Book a demo
Single sign-on for web

Single sign-on for every web app, not just the ones that support SAML.

My1Login gives your workforce one sign-in for web, cloud and mobile apps: the one they already make to your corporate directory. Apps that support SAML or OpenID Connect connect directly, and apps that only take a username and password are signed in too, with the password filled in and hidden. IT sets the rules and sees every access.

Book a 5-minute demoSee pricing
What J. Morgan sees: Every app, already signed in.

Most single sign-on stops at the apps that support SAML.

Cloud single sign-on works well for modern apps. But the supplier portal, the finance tool with a username and password and the app that asks for a one-time code all fall outside it, so people keep typing passwords. My1Login covers both.

Typical cloud single sign-on

  • Covers apps that support SAML or OpenID Connect
  • People type passwords for everything else
  • One-time codes typed in by hand
  • A portal or sign-in page people have to learn
  • Audit covers single sign-on apps only
  • New apps stay unknown until someone reports them

My1Login single sign-on for web

  • Covers SAML, OpenID Connect and username-and-password apps
  • Passwords filled in, and hidden if you choose
  • One-time codes filled in automatically
  • Zero Login, and Zero UI if you want nothing new on screen
  • Every sign-in logged, across every app
  • New apps detected and brought under single sign-on in one click

Single sign-on from the first app to the last day.

Follow your web apps from the day My1Login connects to your directory to the day someone leaves. IT sets the rules at every step, and your workforce just finds itself signed in.

  1. 1ConnectedDirectory and Zero Login
  2. 2DiscoveredNew apps
  3. 3Signed inSAML, OIDC, passwords
  4. 4On the moveMobile app
  5. 5LoggedReports
  6. 6Access revokedOff-boarding
Step 1 · Connected

Signed in once, through your directory.

My1Login synchronizes user accounts with Active Directory or Microsoft Entra ID. With Zero Login, people are signed in to My1Login automatically as soon as they sign in to the directory, and from then on their apps open without another sign-in.

  • Zero UI, if you want it. My1Login can run entirely in the background, so there's no portal or new screen to learn.
  • Accounts follow the directory. People are added as they join and removed as they leave.
Step 2 · Discovered

New apps get noticed as soon as people use them.

My1Login detects the web apps your workforce signs in to and alerts IT, so you can decide what to do about each one. Turning on single sign-on for a new app takes one click in the shadow IT discovery panel, and My1Login learns each person's credentials the next time they sign in, so credential-based single sign-on works from then on.

  • Your choice of who adds apps. IT can choose the apps for everyone, let people add their own, or do both.
  • Shadow IT in view. Apps nobody told IT about show up with the number of people using them.
Step 3 · Signed in

Every kind of web app, signed in the same way.

Apps that support SAML or OpenID Connect connect directly. Apps that only accept a username and password get credential-based single sign-on: My1Login fills the details in so nobody types them, and IT can hide the password completely, which leaves nothing to phish.

  • One-time codes filled in too. Apps that ask for a code don't hold anyone up.
  • Several accounts per app. People pick the right identity from a list on the sign-in page, without typing a password.
Step 4 · On the move

Single sign-on on phones and tablets too.

Single sign-on for web includes the My1Login mobile app for iOS and Android, so people stop typing passwords on small screens.

  • Same apps, same rules. The policies IT sets apply on mobile as well.
  • Secure remote working. Granular access controls apply wherever people work.
Step 5 · Logged

Know which apps are used, and by whom.

Every sign-in is recorded with the person, the app and the time. Ready-made and custom reports help with compliance, audits and software asset management, including spotting licenses that aren't being used.

  • Ready for the auditor. Show who can reach which system, and who did.
  • Software asset management. See real usage before the next renewal.
Step 6 · Access revoked

When someone leaves, every sign-in leaves with them.

Disable a leaver in Microsoft Entra ID or Active Directory and My1Login stops signing them in to every connected app. Passwords they never saw are no use to them, and user provisioning can remove their app accounts too.

  • One switch, every app. No list of separate accounts to chase.
  • A clear record for the exit review. The audit trail shows every app they used.
Add-on

Windows desktop apps too? Add single sign-on for desktop.

The same sign-in, extended to applications that run as executables on Windows: legacy software, Remote Desktop programs, Citrix and mainframe emulators.

