Key takeaways
- SSO controls how people log in. It does not set what they can see. Roles still live in each app.
- Of the 5 company pages read, 3 name a plan: HubSpot, Zoho CRM portals and Aurora. Aurora’s docs wording does not match its pricing page. Procore and Zuper name no plan.
- Zuper says SSO is "not enabled by default" and needs Support to switch it on.
- In an invented 25-user example, a 35 USD per user per month uplift costs 10,500 USD a year. The modelled offboarding benefit is 2,025 USD. Break-even is 6.75 USD per user per month.
- If password login stays on, the example model gives no benefit. Zuper’s page says leaving "Enforce SSO for all users" unchecked allows both.
To judge a company on SSO, start with the seven company questions. Then compare tools in the best solar CRM and best solar field service management software lists.
Single sign-on at a glance
SSO moves the login from each app to one identity provider (IdP), such as Google Workspace or Microsoft Entra ID. The apps ask the IdP who the person is.
| Item | Detail |
|---|---|
| What it gives | One login, MFA set once at the IdP, and one place to switch a person off. |
| What it does not give | Roles, price or cost hiding, or an audit log. See user roles and permissions and audit trail. |
| Protocols | SAML 2.0 and OpenID Connect for login. SCIM for creating and removing accounts. |
| Standard or rule | No solar standard. Each company decides which plan gets SSO. |
| In software | A setting in a CRM, design or project tool, often on a higher plan. See the table below. |
How does SSO work: SAML, OpenID Connect and SCIM?
SAML and OpenID Connect are two ways an app learns from the IdP who has signed in. SCIM is a third standard that handles accounts, not logins.
| Standard | What the primary page says | Page date |
|---|---|---|
| SAML 2.0 (OASIS) | The OASIS profiles document defines profiles for the use of SAML assertions and request-response messages. It includes a Web Browser SSO Profile. | OASIS Standard, 15 March 2005 |
| OpenID Connect (OpenID Foundation) | "OpenID Connect 1.0 is a simple identity layer on top of the OAuth 2.0 protocol." The result is an ID Token. | Core 1.0 with errata set 2, 15 December 2023 |
| SCIM (IETF RFC 7644) | An HTTP-based protocol for managing identity data across domains. "Clients request resource removal via DELETE." | Standards Track, September 2015 |
For an installer, the split matters in one place. SSO decides who may sign in right now. SCIM, where a company offers it, creates and removes the account itself. RFC 7644 says service providers "MAY choose not to permanently delete the resource", but must return 404 for later operations on it.
The HubSpot, Aurora, Zuper and Zoho pages read do not mention SCIM, so ask each company whether it supports it. If a company does not, someone may have to remove each account by hand.
Why does SSO matter for a solar company?
It gives you one place to add, change and remove staff, and one place to require MFA. This helps most when people leave or subcontractors come and go.
Zuper’s page says "disabling their IdP account immediately blocks access to Zuper" when someone leaves. It also says to "complete any multi-factor authentication your IdP requires" at sign-in. MFA is then set once, at the IdP.
SSO has limits. It blocks the login, not necessarily the bill. Some tools keep charging for a seat until the company removes it. See the seat trap on the user roles page. The pages read do not say whether API keys and phone sessions also end.
What is the SSO tax?
The SSO tax is the extra charge for turning SSO on. Companies usually put it on a higher plan. The site sso.tax describes itself as "A list of vendors that treat single sign-on as a luxury feature, not a core security requirement."
We do not copy its rows, and the pages read state no price gap. A plan-locked login also raises the cost of leaving. See company lock-in.
Worked example: does the SSO tier pay for itself?
This compares a yearly plan uplift with the expected cost of logins missed at offboarding. Every input is example. No source gives a miss rate or an incident cost.
| Example input | Value |
|---|---|
| Users | 25 |
| Staff who leave in a year | 24% (6 people) |
| Apps that hold a login for each person | 4 |
| SSO-tier uplift, all apps combined | 35 USD per user per month |
| Logins missed by hand at offboarding | 10% |
| Missed logins misused before they are found | 2% |
| Cost of one misuse incident | 40,000 USD |
| Time to remove one login by hand. Labour | 10 minutes. 35 USD an hour |
| SSO set-up | Enforced in all 4 apps, password login off |
On these inputs the expected benefit is far below the uplift.
| Result (example inputs) | Working | Value |
|---|---|---|
| Yearly uplift | 25 × 35 × 12 | 10,500 USD |
| Logins missed by hand a year | 6 × 4 × 10% | 2.4 |
| Expected misuse loss avoided | 2.4 × 2% × 40,000 | 1,920 USD |
| Admin time saved | (6 × 4 − 6 × 1) logins × 10 minutes = 3 hours × 35 | 105 USD |
| Expected benefit | 1,920 + 105 | 2,025 USD |
| Benefit minus uplift | 2,025 − 10,500 | minus 8,475 USD |
| Break-even uplift | 2,025 ÷ (25 × 12) | 6.75 USD per user per month |
| Break-even incident cost | (10,500 − 105) ÷ (2.4 × 2%) | 216,563 USD |
Figure 1. On example inputs, a 35 USD uplift costs 10,500 USD a year for 2,025 USD of benefit. Break-even rises from 6.75 to 16.35 USD if a misuse costs 100,000 USD.
