SSO tax
The SSO tax, and what it costs beyond the invoice.
The SSO tax is the practice of gating single sign-on behind a more expensive plan, so a customer pays a premium to get a basic security control.
What it is
A vendor offers the product on a standard plan and SAML or OIDC single sign-on only on an enterprise plan, often at several times the price. Customers who want their identity provider to govern access pay the difference or go without.
The cost that is not on the invoice
Every app without SSO is an app with its own passwords. Those passwords are shared, forgotten, and rarely rotated. When someone leaves, their access lingers because no directory event reaches the app. The SSO tax is paid twice: once to the vendor, and again in the security debt of every app where you chose not to pay it.
What SSO does not solve even when you pay
Single sign-on answers who can log in. It does not create the account, set the role, or remove the account when the person leaves. That is provisioning, and it needs SCIM or an API, which is usually a separate tax.
What StitchOps does about it
Run it anyway.
For the apps where you did not pay, StitchOps gives the directory a way to act anyway. When Okta, Entra ID, or JumpCloud disables a user, a workflow removes them from the app through its own interface. Shared passwords move into your vault and rotate on a schedule. The app stays on the standard plan; the access still follows the directory.
How StitchOps executes →Asked directly.
Should we just pay the SSO tax?
For the apps that hold sensitive data and offer SSO, usually yes. For the long tail that does not offer it at any price, or where the premium is out of proportion, StitchOps lets the directory govern access without SSO.
Does StitchOps replace SSO?
No. SSO handles sign-in. StitchOps handles what happens in the app around sign-in: creating, changing, and removing access, and rotating the shared credentials that exist because SSO is not there.
Can StitchOps rotate the shared passwords in apps without SSO?
Yes. A workflow rotates the password in the portal and updates 1Password, Keeper, or the StitchOps vault in the same run. The model never sees the value.
Start with one workflow that never had an API.
Fifteen minutes on your top three manual processes. We tell you which one to run first.