Enterprise application single sign-on: SAML (Identifier, Reply URL, signing certificate) and OpenID Connect

Single sign-on (SSO) lets users sign in once with their Microsoft Entra account and reach many apps without separate passwords. For software as a service (SaaS) apps, you typically add the app from the Microsoft Entra application gallery, which creates an enterprise application, and then configure SSO. The two main federated protocols are SAML 2.0 and OpenID Connect (OIDC); other options include password-based SSO, where Entra securely stores and replays credentials, and linked SSO, which just adds a tile pointing to another identity provider.