Four ways to arrange identity and access compared: local accounts, a password manager, SSO, and provisioning

Before comparing two identity products, compare the four ways of arranging identity. That choice sets what any product is worth to you.

A business running local accounts in fifteen applications faces a different problem from one running everything behind a single sign-in. The second is not simply a better version of the first.

Four arrangements, compared on what they cost to run, what they fix, what they leave open, and what it costs to leave them.

What to take away

The four arrangements

Two things stand out when you set the arrangements beside each other, and the password manager column is worth having in every other column too. Systems that refuse to join a directory do not disappear when you buy one.

The third jump changes the most. It is the first arrangement with a single place to enforce and a single place to disable.

Authentication and authorisation are not the same purchase

This is the most common and most expensive confusion in the category.

Authentication answers whether this is the right person. Authorisation answers what that person may do once they are in. The United States National Institute of Standards and Technology's digital identity guidelines cover only the first of the two, which is a fair demonstration of how separate they are even in the standards.

Single sign-on buys you the first across many applications and almost nothing of the second. The role inside your accounting package, the approver flag in your payment tool, and the export permission in your customer system all still live inside those applications.

On a leaving day, disabling the central account stops sign-in.

It does not remove them as an approver, and it does not tell you they were one.

So whichever arrangement you choose, keep a list of permissions that live inside applications. Read it during the reviews described in identity and access reviews.

Where to put the blast radius

Every argument for centralising is also an argument about concentration. One account to protect well, and one account whose compromise reaches everything.

The reasonable position is not to avoid centralising, it is to decide deliberately what stays outside. Two things generally should.

Your domain registrar and DNS, because whoever controls the domain controls your mail, and therefore controls the recovery route into everything else. If that account sits behind the same sign-in as everything else, a single compromise takes both the business and the means of recovering it.

Your banking access, for the same reason in the other direction, and because banks frequently have their own authentication that does not integrate anyway.

Keep both on separate credentials with their own strong factors and their own recovery contacts, and make that an explicit written decision rather than an accident of what would not integrate. The emergency access reasoning is in identity and access.

Comparing the operating cost honestly

License cost is the smallest term in this comparison. Three others dominate.

Setup per application. Every application connected to a central sign-in is a small project with its own configuration and its own owner to persuade. Count the applications you will actually connect, not the ones the vendor lists.

Ongoing administration. Someone reviews grants, fixes broken syncs, and answers requests. Estimate it in hours per month, by name. This line reverses more comparisons than any feature.

The cost of leaving. Rarely considered on entry and always paid on exit. It is essentially the migration described in identity and access migration, and the arrangements differ enormously here: a password manager exports in an afternoon, a fully provisioned directory does not.

Add the cost of the applications that will never join, because that residue is what you still pay in manual effort forever.

How to run the comparison

Score the arrangements against one written scenario rather than in the abstract. A good one: your longest-serving employee, who has changed roles twice and holds administrator rights in two applications, resigns on a Friday afternoon and their last day is Monday.

The differences between the four become concrete right away. Often, the gap between arrangements two and three is smaller than expected, while the gap between three and four is larger.

Then check the answer against the operating reality: whoever will run this, and how many hours they have. The general method for approach comparisons is in security foundations comparison.

Common questions

Is single sign-on more secure or less?

Both, in different places. This concentrates risk in one account and makes that account easier to protect properly, enforce strong factors on, log, and disable. For most small businesses, the trade is worth it if the central account gets your strongest factor and the registrar and bank stay outside.

Which factors are strongest, and why they are not interchangeable, is on the United States Cybersecurity and Infrastructure Security Agency's multi-factor authentication pages.

Can we mix arrangements?

Almost everyone does, and it is the sensible outcome rather than a compromise. Central sign-on for what supports it, a shared vault for what does not, and separate credentials for the two accounts you deliberately keep outside. Write down which is which, and the options are set out in identity and access alternatives.

How do we compare two products once the arrangement is settled?

By the questions they can answer about your own environment and the time they take to answer them, which is a shorter and more honest evaluation than a feature matrix. The tests are in best identity and access software 2027.

What triggers moving up an arrangement?

Three signals, any one of which is enough. You cannot answer who has access to a named system without asking around. A leaver process took more than a day. Or somebody has started sharing a login because the proper route was slower than the workaround.