What’s The Best Single Sign On Solution (SSO) For My RIA? RIA Tech Talk Episode #7

Todd W. Darroca

Hello and welcome to the RIA Tech Tech Talk podcast, brought to you by of course, RIA Workspace. I’m Todd Darroca, and alongside me is David Kakish. And together we’re on a mission to simplify the complex world of technology for RIAs just like yours. So in this podcast, we’ll be your tech guides breaking down those often confusing tech topics into plain and practical terms. So we hope you join us for every episode as we dive into the latest tech trends, share expert insights, and help you navigate the ever-changing world of RIA technology. So David, welcome. I’m glad you’re here with us as always, as our captain, my captain, telling us about some good stuff inside of what’s happening in the world for I a technology. So today we are asking the question about single sign-on what’s the best single sign-on solution for my RIA. It looks obviously cybersecurity attacks, keeping things safe, it’s always a big deal more now than ever. Good topic to start on. First off, why should anybody care about an SSO?

David Kakish

Yeah, well hey Todd, I’m always mesmerized as I listen to you. You’ve got that DJ voice.

Todd W. Darroca

It’s taken a lot of practice to get there, but no, it’s really weird. Every time just like I get a mic on it just automatically flips on. That’s

David Kakish

Funny. Alright, so to the topic at hand, to the topic at hand, web single sign on a lot of RIAs, and basically it’s a way for an RIA where you can secure your web-based applications, think like e-money, Salesforce, Redtail, Wealthbox and so on, and why this is important for you as RIAs, A most RIAs that we start working with are either not using it or B, they’re using a consumer version of a single sign-on solution, or they’re using a password manager like ClassPass as a single sign-on solution. So I can confidently tell you that out of all the new RIAs we work with, probably over 80%, they’re either not using a single sign-on solution, or if they are using one, they’re using a consumer version one and not an enterprise version. And so what we’re going to be talking about is an enterprise version of secure single today and why you want to use that.

By the end of the session today, you’re going to know, hey, here’s some of the options that are out there. There’s one that for us is a clear winner and we’ll tell you why. And then you can go ahead and can implement that yourself or you can reach out to us and we’re happy to help. So just kind of a highlight of what we’re going to go over today. And again, I try not to get too much into the technical jargon. Most of our listeners are managing partners, chief compliance officers, VP of operations and stuff like that. So this is not meant for an IT person, this is meant for a managing partner or a chief compliance officer at an RIA with 10 20 people. Okay, got

Todd W. Darroca

It. Awesome. So let’s start with the basics then. David, what is web single sign on? Let’s start right there.

David Kakish

Yeah, so if you look at a typical RIA today, vast majority of the software applications that they use are no longer server-based. Remember five, 10 years ago you had a server in the closet that was running like your files and your application and things like that. Today, most RIAs are using web-based applications. Think Dropbox, think e-money think salesforce.com. Again, wealthbox, Orion, Redtail, the list goes on and on and on. And so the question becomes now that you’re using a lot of web-based applications, how can you use an RIA secure those web-based applications? And so what essentially this is, and I’ll share this here on my screen in a minute, what this basically is, it’s a way for you to go ahead and access all of your web-based applications securely. And think of it as you hire an employee or hire Mary, she opens up her browser and then she sees a dashboard for e-money, Salesforce and everything else. As a matter of fact, let me share my screen here and then you can go ahead and see that. So I’m going to share my screen.

Todd W. Darroca

I’ll walk those who are listening through David’s demo, but he’s pulling it up right now. So

David Kakish

Todd, do you see my screen right now?

Todd W. Darroca

I do. You’ve got the apps dashboard with a whole bunch of apps on there, including eight by eight teams booking Calendly.

David Kakish

Exactly. Yeah, exactly. So all that I do is I open up my, I’m on my computer, my computer is secure and registered to my company. I open up the browser and then I can come in. And what I did is I came here and I opened up my apps, my applications, and this is tied into my Azure active directory account. And if you look, these are the web-based applications that I use. I have it as a dashboard one, and then the Microsoft Web-based applications are also available. But just to kind of go back here, I have active campaign, I have QuickBooks online, I have Bamboo hr, I have Zoho, CRM, and a combination of other things. Your RIA would have the applications that you would use, wealthbox, salesforce.com, Orion and so on, it would all be listed right here. And I’ll click on Calendly as an example.

