric and concerned about lost devices or off-site access: set up SSO and MFA with Entra ID Free and give P1 (or Business Premium) only to those who need it
- Google-centric: connect SAML apps from the Workspace admin console and cover gaps with other measures
- Using both, or unwilling to tie to one platform: consider an IDaaS, but check the minimum contract size first
- Many of your SaaS products do not support SAML: first check each service's SSO support and the plan required; this is where cost changes most (see failure patterns)

List the cloud services the company subscribes to. Put the service name, administrator, number of users, current login method, whether it supports SSO (SAML), and the plan required for SSO into one table. Support is usually documented in each service's help or pricing page. This table is the basis for every later decision.

Choose one IdP using the thinking above. Running several IdPs brings back multiple places to switch off at exit. Once chosen, appoint at least two administrators and prepare a separate emergency administrator account (a break-glass account) for getting into the IdP, stored apart from daily operations.

Because SSO makes the entrance single, a break-in there has a bigger effect. Before adding integrations, require MFA for everyone at the IdP. Choose an authenticator app or, where possible, a device-bound passkey, and avoid relying only on SMS codes.

Do not connect everything at once. Try one or two services with administrators only, then expand to widely used services such as accounting, time tracking and chat. After connecting, disable direct ID and password login wherever the service allows it; otherwise an entrance that bypasses SSO remains and MFA does not apply.

At joining, create the account in the IdP and grant access to services by department. At leaving, disable the IdP account and include in the procedure the accounts on unconnected services and the changing of shared-account passwords. For concrete items, see the offboarding IT checklist.

- A higher plan was required for SSO (the so-called SSO tax): some SaaS products offer SAML SSO only on upper plans or as paid options. Raising several services' plans just to enable SSO can cost more than the IdP itself. Before signing, check the required plan and price difference for each service in the Step 1 table
- Everything depends on one administrator account: with a single IdP administrator, that person leaving, being absent or having the account hijacked stops or endangers everything. Appoint at least two administrators and use especially strong MFA on admin accounts
- Direct login remains after connecting: if the old password still works after SSO is in place, reuse and a leaver's path in both remain
- Choosing a product without checking the minimum contract size: you build the comparison table and only then find you cannot sign at your headcount

- Have you listed your cloud services and the administrator of each?
- Have you checked whether each service supports SSO (SAML), and the required plan and price difference?
- Have you first confirmed whether your current groupware (Microsoft 365 or Google Workspace) is enough?
- If considering an IDaaS, have you confirmed the minimum contract size, annual minimum, term and pricing unit?
- Have you confirmed prices from official pages or quotes and compared them on the same tax basis?
- Have you appointed at least two IdP administrators and stored an emergency admin account separately?
- Have you decided to require MFA for everyone at the IdP, and the method (authenticator app or passkey)?
- Have you decided to disable direct ID and password login after connecting?
- Have you written the exit procedure for services outside SSO and for shared accounts?
- Have you built IdP account creation and disabling into joining and leaving procedures?