After rolling out single sign-on to forty cloud applications, the CISO points out that one phished password would now give an attacker access to all of them. What is the most effective way to reduce this risk while keeping SSO in place?

Single sign-on concentrates authentication at one identity provider, which creates a single point of compromise: whoever authenticates there inherits access to every federated application. The proportionate control is to strengthen that one authentication event. Requiring multifactor authentication at the IdP, preferably a phishing-resistant method such as FIDO2 security keys or platform authenticators bound to the legitimate origin, means a captured password is insufficient on its own and the protection applies uniformly to all forty applications. Removing sensitive applications from SSO gives up central control, reintroduces separate passwords that users tend to reuse, and makes deprovisioning harder; it reduces blast radius only by abandoning the benefits SSO provides. Stricter complexity rules and frequent forced changes do not stop phishing, because the attacker captures whatever the current password is, and frequent rotation tends to produce predictable patterns. Shortening assertion lifetimes limits session duration, but an attacker holding the password simply authenticates again whenever a session expires. Exam caveat: SSO is often presented as a risk on the exam, but the expected answer is to protect the IdP rather than abandon SSO. Operational check: confirm that the IdP's authentication policy requires MFA for every application with no legacy-protocol bypass, and test that a sign-in with the correct password but no second factor is refused.