What’s going to happen is it’s going to automatically log me in and now I am a lot more productive. I don’t have to remember all the usernames on the passwords, but on the backend it’s a lot more secure because what I have essentially done is I went ahead and now it’s a much more complex password that’s tied into my Microsoft account. So anyways, I just wanted to share that quickly because again, you may know what that is and you may not, but don’t confuse a password manager for a single sign on and I’ll talk about that. I’ll talk about the problem in a minute. But just at a very high level, for those that are not familiar with web single sign-on, I wanted to explain it and then show it to you. So from Todd as an employee, you would be a lot more productive because you don’t have to remember 10 different passwords and usernames and then you’re a lot more secure because now much, much tighter integration with Microsoft and a much more secure password that’s tied into that.

Todd W. Darroca

And just so I’m clear too, this is very different than multifactor authentication like a duo mobile or all those other kind of enter this number into that that is not single sign on correct for a while. That’s why I was thinking that’s why.

David Kakish

Well, a lot of the so correct multi-factor authentication and single sign-on are two different things. We already have multifactor authentication built in. So when I logged into my computer, it forced me to, so think of it as this way, what you saw was just a glimpse. I’ve already signed securely into my computer, this computer knows that it’s me and Microsoft acknowledges that it’s me and that’s why I can securely access these web-based applications. But yes, secure single sign-on is a way for you to productively and securely access all of your web-based applications for your company without compromising usernames and passwords and things like that.

Todd W. Darroca

I want to go back to what you said earlier when we first started the podcast here, you said about 80% or that was your best guess, 80% are not using an SSO. And so I’m astonished by that. Maybe astonished too strong of a word, but I’m surprised Why is that? And I know you were going to touch on a couple of big problems that you see. So is that one of them or are there other problems that you’re seeing that RIAs and SSOs, why they don’t get along so much or there’s conflicting cation channels?

David Kakish

So I just want to qualify that 80% are either not using single sign on or they’re using a consumer version of single sign-on think of like Chrome SSO, it’s really a password manager. It’s not a single sign-on LastPass. It’s a really great password manager, but it’s not single. And people kind of confuse the two sometimes. And this is just really phenomenal. The big, big reason why is historically single sign-on solution was available for large enterprises. So really big businesses use that. And it was really complicated to set that up for a small business RIA 5 10, 25 employees. And so that’s what that is. When I say 80% are not using it, they’re not using single sign-on at all or they’re using a consumer version of single sign-on very, very, very few are using an enterprise or a big business single sign-on solution. So I just wanted to qualify that a little bit. Okay,

Todd W. Darroca

Gotcha, gotcha. Why?

Todd W. Darroca

Ahead. Go ahead. So why do you think that they’re not using that bigger enterprise solution? Is it cost? Is it just ignorance of understanding what that is or that is surprising? Yeah,

David Kakish

So I think it’s a combination of things, right? Number one is just sort of understanding that again, a password manager is not a single sign-on solution. And then the other thing is these enterprise businesses historically have not made it easy for a small business with 10 employees, 25 employees, five employees to use a single sign-on solution. If you think about, and we struggle with this all the time, right? Because we’re always bringing the latest technology that enterprises are using to an RIA with 10 employees. Think of a vendor or a software vendor that has something built specifically for banks where each bank has like 10,000 employees. They’re not even going to return the phone call for that RIA with five employees, right? So we kind see that. So it’s a combination, it’s education. The product has been really focused on these large enterprises and it’s been to be fair, complex and expensive, but not anymore. That’s part of why we’re talking about this and want to bring this to the RIA that’s listening to us and really highly recommend that you implement this single sign-on solution.

Todd W. Darroca

So what isn’t considered a single sign-on? So for example, you mentioned LastPass, and so I do use one of my clients, they gave me a full dashboard of, hey, here’s everything you need to have to access to just click on it and it’ll fill the password in for you. So what makes that not a single sign-on solution if I have all the passwords there, sure. And am I still safe, secure wise when I use those items or is there a different level of security I get with an enterprise level, obviously. But

David Kakish

Yeah, that is a great question and that’s sort of the crux of it all right? Which is, look, having your username and passwords in Excel spreadsheet is not a good idea and some people have that. So having it in something like a keeper or LastPass is really smart. But LastPass, and we see this a lot is not a single sign-on solution. I’m going to tell you the difference because what LastPass and you still want to have a password manager like LastPass, right? The LastPass is going to list a username and a password for something. You might need to share it among employees or whatever. With the SSO solution, what happens is I create a dashboard for you, Todd, and then you go into that dashboard and now you’re accessing Redtail and Wealthbox and e-money and Orion and salesforce.com. You as an employee, you don’t know what that username and password is for Salesforce, you’re just accessing that.

