# What is single sign-on?

Single sign-on (SSO) lets people sign in to many applications with one account at their company's identity provider.

**Runtime includes single sign-on over SAML or OIDC, and SCIM directory sync,
free on every account.** Your directory adds people, gives them roles through
groups, and removes them the moment they leave, and an owner can require single
sign-on for everyone whose email is on your domain
([single sign-on](/docs/single-sign-on)).

## How it works

The application trusts the identity provider instead of keeping passwords. At
sign-in it sends the person to the provider, which checks them, applies its own
rules such as multi-factor authentication, and sends back a signed statement of
who they are. Two standards carry that statement:

| Standard | What it is                                                                                    | Since |
| -------- | --------------------------------------------------------------------------------------------- | ----- |
| SAML 2.0 | "An XML-based framework for describing and exchanging security information", in OASIS's words | 2005  |
| OIDC     | "A simple identity layer on top of the OAuth 2.0 protocol", returning a signed JSON ID Token  | 2014  |

Sign-in is half the job. The other half is leaving: SCIM lets the directory
create, update and deactivate accounts in the application automatically, so a
person who leaves the company loses access everywhere at once.

## Why it matters for a cloud account

A cloud account holds keys that spend money and reach data. With SSO, access
follows the company's directory rather than a list of personal passwords, and
an audit can answer who had access on a given day. Many providers sell SSO only
on an enterprise plan; Runtime does not charge for it.

## On Runtime

- Okta, Microsoft Entra ID and Google Workspace are supported from day one, and
  any SAML 2.0 or OpenID Connect provider works the same way.
- You prove your email domain with a DNS record before SSO applies to it.
- Directory groups map to Runtime roles, and SCIM keeps them current
  ([directory sync](/docs/single-sign-on#directory-sync-scim)).
- Agents keep their own keys: connecting one is still a single browser approval.

## Related

- [How to set up single sign-on](/how-to/set-up-single-sign-on)
- [What is workload identity?](/glossary/workload-identity)
- [Least-privilege API keys](/glossary/least-privilege-api-keys)
- [What is a spending limit?](/glossary/spending-limit)

## Sources

Checked 27 September 2026.

- [SAML V2.0 Technical Overview, OASIS](https://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0.html)
- [OpenID Connect Core 1.0](https://openid.net/specs/openid-connect-core-1_0.html)
- [Runtime single sign-on and directory sync](/docs/single-sign-on)