SSO should be table stakes
From a security engineering perspective I think strong authentication should be table stakes, and the proliferation of WebAuthn is a good starting point. For most enterprise companies it also likely makes sense from a risk management perspective. Single sign-on, however, is a convenience feature, not necesarily a security feature. And as such, I think it&#x27;s acceptable for it to be an add on subscription.<p>This is especially true when the application in question offers strong authentication with no opt outs, which doesn&#x27;t seem to be the case with Tuple -- I don&#x27;t see a way to set a second factor, and the app happily let me register with &#x27;password1234&#x27; as my password. Given their lack of strong authentication, I agree with SSO being part of the base subscription, for their own sake more than their customers&#x27;. I&#x27;d like to see them improve, revamp, or remove their direct login feature altogether.