# sso-tax

Source: https://startwithidentity.com/glossary/sso-tax/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

The SSO tax is the practice of offering single sign-on (SAML or OIDC) only on a higher-priced plan, an enterprise plan or a paid add-on, so that a customer must pay more to connect an app to its identity provider. The term was popularized by the [SSO Wall of Shame](https://sso.tax/), a community list of vendors that treat SSO "as a luxury feature, not a core security requirement".

It matters because SSO is where most security controls for a SaaS app actually live: MFA strength, conditional access, and removal of access when someone leaves. In SWI's [Phishing-Resistant MFA Support Matrix 2026](https://startwithidentity.com/reports/phishing-resistant-mfa-matrix-2026/), 49 of the 82 business SaaS apps that offer SSO and document which plan includes it (59.8%) charge more for it: 23 on a higher paid tier, 20 on an enterprise plan only and 6 as an add-on. For two in three apps that cannot require phishing-resistant MFA on their own login, the SSO tax is therefore the price of phishing-resistant sign-in. The per-app data is in the [MFA matrix tool](https://startwithidentity.com/tools/mfa-matrix/), and the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/) puts the cost next to the rest of the identity budget.

See also: [The SSO tax explained](https://startwithidentity.com/articles/sso-tax-explained/), [SSO](https://startwithidentity.com/glossary/sso/), [SSO enforcement](https://startwithidentity.com/glossary/sso-enforcement/), [local login bypass](https://startwithidentity.com/glossary/local-login-bypass/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [SAML 2.0](https://startwithidentity.com/standards/saml-2-0/), [implementing SSO](https://startwithidentity.com/guides/authentication/complete-guide-implementing-sso/)