Single sign-on
Single sign-on is an authentication experience that lets a user access multiple applications without repeating a full sign-in for each application.
What carries between applications
SSO describes the sign-in experience. In a federated arrangement, applications trust identity information from an identity provider instead of each checking the user’s password. Protocols such as OpenID Connect and SAML support this arrangement. Other approaches exist, including password-based SSO for applications without federation support.
The applications still have their own access rules. Reaching an application through SSO does not give the user every role, document, or administrative permission inside it. Additional authentication can also be required for a more sensitive action.
Troubleshooting access
When troubleshooting, first ask what failed: signing in, or doing something inside the application? Identify the application and identity provider involved. Ask the application owner which access rule controls that action.
During an incident, keep track of the identity-provider session and each application session separately. Do not assume that ending one session automatically ends all the others. Check how the application handles revocation, then test whether the affected access still works.