For a small company, the best SSO and MFA option is usually the one already inside your email suite: Google Workspace or Microsoft Entra. Add a dedicated provider such as Okta, JumpCloud or Duo when you need more apps, device checks or audit controls. Prices below are as of 19 October 2026.
Safeguard publishes this guide and sells a competing product, so we describe other tools only from their own documentation.
Key takeaways
- Turn on MFA everywhere first. A basic SSO setup with security keys beats an advanced tool nobody enforces.
- Use the suite you already pay for before adding another vendor.
- Watch the minimums: Okta lists a $1,500 annual contract minimum, and Duo Free stops at 10 users.
- Avoid SMS codes where you can. Google's own admin guidance advises against text messages.
What is SSO and why does MFA matter with it?
Single sign-on (SSO) lets people sign in once to a central identity provider and reach many apps. MFA adds a second proof, so a stolen password alone is not enough.
Together they give you one place to enforce rules and one place to turn off a leaver. That second point matters for offboarding.
Which SSO and MFA options fit a small company?
Compare them by price, what is included, and the limits. The table uses each vendor's pricing or documentation page as of 19 October 2026.
| Option | SSO and MFA | Price as stated | Limits and notes |
|---|---|---|---|
| Google Workspace 2-Step Verification | Second step can be security keys, Google prompt, authenticator app codes, backup codes or text and calls | Part of Workspace; plan prices not checked | Passkeys are available only if an admin enables skipping the password; Google advises against text messages |
| Microsoft Entra ID Free | Unlimited SSO across SaaS apps; MFA supported | Included with Microsoft cloud subscriptions such as Azure and Microsoft 365 | P1 is $7.00 per user per month and P2 $10.00, billed yearly; we could not confirm the exact feature split from the page text |
| Okta Workforce Identity | Starter includes SSO and MFA | Starter $6, Core Essentials $14, Essentials $17 per user per month; billed annually | $1,500 annual contract minimum; Adaptive MFA is an add-on on Starter |
| JumpCloud | SSO package includes SSO and MFA | SSO package $11 per user per month annual ($13 monthly); a la carte SSO $3 and MFA $3 annual | 30-day free trial; Platform Essentials limited to 300 users |
| Duo | Free: MFA for up to 10 users; Essentials adds phishing-resistant MFA, passwordless and SSO | Free $0; Essentials $3, Advantage $6, Premier $9 per user per month | Self-service licenses in increments of 10 under 100 users; SSO not listed on Free |
What should I use if I already have Google Workspace or Microsoft 365?
Use their built-in controls first. Google Workspace lets admins require 2-Step Verification and recommends requiring it for admins and for anyone who handles sensitive data. Entra ID Free offers unlimited SSO across SaaS apps.
This keeps your cost at zero extra seats and your admin work in one console. Move to a dedicated provider when you hit a real gap, such as many apps without SAML support, device trust rules or approval workflows.
Which MFA method should I pick?
Pick security keys or passkeys where you can, an authenticator app next, and SMS only as a last resort. NIST SP 800-63B-4 says phishing resistance requires cryptographic authentication, cites WebAuthn and FIDO2 as an example, and says manually entered codes do not qualify.
Google's admin help calls security keys the strongest second step. See our post on passkeys vs passwords for a business for the trade-offs.
How do I roll out SSO and MFA without chaos?
Roll out in four steps over a few weeks.
- Enforce MFA for admins today. Google is enforcing 2-Step Verification for administrator accounts, so this is also where you meet the platform halfway.
- Move the apps that hold customer data behind SSO first: code hosting, cloud console, CRM, support desk.
- Issue two security keys per admin so a lost key is not a lockout.
- Remove local passwords from SSO apps where the app allows it, and list the apps that cannot join SSO.
How do I choose?
Use this checklist.
- Do you already pay for Google Workspace or Microsoft 365? Start there.
- How many users will you have in 12 months? Check minimums and user caps.
- Which apps lack SAML or OIDC? Some vendors charge extra for SSO, so list them.
- Do you need device checks or conditional rules? That pushes you to a paid tier.
- Do auditors need evidence? Ask whether the tool exports access lists and MFA status.
- Can you enforce phishing-resistant MFA for admins today?
Frequently asked questions
Is SSO enough without MFA?
No. SSO centralizes sign-in, so one stolen password could open every app. Pair it with MFA, ideally phishing-resistant methods.
Is there a free SSO and MFA option?
Entra ID Free lists unlimited SSO across SaaS apps, and Duo Free covers MFA for up to 10 users. Check each vendor's current limits before relying on them.
Are authenticator apps good enough?
They are better than text messages, but NIST says manually entered codes are not phishing resistant. Use security keys or passkeys for admins and high-risk roles.
What is the SSO tax?
It describes vendors that charge more to support SAML or SSO than the base plan. Ask each app vendor which tier includes SSO before you commit.
When should a small company move to a dedicated identity provider?
When apps outgrow your suite's SSO, when you need device trust or automated user lifecycle, or when auditors want better evidence.
Sources
- Google Workspace: protect your business with 2-Step Verification
- Microsoft Entra pricing
- Okta pricing
- JumpCloud pricing
- Duo pricing
- NIST SP 800-63B-4
Last reviewed: 19 October 2026.
