Single Sign-On (SSO) for an LMS removes the need for a separate password. The two dominant protocols are:
- SAML 2.0 — the long-standing standard for enterprise & higher-ed identity (Shibboleth, ADFS, Azure AD as IdP).
- OpenID Connect (OIDC) on OAuth 2.0 — the modern equivalent, common with Microsoft Entra ID, Google Workspace, Okta.
SSO is the single largest reduction in attack surface for an LMS — no learner passwords stored, MFA enforcement happens at the identity provider, and offboarding a graduating student or terminated employee revokes LMS access instantly.