SSO, MFA, and Why You Have to Log In Again

Every workday starts the same way: a login screen, a password, a phone buzz, a tap. Then at 2 p.m. an app you were using an hour ago demands you prove who you are again. None of this is random. Behind it sits identity — the layer that answers two questions for every system in the company: who are you, and what may you touch?

The foundation is the directory: one master list of every person and what they’re allowed to access. Microsoft Entra ID (the successor to Active Directory) and Okta are the famous examples — if your company runs on Microsoft 365, Entra ID is the directory doing the vouching every time you open Outlook. In module 1 terms, the directory is the system of record for access, and like all systems of record, when it disagrees with what you think you should be able to open, it wins.

SSO and MFA: one key, checked properly

SSO (single sign-on) means you log in once, to the directory, and the directory vouches for you to every app. That’s the whole trick behind the “Sign in with your company account” button: the app never sees your password — it asks the directory “is this really them?” and trusts the answer. One strong login instead of forty weak ones, and when you leave the company, one switch turns them all off.

MFA (multi-factor authentication) is what makes that one login strong: something you know (your password) plus something you have (your phone, a hardware key). A stolen password alone opens nothing, which — since phished passwords are how most breaches start — is the entire point.

And the 2 p.m. re-login? Sessions expire on purpose. A session is a temporary “yes, it’s them,” and a yes that lasted forever would be a stolen laptop’s dream. Systems also run risk-based prompts: log in from a new device, a new country, or the coffee-shop wifi, and the directory raises an eyebrow and asks for MFA again. Annoying, but the alternative — trusting anyone who once logged in, from anywhere, forever — is how companies end up in the news.

Where access comes from — and where it goes

Remember the hire event from module 4? This is where it lands. Provisioning is the flow from HRIS to directory: a hire event creates your account and grants the access bundled with your role; a transfer swaps it; a leave event triggers deprovisioning, shutting everything off at once — which is precisely why the HRIS record has to be right. It’s also why day-one access is sometimes broken: the chain from HRIS to directory to each individual app has many links, and one slow sync anywhere leaves you locked out of exactly one thing on your first morning. Nobody forgot you; a link was slow.

Two more policies decode themselves once you see the machinery. Least privilege: you get the minimum access your role needs, which is why “just give me admin, it’s easier” is always refused — every extra permission is attack surface someone else has to defend. And access reviews: quarterly, managers certify what their people can touch, and access you never used gets removed. Losing a permission you’d forgotten you had isn’t punishment — it’s hygiene.

The reframe: every annoying prompt is the company making the stolen-password attack not work. When MFA pings you and you didn’t just log in, that’s the system catching someone else using your password — deny it and tell IT. The Security Essentials course covers what the attacker was trying; do one thing today and register a second MFA method, so a lost phone doesn’t become a lost workday.

Spot it: what’s the identity layer doing?

Why it matters

Identity is the layer where this course’s threads knot together: the HRIS hire event becomes an account, the account becomes access, the access becomes every “sign in with your company account” button you’ll click today — and the departure event unwinds it all in one motion. Read the prompts as protection rather than friction and you’ll make better calls with them, which is most of what Security Essentials asks of you anyway. Next module: APIs — how all these systems actually talk to each other, when they talk at all.