Skip to main content

Pro audit program · v1.0

SSO Health Check

Single sign-on is only as strong as the apps it covers and the policies behind it. Quick check on coverage, MFA, conditional access and session controls.

  • General target area
  • NIST CSF framework
  • 6 controls in this program
  • Cyentrix Cyentrix Trusted Author
Sign in to run → Back to library

About this program

Single sign-on is only as strong as the apps it covers and the policies behind it. Quick check on coverage, MFA, conditional access and session controls.

Risks addressed

  • High Tier-1 apps not behind SSO u2014 separate password leakage
  • High IdP outage causes business-wide lockout
  • High No conditional access u2014 risky sign-ins not challenged

Controls (6)

  1. SSO coverage on Tier-1 SaaS

    High

    This control requires that all Tier-1 SaaS applications (critical business systems such as email, collaboration platforms, CRM, HR systems, and financial software) enforce Single Sign-On (SSO) authentication through a centralized identity provider (IdP). SSO consolidates authentication to a single, hardened…

    How to test + evidence

    Testing procedure: List Tier-1 SaaS; verify SSO enforced on each.

    Evidence to collect: SSO config screenshots.

  2. MFA enforced at the IdP layer

    Critical

    Multi-factor authentication (MFA) is enforced at the Identity Provider (IdP) layer, meaning authentication policies require users to present at least two distinct authentication factors before the IdP issues identity tokens or assertions to relying applications. This architectural approach centralizes authentication…

    How to test + evidence

    Testing procedure: IdP policy requires MFA on every sign-in for the workforce.

    Evidence to collect: IdP policy export.

  3. Conditional access for risky sign-ins

    High

    Conditional access for risky sign-ins applies adaptive authentication controls based on real-time risk signals such as anomalous login locations, unfamiliar devices, credential leak intelligence, or atypical user behavior patterns. When an identity provider or access management platform detects elevated risk…

    How to test + evidence

    Testing procedure: Policies challenge / block sign-ins from anomalous IPs, impossible travel, unmanaged devices.

    Evidence to collect: CA policy export + sample alerts.

  4. Break-glass admin accounts excluded from CA

    High

    Break-glass (emergency access) administrative accounts are intentionally excluded from Conditional Access (CA) policies to ensure recovery access when authentication systems fail or CA policies misconfigure and lock out all users. These accounts are typically cloud-only identities with randomly generated complex…

    How to test + evidence

    Testing procedure: Two break-glass accounts exempted, hardware-key only, alerts on use.

    Evidence to collect: Break-glass register + alerts.

  5. Session timeout + reauthentication on sensitive ops

    Medium

    This control enforces automatic termination of authenticated sessions after a defined period of inactivity and requires users to re-authenticate before performing sensitive operations such as changing passwords, accessing privileged accounts, modifying security settings, or processing financial transactions. Session timeouts reduce…

    How to test + evidence

    Testing procedure: Sensitive flows force reauth; max session length documented.

    Evidence to collect: IdP session-policy export.

  6. IdP availability monitored

    Medium

    This control requires continuous monitoring of Identity Provider (IdP) availability and performance to ensure authentication services remain operational. Monitoring systems track uptime, response times, authentication success/failure rates, and service health metrics with automated alerting when thresholds are breached or outages…

    How to test + evidence

    Testing procedure: Health checks alert on auth failures / IdP downtime.

    Evidence to collect: Monitoring dashboard.