The password reset treadmill
Most IT teams track password reset tickets as a cost of doing business. They should not. The visible cost (help desk time) is the smallest part of the problem. The real costs are hidden in productivity loss, security degradation, and user frustration that builds over time.
This post examines the true cost of password sprawl and how single sign-on (SSO) changes the equation for both security and operations.
Counting the real costs
Direct costs: Industry estimates put the average password reset at $70 in help desk labor when you factor in ticket creation, verification, reset execution, and user communication. For a thousand-employee company with quarterly password expiration and two resets per employee per year, that is $140,000 annually in direct IT costs alone.
Productivity costs: The average employee spends 11 hours per year dealing with password issues. At an average loaded cost of $50 per hour, that is $550 per employee per year in lost productivity. For the same thousand-employee company, that is $550,000 in productivity loss.
Security costs: When users struggle with passwords, they compensate in predictable ways: writing them down, reusing them across systems, choosing simple patterns. Each workaround reduces your security posture. Password reset fatigue also drives users toward personal password managers that may not meet corporate security standards.
Morale costs: Few things erode trust in IT like constant authentication friction. Users who fight your security controls daily are less likely to cooperate when real security issues arise.
How SSO changes the math
Single sign-on replaces dozens of password relationships with one trusted identity provider. The benefits compound across multiple dimensions.
Reduced help desk burden: With SSO, users remember one strong password. Most organizations see password-related tickets drop by 70-90% after SSO implementation. That thousand-employee company saves roughly $100,000 in direct IT costs.
Improved productivity: Users access applications without interruption. The 11 hours of annual password friction drops to near zero for SSO-connected applications.
Stronger security: Centralized authentication enables stronger controls: multi-factor authentication becomes practical to mandate, session management becomes consistent, and credential stuffing attacks against individual applications become ineffective.
Better visibility: When authentication flows through a single point, you gain visibility into access patterns, failed login attempts, and unusual behavior that would be scattered across dozens of siloed systems.
The SSO implementation checklist
Moving to SSO requires planning. Use this checklist to guide your rollout:
- Inventory all applications and identify authentication methods
- Prioritize applications by user count and sensitivity
- Select an identity provider appropriate to your size and complexity
- Plan for applications that cannot use SAML or OIDC (legacy, vendor limitations)
- Design your identity lifecycle: provisioning, role changes, deprovisioning
- Establish MFA requirements by application risk level
- Create user communication explaining the change and benefits
- Plan a phased rollout starting with low-risk applications
- Monitor adoption and address integration issues quickly
- Document exceptions and plan for ongoing identity governance
Handling the edge cases
Not every application supports modern authentication standards. Common patterns for dealing with exceptions include:
Password vaulting: Store legacy credentials in an enterprise password manager and inject them automatically. Users get SSO-like experience even for older applications.
Reverse proxy: Place legacy applications behind an SSO-enabled proxy that handles authentication before passing traffic through.
Federation bridges: Use tools that translate between modern protocols (SAML, OIDC) and legacy protocols (LDAP, RADIUS, Kerberos).
Accepting friction for risk: Some applications may remain outside SSO due to air-gapping requirements, vendor restrictions, or regulatory constraints. Document these exceptions and apply compensating controls.
Security considerations
SSO creates a single point of failure that must be protected accordingly:
MFA is mandatory: The identity provider must require multi-factor authentication. A compromised SSO account should not automatically grant access to everything.
Session management matters: Long-lived sessions reduce friction but increase risk. Balance user experience with security through appropriate session timeouts and step-up authentication for sensitive operations.
Monitor the identity provider: Your identity provider becomes your most critical security infrastructure. Monitor it closely for anomalies and have incident response plans specific to identity compromise.
Plan for outages: When SSO is down, work stops. Have offline authentication options for critical systems and clear communication plans for identity provider outages.
The bottom line
Password sprawl is expensive in ways that rarely appear on balance sheets. SSO is not just a convenience feature. It is a security control that happens to make users more productive. The organizations that thrive are those that recognize security and usability are not competing priorities. They are the same goal approached from different directions.
Disclaimer: This post is for educational and informational purposes only and does not constitute legal, compliance, or professional security advice.