We’re getting too many support issues from custom authentication. What SSO approach makes sense?

If custom authentication is causing support pain, the usual move is to standardize on SSO with a central identity provider (IdP) rather than maintaining app-specific auth logic.

Best-practice approach

1) Use an enterprise IdP

Pick one of:

• Okta
• Microsoft Entra ID (Azure AD)
• Google Workspace / Cloud Identity
• Ping Identity / OneLogin if you already use them

2) Use standard protocols

Prefer:

• OIDC / OAuth 2.0 for most modern apps
• SAML 2.0 if you have older enterprise apps or vendor software that only supports SAML

In general:

• New apps: OIDC
• Legacy/enterprise SaaS: SAML
• If both are available: choose OIDC unless there’s a compatibility reason not to

Why this reduces support issues

A centralized SSO setup helps because:

• Users authenticate in one place
• Password resets and MFA are handled centrally
• Fewer custom login flows to debug
• Easier offboarding and access control
• Better audit logs and security policy enforcement

Recommended architecture

• IdP handles authentication
• Your apps become relying parties / service providers
• App auth is limited to:
  • validating tokens/assertions
  • mapping IdP identity to local roles/permissions
  • session management

Avoid:

• custom password stores
• app-specific MFA implementations
• bespoke login logic per application

What I’d recommend in practice

If you’re replacing custom auth across multiple apps:

1. Choose a single corporate IdP
2. Integrate all apps through OIDC where possible
3. Use SCIM for provisioning/deprovisioning if supported
4. Require MFA and conditional access at the IdP
5. Keep local app accounts only for app-specific authorization, not authentication

If you need the simplest path

• If you’re mostly Microsoft-based: Entra ID + OIDC
• If you want a strong neutral enterprise option: Okta + OIDC/SAML
• If you’re a Google-first org: Google Workspace SSO

Good rule of thumb

• One login source
• One MFA policy
• One user lifecycle system
• Standards-based integration only

If you want, I can also suggest the best SSO choice based on your stack (Microsoft, Google, Okta, AWS, on-prem apps, etc.) and whether you’re mostly employee or customer login.