Short Definition
Single sign-on (SSO) allows users to access multiple connected applications using one centrally managed digital identity. Multi-factor authentication (MFA) requires at least two different authentication factors. The two methods can be combined but perform different functions.
SSO and MFA at a Glance
- SSO centralises access to connected applications through an identity provider.
- MFA requires authentication factors from at least two different categories.
- An identity provider can perform the MFA check centrally.
- Roles and permissions determine which sites, data and functions users can access after authentication.
How Do SSO and MFA Work?
With SSO, an identity provider (IdP) verifies the user’s digital identity. Examples of identity providers include Microsoft Entra ID and Okta. The target application trusts the secured identity confirmation provided by the IdP and therefore does not need to manage the login credentials itself.
Protocols such as SAML 2.0 and OpenID Connect are commonly used to exchange identity information. The application typically receives a signed assertion or token. Depending on the protocol and configuration, this information may include the user’s identity, selected user attributes and details about the authentication method.
A typical login process begins when a user opens the energy platform. The platform redirects the authentication request to the IdP. After verifying the user, the IdP provides a secured identity confirmation that allows the platform to establish an authenticated session.
MFA combines factors from different categories:
- Knowledge: for example, a password or PIN
- Possession: for example, a registered smartphone with an authenticator app, a hardware token or a security key
- Biometric characteristic: for example, a fingerprint or facial recognition, typically used with a registered device
Two passwords, or a password combined with a PIN, do not constitute MFA because both factors are based on knowledge. Phishing-resistant authentication based on FIDO2 or WebAuthn, including security keys and passkeys, can provide stronger protection than password- or one-time-password-based methods. Depending on the implementation, passkeys can also enable passwordless authentication and should not automatically be treated as a conventional second factor.
SSO and MFA can be used together or independently. In a combined architecture, the IdP can perform the MFA check centrally and then provide the connected applications with a secured identity confirmation. This confirmation may include information about the authentication method used.
Typical Applications in Energy Platforms
SSO is particularly relevant for energy platforms used by multiple users, sites or organisations. Operators can centrally create or revoke access, while service providers and asset managers can use their existing corporate identities.
MFA becomes especially important when users can do more than view measurement data. This includes configuring alarms, changing operating parameters or remotely controlling energy assets. The greater the potential impact of unauthorised access, the stronger the authentication method should be.
Benefits, Limitations and Technical Requirements
SSO can reduce administrative effort and simplify the removal of access when users leave an organisation. MFA reduces the risk that a stolen or guessed password alone will provide access to the platform.
However, a central identity provider also creates a critical dependency. If the IdP is unavailable or incorrectly configured, users may be unable to access several connected applications at the same time. Availability, session duration, logging, recovery procedures and controlled emergency access must therefore be considered.
Authentication and authorisation must be treated separately. Authentication verifies the identity of a user. Roles and permissions then determine which tenants, sites, data and functions that user can access. Shared user accounts should be avoided because changes and control commands cannot otherwise be reliably attributed to an individual.
For SSO integration, the identity provider and the energy platform must support a compatible authentication protocol. Clear user mappings, suitable role models and defined rules for sessions, account deactivation and emergency access are also required.
User Access in the EcoPhi Monitoring & Control Cloud
The EcoPhi Monitoring & Control Cloud supports role-based access control and the separate management of users, systems and tenants. Access can therefore be restricted to the energy assets and information relevant to each user.
Whether SSO or MFA is available for a specific platform package should be assessed for the individual project. Relevant factors include the required identity provider, supported authentication protocols, user structure and applicable security policies. SSO and MFA should therefore not be presented as general standard features without prior technical confirmation.
Importance for Secure Platform Operation
SSO and MFA can improve the management and security of user access. For energy platforms, however, a robust access concept also requires individual user accounts, appropriate permissions, traceable logging and defined operational and recovery procedures.
Frequently Asked Questions About SSO and MFA
Can MFA Be Used Without SSO?
Yes. An application can require MFA for its own user accounts without being connected to a central identity provider.
What Happens If the Identity Provider Is Unavailable?
New SSO logins may be temporarily unavailable. Depending on the session configuration, users who are already logged in may be able to continue working. Critical applications should have defined emergency access and recovery procedures.
Does MFA Replace Role-Based Access Control?
No. MFA strengthens the verification of a user’s identity. Role-based access control determines which data, sites and functions that user may access after authentication.
Are Passkeys Automatically a Form of MFA?
Not necessarily. Passkeys can enable passwordless and phishing-resistant authentication. Whether multiple factors are involved depends on the implementation and how the passkey is activated.