SSO Tax
The SSO tax is the practice of offering single sign-on (SAML or OIDC) only on a higher-priced plan, an enterprise plan or a paid add-on, so that a customer must pay more to connect an app to its identity provider. The term was popularized by the SSO Wall of Shame, a community list of vendors that treat SSO "as a luxury feature, not a core security requirement".
It matters because SSO is where most security controls for a SaaS app actually live: MFA strength, conditional access, and removal of access when someone leaves. In SWI's Phishing-Resistant MFA Support Matrix 2026, 49 of the 82 business SaaS apps that offer SSO and document which plan includes it (59.8%) charge more for it: 23 on a higher paid tier, 20 on an enterprise plan only and 6 as an add-on. For two in three apps that cannot require phishing-resistant MFA on their own login, the SSO tax is therefore the price of phishing-resistant sign-in. The per-app data is in the MFA matrix tool, and the TCO calculator puts the cost next to the rest of the identity budget.
See also: The SSO tax explained, SSO, SSO enforcement, local login bypass, phishable MFA, SAML 2.0, implementing SSO
Related on Start with Identity
- GlossaryAuthentication Policy
An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on condi
- GlossaryIdentity as a Service (IDaaS)
Identity as a Service (IDaaS) is identity and access management delivered from the cloud as a subscription: the provider runs the directory, single sign-on, MFA
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-
- CVEFortiWeb FortiCloud SSO SAML bypass
The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or d