One login for every app
A growing company collects logins fast. Each new tool gets its own password, leavers keep access to apps nobody remembered to check, and an audit question like "who can get into the finance system?" takes a day to answer. An identity platform puts every app behind one company login, so access is granted in one place and removed in one place.
Choosing the identity provider
We set up Okta, JumpCloud, Microsoft Entra ID and Google as identity providers, and the right one depends on what you already run:
Google Workspace with a modest app list. Google as the identity provider is often enough.
Mac-first with many SaaS tools. Okta or JumpCloud give the most flexibility with apps and devices.
Heavy Microsoft use. Entra ID is usually the sensible choice, and works well with Macs when set up properly.
We compared the four for Mac-first teams in Okta vs Entra ID vs Google vs JumpCloud.
What we set up
Single sign-on. Slack, Notion, Figma, Adobe, GitHub, your CRM and finance tools, and anything else that supports SAML or OIDC, all behind the company login.
Automatic accounts. Where apps support SCIM, new starters get the right apps for their role on their first day, and leavers lose access when their account is switched off. Our offboarding checklist shows what that covers.
MFA everywhere. Phishing-resistant methods such as passkeys and Okta FastPass where possible, with rules that ask for more checks when something looks unusual and fewer when someone is on a managed Mac.
Platform SSO on Macs. People sign in to their Mac with their company account, and the same login unlocks their apps. It also means a password change or a disabled account reaches the Mac straight away. More in our Platform SSO guide.
One directory. If accounts are spread across Google, an old Azure AD tenant and a forgotten LDAP server, we bring them together into one source of truth with consistent groups.
How it works
Weeks 1 to 2: Audit and design. We list every app, who uses it and how they sign in, and agree the groups and rules that decide who gets what.
Weeks 3 to 5: Connect apps. Apps are moved behind single sign-on in batches, starting with the ones that hold the most sensitive data. Each batch is tested with a small group first.
Weeks 5 to 6: Roll out. MFA enrolment and Platform SSO for everyone, with short sessions and help on hand for the first days.
Afterwards. New apps added on request, access reviews when you need them, and starters and leavers handled through the helpdesk.
Why Stabilise
Identity and device management are one job for a Mac-first company, and we do both, so the login on the Mac, the apps behind it and the device itself all follow the same account. Our phishing-resistant MFA case study shows one of these rollouts from start to finish, and the Okta rollout page covers Okta in more depth.
Frequently Asked Questions
Will people have to sign in more often? Usually less. One sign-in on a managed Mac covers most apps for the day.
What about apps that do not support SSO? Their logins go into the company password manager, with a note to move them across if the vendor adds SSO later.
Can we do this without moving off Google Workspace or Microsoft 365? Yes. The identity provider sits alongside your email and files, and may be the platform you already pay for.
How long does it take? Around six weeks for most teams. The number of apps sets the pace.