See single sign-on for desktop

Everything else your single sign-on should do.

Some of these come with every plan and some depend on the plan you choose.

  • Zero Login

    Signing in to your corporate directory signs your workforce in to My1Login automatically. There's no extra password to forget.

  • Zero UI

    Nothing for your workforce to learn. My1Login runs in the background, so there's no training and no rollout campaign.

  • SAML and OpenID Connect

    Modern cloud apps connect using the standards they already support.

  • Hidden passwords

    For password-only apps, IT can hide the password so it's filled in but never seen.

  • One-time codes filled in

    My1Login generates the authenticator codes apps ask for and enters them automatically.

  • Several accounts per app

    People with more than one identity for an app choose the right one on the sign-in page.

  • Password policies

    Set a password policy for each external app and My1Login enforces it. Enterprise password manager

  • Secure remote working

    Granular access controls keep sign-ins secure wherever people work.

Zero-knowledge encryption

We can't read your passwords. Nobody outside your organization can.

The keys that unlock your stored passwords are only available inside your organization's own network. What My1Login stores is encrypted and unreadable to anyone outside it, and that includes us.

Where the encryption keys are kept Your organization's network holds the encryption keys and your workforce's sign-ins. Only encrypted passwords travel to and are stored in the My1Login service, which has no keys and cannot read them. YOUR ORGANIZATION'S NETWORK Encryption keys Only ever here Your workforce Signed in to their apps encrypted MY1LOGIN SERVICE Encrypted passwords No keys here, so nobody at My1Login can read them

Independently recognized

  • KuppingerCole Leadership Compass 2025My1Login featured in the Privileged Access Management report
  • SC Awards Europe 2025, winnerBest Identity and Access Management Solution
  • Cyber Essentials PlusCertified. Penetration tested by CREST-approved testers: rated A+ and suitable for use in defense
Trust centerSecurity overview (PDF)

Part of one platform, with one policy and one log.

Single sign-on shares its directory connection, policies and audit trail with the rest of My1Login.

Choosing single sign-on

Single sign-on questions

What is single sign-on?

Single sign-on (SSO) lets people sign in once and then open their work apps without signing in again. With My1Login, that one sign-in is the one they already make to your corporate directory.

Does it work with apps that don't support SAML?

Yes. Apps that support SAML or OpenID Connect connect directly. Apps that only accept a username and password get credential-based single sign-on, with the password filled in and, if you choose, hidden.

Do people have to sign in to My1Login?

No. With Zero Login, signing in to Active Directory or Microsoft Entra ID signs them in to My1Login automatically.

Does it replace Microsoft Entra ID?

No. My1Login works alongside Microsoft Entra ID. Entra ID remains your directory: people sign in to it as normal and Zero Login signs them in to My1Login. My1Login then extends single sign-on to the apps Entra ID can't reach, such as password-only web apps, apps that ask for one-time codes and Windows desktop apps. It can also handle your SAML and OpenID Connect apps itself, so every app can sit under one set of policies and one audit trail.

Does it work on mobile?

Yes. Single sign-on for web includes the My1Login mobile app for iOS and Android.

What about Windows desktop apps?

They're covered by single sign-on for desktop, an add-on to single sign-on for web. See single sign-on for desktop

Who decides which apps are covered?

You do. IT can choose the apps that are covered for everyone, let people add their own apps and logins, or combine the two. For example, IT can set up the core business apps while people add the other work apps they use.

What does the adoption guarantee cover?

Adoption is guaranteed wherever the zero-login configuration has been deployed. Every provisioned user who signs in to your corporate directory, such as Microsoft Entra ID or Active Directory, during the contract term counts as adopted. Signing in to the directory signs them in to My1Login automatically, so your workforce doesn't have to enroll in or open My1Login.

How much does it cost?

Our pricing page has current prices and plans. See pricing

Bring your most awkward web app to a 5-minute demo.

We'll connect a SAML app and a password-only app side by side, then show you what your workforce sees: both, already signed in.

  • 5 minutes, on your own apps
  • A specialist replies within one working day
  • No obligation
Book a 5-minute demoStart a 14-day free trialThe full product, on your own apps.
Book a 5-minute demoFree trial