The Quote That Arrives With Two Extra Zeros
For most teams under twenty people, the short answer is no: the enterprise upgrade is not worth it across the whole stack. A team password manager with enforced two-factor authentication covers most of the risk, so upgrade only the tools holding customer data, money, or production access.
Someone on the team asks a reasonable question. Can we make everyone log in through one account, so leavers lose access everywhere at once?
The vendor’s answer is yes, on the enterprise plan. The quote that follows is often several times the plan you are on, and it applies to every seat rather than the admin seats that need it.
That gap has a name in the industry, and a community-run site has tracked it for years. The pattern is consistent enough that small teams should plan around it rather than react to it.
This guide works out what the upgrade genuinely buys, what covers the same risk for far less, and the specific triggers that make paying the right call.
The Short Answer for a Team Under Twenty
- ● SSO is sold as a control, not a feature
- ● SCIM is the part that removes accounts
- ● Password managers cover the small case
For most teams under twenty people, the enterprise upgrade is not worth it across the whole stack. A team password manager with enforced two-factor authentication covers the majority of the risk at a fraction of the cost. As of September 2026, 1Password’s Teams Starter Pack costs $24.95 a month for 10 members, billed annually.
The exception is narrow and important. Upgrade the specific tools that hold customer data, financial access, or production infrastructure, and leave the rest on standard plans.
The trigger that changes everything is external. Once a customer contract or a security questionnaire names single sign-on as a requirement, the cost stops being a security decision and becomes a sales decision.
What SSO Actually Does and What It Does Not
Single sign-on moves authentication to one identity provider, usually the one behind your email. Staff log in there, and each application trusts that login instead of holding its own password.
The security gain is real. There are fewer passwords to leak, one place to enforce multi-factor authentication, and one log showing who signed in where.
What SSO does not do is remove accounts. Disabling someone in the identity provider blocks new logins, and the downstream account often still exists with its data and its licence attached.
That removal job belongs to SCIM provisioning, a separate standard that syncs user creation and deactivation. Vendors frequently sell the two together, and some charge for one while offering nothing of the other.
The Offboarding Problem Underneath the Question
Most teams reach this topic through a bad offboarding experience rather than through security theory. Someone leaves, and three weeks later a licence is still billing and a shared document is still shared.
The size of that problem scales with your tool count, not your headcount. A ten-person team running forty applications has more offboarding surface than a thirty-person team running twelve.
Counting the tools is the useful first exercise. Our guide to auditing SaaS subscriptions walks through pulling that list from billing records rather than memory.
Once you have the list, sort it by damage. A leaver who keeps access to a design tool is an annoyance, and one who keeps access to the billing system or the customer database is something else entirely.
Six Ways Small Teams Control Access
- ● Count tools that hold customer data
- ● Ask vendors for the SCIM answer
- ● Price the upgrade per seat per year
The table compares the realistic approaches, judged on the things that separate them when someone leaves the company.
| Approach | Cost shape | Offboarding effort | Audit trail | Enforces two-factor | Main weakness |
|---|---|---|---|---|---|
| Shared password in a document | None | Manual, easy to miss | None | No | One leak exposes everything |
| Team password manager with vaults | Small per user per month | Revoke vault, rotate shared items | Vault-level | Yes, in most business plans | Per-app accounts still exist |
| Sign in with Google or Microsoft | Included with your email plan | Suspend the account | Partial | Yes, at the identity provider | Third-party access is hard to see |
| SSO on an enterprise tier | Large per user per year | Blocks login immediately | Strong | Yes | Priced for large buyers |
| SSO plus SCIM provisioning | Largest | Automatic deactivation | Strongest | Yes | Rarely available to small plans |
| Managed device with browser policy | Device management cost | Wipe the profile | Device-level | Indirect | Does not cover personal devices |
Read the offboarding column first, because that is the risk you are actually buying down. The audit trail column matters mainly when a customer or auditor asks for evidence.
Two rows do most of the work for small teams. The password manager row is cheap and covers a lot, and the SSO plus SCIM row is what you eventually need, at a price that arrives later.
Costing the Upgrade Honestly
Vendors quote SSO per user per month, which understates the commitment. Multiply by your headcount and by twelve, then repeat for every tool you would upgrade.
The number surprises people because SSO is rarely available as an add-on. You buy the whole enterprise tier, including features a small team will never open, just to reach one login setting. Even password managers follow this pattern: as of October 2026, Bitwarden lists Teams at $4 per user per month billed annually and puts SSO integration on Enterprise at $6.
Per-seat pricing also punishes growth in a way flat pricing does not, a distinction our comparison of per-user versus flat-rate SaaS pricing covers in detail. An SSO upgrade converts a small recurring cost into one that scales with hiring.
Confirm current pricing directly with each vendor, since tier contents as of 2026 change without much announcement. Ask specifically whether SCIM is included, because paying for SSO without it leaves the offboarding problem unsolved.
