Enterprise Single Sign-On

Sign in with the directory you already run

Every separate login is a security liability

When a vendor issues its own usernames and passwords, your organization inherits a user directory it doesn't control. Nobody wants it, but everybody has one - usually several.

The costs are predictable. Passwords get reused. Multi-factor policy stops at the boundary of your own systems. And the one that matters most in an audit: when someone leaves, their account in your directory is disabled the same day, while their account at the vendor keeps working until someone remembers to file a ticket.

Single sign-on removes the separate account entirely. There is no second password to rotate, no second MFA policy to configure, and no second list to reconcile at review time.

Built on SAML 2.0 and OpenID Connect

EqualWeb acts as a service provider against your identity provider directly - no intermediary broker sitting between your directory and your users.

Because both are open standards rather than a bespoke integration, this works with Microsoft Entra ID, Okta, Ping Identity, Google Workspace or any other standards-compliant provider. Organizations that would rather not run SSO at all can continue to use ordinary accounts - enabling it is a choice, not a migration.

Your users never leave your domain

This is the part most single sign-on integrations don't offer. A connection can be served on your organization's own hostname, so the entire experience - the sign-in, the platform, the address in the browser bar - belongs to you.

For public-sector bodies and regulated institutions, that isn't cosmetic. Redirecting citizens or staff to an unfamiliar commercial domain to reach official documents is a real objection in a procurement review, and often a real accessibility and trust problem for the people using it. Keeping the session on your own hostname removes the objection entirely.

Multiple hostnames can be registered against a single connection - a staging domain alongside a production one, for instance - with each one explicitly allow-listed so that a login started on a given host also finishes there.

Control stays where your policy already lives

• One set of credentialsYour users sign in with the account they already have. There is no additional password to issue, reset or audit.
• Your MFA and conditional access applyWhatever your directory enforces - hardware keys, device compliance, network conditions - governs access here too, because authentication happens at your provider.
• Revocation takes effect at the sourceDisable an account in your directory and new sign-ins stop immediately. No vendor ticket, no lag between your offboarding process and ours.
• Optional single logoutWhere your provider supports it, signing out can be propagated back to the identity provider rather than ending only the local session.
• Group and role mappingAttributes from your directory travel with the assertion, so the permissions someone gets are driven by their position in your organization.

A short conversation between two administrators

Configuration is handled by EqualWeb rather than left to you as a self-service form, because the values involved include signing certificates and client secrets. In practice your identity administrator supplies five things.

1. The sign-on URL your provider issues for the application
2. The token-signing certificate we verify assertions against
3. The hostnames your users will reach the platform on
4. An optional sign-out URL, if you want single logout
5. The attributes you want mapped to roles

On your side, EqualWeb is registered as an enterprise application with our entity identifier and reply URLs. Nothing needs to be installed, and no inbound access to your network is required.

Fewer accounts is a security improvement: connecting your identity provider takes one exchange between administrators and removes a standing account from your estate permanently. If your organization already runs a directory, there is very little reason to keep a separate login alive beside it.

Enterprise SSO connection is included in every accessibility audit package, and sits inside the same ISO/IEC 27001-certified program described on our Security & Privacy page.

Last updated 16 August 2026. Reviewed by the EqualWeb accessibility team.