Single Sign-On (SSO)

No. SSO decides where authentication happens; multi-factor authentication decides how strong that authentication is. Because SSO routes every login through one identity provider, it becomes the natural place to enforce a second factor once for all connected tools, which is why the two usually arrive together. You can run multi-factor authentication without SSO, and SSO without it, though the second combination is rarely a sensible choice.

Often, yes. Many vendors package single sign-on with higher tiers rather than including it in entry plans, so confirm it during evaluation rather than after signature. Ask which protocols are supported, whether automated user provisioning is bundled or priced separately, and whether a test connection can be built in a sandbox before you commit production identities to it.

Candidate-facing login is a different problem. Applicants are not employees, so they cannot sit in your corporate directory. Some career sites offer social sign-in through a consumer account, which shortens the application form but is not enterprise SSO and carries none of the same controls. Keep the two conversations apart: staff authentication is a security decision, candidate sign-in is a conversion decision.

SCIM is a provisioning standard that creates, updates and deactivates accounts automatically from the identity provider. Single sign-on handles the login itself; without provisioning, a human still adds and disables users by hand. Smaller teams cope with that comfortably. Once headcount grows, or once an auditor wants proof that departures were deactivated promptly, automated provisioning stops being optional.