The Middle Path Most Teams Should Take
Tiering your stack is the approach that actually fits a small budget. Split your tools into three groups and treat each differently.
The first group holds customer data, money, or production systems. Upgrade these if the vendor’s price is survivable, and prioritise the ones where a lingering account could cause real harm.
The second group holds internal work with no sensitive data. Keep them on standard plans, run per-person accounts through a team password manager, and enforce two-factor authentication everywhere it is available.
The third group is the tail of rarely used tools. Cancel most of them, since an unused subscription is both a cost and an access risk, and our comparison of 1Password and Bitwarden for teams covers where the remaining logins should live.
Which Access Setup Fits Your Team Today
- ● Under ten people, vault plus two-factor
- ● Compliance questionnaire changes the maths
- ● Upgrade the riskiest tools only
A five-person startup with no enterprise customers: Skip SSO entirely. A business password manager, enforced two-factor authentication, and a written offboarding checklist cover the realistic risk.
A fifteen-person team selling to enterprise buyers: Expect a security questionnaire within a year. Budget for SSO on the tools that touch customer data, and start the vendor conversations before a deal depends on the answer.
An agency with contractors rotating in and out: Prioritise provisioning over sign-on. Frequent joiners and leavers make manual offboarding fail, so favour vendors that offer SCIM at reasonable tiers.
A team already on Google Workspace or Microsoft 365: Use the identity provider you are paying for. Social sign-in through it is not full SSO, and it centralises far more than individual passwords do.
A regulated business handling health or financial data: Treat SSO as a baseline rather than an upgrade, and choose vendors accordingly. Buying tools that gate it behind an unaffordable tier creates a compliance problem later.
A team of two founders: None of this applies yet. Use a shared vault, turn on two-factor authentication, and revisit when the third hire arrives.
Questions Worth Asking Every Vendor
Ask whether SSO and SCIM are separate, and what each costs. A vendor that offers SSO without provisioning is selling you half of the problem’s solution.
Ask what happens to a deactivated user’s data and licence. Some tools free the seat automatically, and others keep billing until an admin intervenes.
Ask whether SSO can be enforced rather than offered. An optional setting means staff can keep using passwords, which leaves the original risk in place.
Finally, ask the price of the tier you would need in two years at double your headcount. Vendors answer this readily during a sales conversation, and the answer often changes which tool you choose in the first place.
What to Do This Quarter
Start with the tool count rather than the pricing pages. List every application that holds customer data or money, and check who still has an account on each one.
Then close the cheapest gaps immediately. Enforced two-factor authentication and a shared vault take an afternoon and remove more risk per dollar than any upgrade.
Write the offboarding checklist while the list is fresh. A document naming every tool and who revokes access is the control that SSO would automate, and it works today.
Keep the SSO question on a calendar rather than a wish list. Community tracking at sso.tax shows how vendors price this, and revisiting once a year is enough until a customer contract forces the decision.
That checklist is the part worth doing properly, since it is the control you keep whether or not the upgrade ever happens. The software offboarding checklist for a small team sets out what to revoke, in what order, and what usually gets missed.
Teams already on Google Workspace have a related control that sits outside the SSO question entirely. Our guide to controlling which third-party apps reach Google Workspace data shows how an admin can stop unreviewed tools connecting to company mail and files.
Offices on Microsoft 365 meet the same trade-off one tier down, where Conditional Access sits behind the Business Premium licence. Our breakdown of Microsoft 365 Business Standard vs Premium prices that upgrade against buying Entra ID P1 and Defender for Business separately.
FAQ
Why is SSO only on the most expensive plan?
Because vendors treat single sign-on as an enterprise control rather than a security baseline, and enterprise tiers are priced for large buyers. The practice is common enough that a community-run site tracks which vendors gate it and by how much.
Does SSO handle offboarding by itself?
Not on its own. SSO centralises the login, but SCIM provisioning is what removes an account automatically when someone leaves. Many vendors sell them together, and some charge for SSO while offering no SCIM at all.
Is a password manager a reasonable substitute for SSO?
For a handful of tools, yes. A shared vault with per-person accounts and enforced two-factor authentication covers most of the same risk, and it costs a fraction of an enterprise upgrade.
What about signing in with Google instead?
It behaves like SSO for the login and gives you far less control. You cannot always revoke third-party access centrally, and the account that owns those logins becomes a single point of failure.
At what point does SSO stop being optional?
When a customer contract or a compliance questionnaire requires it, or when the number of tools makes manual offboarding unreliable. Both triggers usually arrive before a team reaches thirty people.
Sources
- 1Password: Business Pricing — checked 2026-10-01
- Bitwarden: Business Pricing — checked 2026-10-01
Some links may be affiliate links. We may earn a commission at no extra cost to you.
How this article was made: it was drafted with AI assistance from the official sources listed above, and its figures were checked against those pages on the dates shown. It is not based on personal hands-on testing.
Comments
Post a Comment