Skip to content
ENExplore Calculators

Single Sign-On Coverage Calculator

Measure SSO coverage across your application estate and the password resets and helpdesk hours the gap is costing you.

About Single Sign-On Coverage Calculator

Coverage is counted two ways because the risk differs: federated applications have no standalone credential at all, while vaulted ones still do but at least it is rotated and monitored. Everything in neither group is a password a user chose, probably reused, and nobody rotates. Coverage weighted by criticality is the number that matters — 90% coverage that excludes the finance system is worse than 70% that includes it.

Formulas

Single Sign-On Coverage

coverage = applications behind SSO ÷ total applications, and the residual password count per user is 1 + applications outside SSO and the vault.

behind SSO
Federated through SAML or OIDC so the identity provider holds the credential
vaulted
Password still exists but is stored and rotated by a vault rather than by the user

Helpdesk saving

helpdesk hours saved = users × resets per user per year × SSO coverage × minutes per reset ÷ 60.

minutes per reset
Verification, reset and follow-up — 15–20 minutes is typical for an assisted reset

Worked example

With the default values below, Single Sign-On Coverage Calculator returns SSO Coverage of 62.5%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Applications in the estateaccepts 1–100,000 apps
240 apps
Applications behind SSOaccepts 0–100,000 apps
150 apps
Remaining apps in a password vaultaccepts 0–100,000 apps
40 apps
Business-critical applicationsaccepts 1–100,000 apps
60 apps
Critical applications behind SSOaccepts 0–100,000 apps
48 apps
Usersaccepts 1–5,000,000 users
12,000 users
Password resets per user per yearaccepts 0–100 resets
3 resets
Helpdesk minutes per resetaccepts 1–240 minutes
18 minutes

Results

SSO Coverage
62.5%
Coverage Including Vaulted Apps
79.2%
Applications With Standalone Passwords
50
Critical Application Coverage
80.0%
Distinct Passwords a User Must Hold
51
Helpdesk Hours Saved per Year
6,750 hours
Assessment
Critical applications are still outside SSO — start there

Step by step

  1. 1Values used
  2. 2Single Sign-On Coverage
  3. 3Helpdesk saving
  4. 4SSO Coverage= 62.5
  5. 5Coverage Including Vaulted Apps= 79.2
  6. 6Applications With Standalone Passwords= 50
  7. 7Critical Application Coverage= 80.0
  8. 8Distinct Passwords a User Must Hold= 51
  9. 9Helpdesk Hours Saved per Year= 6,750 hours

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax or fees or charges into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Single Sign-On Coverage calculated?

coverage = applications behind SSO ÷ total applications, and the residual password count per user is 1 + applications outside SSO and the vault. Coverage is counted two ways because the risk differs: federated applications have no standalone credential at all, while vaulted ones still do but at least it is rotated and monitored. Everything in neither group is a password a user chose, probably reused, and nobody rotates.

Why does Single Sign-On Coverage matter?

Coverage weighted by criticality is the number that matters — 90% coverage that excludes the finance system is worse than 70% that includes it.

What values do I need to enter?

This calculator takes 8 inputs: Applications in the estate, Applications behind SSO, Remaining apps in a password vault, Business-critical applications, Critical applications behind SSO, Users, Password resets per user per year, Helpdesk minutes per reset. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Which applications should move to SSO first?

Business-critical and data-sensitive applications, then anything with more than a handful of users, then the long tail. Criticality beats user count: a five-user application holding payroll data is a higher priority than a two-hundred-user internal wiki.

What about applications that do not support SAML or OIDC?

Put them behind a password vault with rotation and session recording, front them with an access proxy that handles authentication, or treat the lack of federation as a procurement defect at renewal. Leaving them with user-chosen standalone passwords is the option that reuse turns into an incident.

Related Calculators

Single Sign-On Coverage Calculator – Calculate SSO Coverage