The table shows the benefit minus uplift for other example uplifts and incident costs.
| Uplift (USD per user per month) | Incident 40,000 USD | Incident 100,000 USD | Incident 250,000 USD |
|---|---|---|---|
| 35 | minus 8,475 | minus 5,595 | 1,605 |
| 15 | minus 2,475 | 405 | 7,605 |
| 5 | 525 | 3,405 | 10,605 |
Headcount alone does not change the answer. Users, leavers and uplift all scale together. So the break-even uplift stays 6.75 USD at 10, 25 or 60 users. If password login stays on, the model counts no benefit, and the result is minus 10,500 USD.
A negative result does not mean you should skip SSO. The model leaves out seat fees that keep billing. It also skips the IdP cost, set-up time, and any customer or insurer requirement. It says only what offboarding risk alone can justify.
Check your own numbers
Enter your headcount, uplift and risk guesses. The calculator opens with the example above.
If the calculator does not load, open the SSO tier calculator on its own page.
How solar software handles single sign-on
Three of the five pages name a plan for SSO, and only Zuper says password login can stay on. HubSpot and Zoho are general CRMs. Procore is construction software. The table rates only what each company page says, read in October 2026. Partly means the page covers only part of the use, and Not stated means the page does not say.
| Software | SSO documented? | Protocol on the page |
|---|---|---|
| HubSpot | Yes | SAML 2.0 |
| Zoho CRM | Partly | SAML |
| Procore | Partly | Not stated in the page body. A related article title names SAML 2.0. |
| Aurora Solar | Yes | OpenID Connect. SAML not mentioned |
| Zuper | Yes | "Zuper uses the SAML 2.0 standard to communicate with your IdP". |
- HubSpot: Super Admin permissions are required to set it up. Plan wording: "Available with any of the following subscriptions, except where noted:" Each hub lists "Professional, Enterprise". Source: AD FS set-up article, last updated 20 May 2026.
- Zoho CRM: The page covers CRM portal users, not staff sign-in. Plan wording: "Editions: Enterprise and Ultimate". Bundles: CRMPlus and Zoho One. Source: Portal SAML SSO article, no date printed.
- Procore: "Procore provides limited support in the setup and configuration of SSO integrations." Plan wording: None stated. Procore Pay customers may need extra support to enable MFA for Payments. Source: SSO FAQ, no date in the body. Page metadata shows modified 2 December 2025.
- Aurora Solar: Set up through API calls. Users sign in at their IdP. Plan wording: "your Aurora tenant to be on a Business plan". Aurora’s pricing page lists Basic, Premium and Enterprise and files "Single sign on (SSO) support" under Enterprise capabilities, so ask which plan this means. Source: Developer docs, no date in the body. Metadata shows modified 8 September 2025.
- Zuper: Password login can stay on if "Enforce SSO for all users" is unchecked. Plan wording: No plan named. "SSO is not enabled by default." If the option is missing, contact Zuper Support to have it enabled. Source: Zuper docs SSO page and a care article, no dates.
Other companies may document SSO elsewhere. The five above are the pages read. Tools of these kinds are ranked in the best solar design software for EPCs list too. We have not checked which ranked pages name SSO support.
What should you ask a company about SSO?
Ask for the plan, the price gap and the offboarding steps in writing. Seven questions cover it.
- Which plan includes SSO, and what is the price difference per user, with any minimum seats?
- Is it SAML 2.0 or OpenID Connect, and which identity providers are supported?
- Who sets it up, and what support do you get? Procore says its support is limited.
- Can password login be switched off for everyone, including admins?
- Does the company support SCIM, or may someone have to remove each leaver by hand?
- When a login is blocked, do the seat, API keys and phone sessions also end? See API.
- Does the plan also give a sign-in log?
Common mistakes with single sign-on
FAQs
Is SSO the same as MFA?
No. SSO means one login at an IdP. MFA asks for a second proof, such as a code. With SSO, the IdP can ask for MFA once. Zuper’s page says users complete the MFA their IdP requires.
Which is better, SAML or OpenID Connect?
Use the one your company supports. HubSpot and Zuper document SAML 2.0. Aurora documents OpenID Connect only. Make sure your IdP speaks the same protocol before you buy.
Does a small installer need SSO?
SSO pays most when staff or subcontractors turn over, several tools hold logins, and password login can be switched off. In the example the offboarding risk alone justified only 6.75 USD per user per month. Weigh that against the IdP cost and any customer, lender or insurer rule that asks for SSO.
Is "Sign in with Google" the same as SSO?
Not necessarily. Zuper documents Google sign-in on a separate page from its SAML page. The Google page names no plan and no protocol. Ask whether it can be enforced and whether it blocks a leaver.
Related terms
- User roles and permissions: what each login can see and change.
- Per-seat pricing: a fee for each person with a login.
- Data security and SOC 2: assurance reports on a company’s controls.
Next step: before you pay an SSO uplift, send each shortlisted company the seven company questions and test a dummy leaver.
Sources
- OASIS: Profiles for SAML V2.0 (OASIS Standard, 15 March 2005, checked October 2026).
- OpenID Foundation: OpenID Connect Core 1.0 incorporating errata set 2 (15 December 2023, checked October 2026).
- IETF: RFC 7644, SCIM Protocol (September 2015, checked October 2026).
- sso.tax: The SSO Wall of Shame (no page date, checked October 2026).
- HubSpot: set up SSO using AD FS (last updated 20 May 2026, checked October 2026).
- Zoho CRM: configuring SAML-based SSO in CRM portals (no date printed, checked October 2026).
- Procore: how do I set up SSO (no date in the body, checked October 2026).
- Aurora Solar: configure single sign-on (no date in the body, checked October 2026).
- Zuper: single sign on, care article and login using Google (no dates printed, checked October 2026).
Last updated 30 October 2026. Next scheduled review: 30 January 2027.