Whereas with LastPass, it’s giving you the username and it’s giving you the password. And what happens now is Todd no longer works with us, we’re going to let you go. You already know the username and the password for salesforce.com in a single sign-on solution, I disable your main account and now you can’t access salesforce.com, you can’t access whatever web-based application. So that’s one. And then also when we hire you, this dashboard is kind of created for you. You can go and you can’t access these web-based applications securely. You as an employee, you don’t know that username and that password.

And to kind of expand on that, many of these software vendors also have a really great direct integration with Microsoft. And so the security is much, much higher because now you’re not relying on just a username and a password. And then, but wait, there’s more. So the last thing that we see, and not a lot of people are using this, but it is really nice, is I can look at logs like, Hey, how often is Todd accessing salesforce.com and wealthbox? And by the way, where is he accessing it from? And then another security feature for really highly sensitive applications, I can lock it down and I say, Hey, Todd can only access this from inside the office, or I can restrict it to access within the US or from your home office and the work office. So you start looking at some of these highly sensitive applications where you want to really lock it down and you can really do that. So now you begin to see the difference between single sign-on and password manager. There’s some similarities, but they are sort of two different things

Todd W. Darroca

When you talk about you can get a log of who’s using what app for how long, is this something that all the time teams are asking for new software applications? Or let’s say they want a sales navigator and it’s so much money per month, can I see that they said they wanted it, but let’s just see if they’re actually using it is can I use a single sign-on solution to see how much they are using that app and say, look, you wanted it, but now you’re not using it at all and here’s the proof. Is that something I can do in poll?

David Kakish

Yeah, absolutely. And I didn’t even think about the application that way. That’s interesting how you’re even thinking about that, right? I’m like, oh wow, yeah, that’s actually really smart. Hey David, I put in a request to use this. Really get that

Todd W. Darroca

All the time.

David Kakish

And so you can look at the logs and you can say, Hey, how often are they using it and how long are they in it and where do they log in from? And different things like that. So yes, absolutely you can do that. And I’ll take it a step further. There are some applications where there’s shared credentials, think like FedEx and UPS. So you’ve got maybe three employees that are using the same username and password. So what we can actually do is we can set up Todd and David and Mary and Bob to use that same FedEx account. They just don’t know what that username and password are, but they can go in and they can use that and they can be fully productive within that right there. So there’s a couple of different ways you can do that. But yes, I didn’t even think about the way that use case that you just presented, and I think that’s phenomenal.

Todd W. Darroca

Yeah, I just think you’ve got these huge programs that are worth like $10,000 a month and you’re always hearing, I need that, I need that, I need that. And so it’s good as a business owner to be able to go back and say, okay, is it worth the investment we’re doing now? No, it’s not. So let’s knock it off and improve that bottom line. So if I’m looking for an SSO, tell me what are the best enterprise ones that I should be considering and what things should I consider if I’m going to, or when I decide to buy one of these?

David Kakish

So before I answer that question, back to the previous point, something we’ve done here in our businesses where somebody’s asking for something, we’re going to say, okay, great, what is that going to replace? So what we’ve trained them is, and now they come and they’re like, Hey, we want use this tool, but we no longer use this tool, so we want to swap it and it’s going to break even. So that’s a very common practice that we do here on purpose. Now if there’s a business case and it’s net new, we will go ahead and we’ll do that. But everybody’s been trained that well, if you’re going to do a new thing, what’s the old thing that’s going to go away? Yeah, talk

Todd W. Darroca

About a technology stack that’s obsolete after a while. Alright, yeah. So let’s tell me about the top ones to use and ones and how I should consider them.

David Kakish

Sure. And I’m going to share my screen. I have a really nice Gartner report here. So if you look, this is a Gartner report, the Gartner Magic Quadrant report. And if you look, it’s really nice because if you haven’t seen this before, it’s nice because they do it basically on the ability to execute and then completeness of vision. And then up in here are typically the leaders or the winners in the top right hand corner. So if you look, the really two big ones in this space is Microsoft and Okta. And then there’s some other players like IBM. Historically what we’ve seen is Microsoft, Okta, and then one login. Those are kind of the big ones that we’ve seen. But there are other players and we we’ll include this Gartner report in the show notes, so you can see that. But yeah, Okta, OneLogin, IBM, Microsoft, those are probably the big ones. And for me, there’s a clear winner and I’ll explain why in a minute, but I’ll come back to you if you wanted to ask something or add what I just said.

Todd W. Darroca

And that magic quadrant, everybody wants that top. If I’m as a business owner, I’m like, I want to get the best, the one that can get me everything I can. How should somebody, is that the end all be all of like, Hey, anything in that right hand side quadrant, if you wanted to use that, that’s what you should be using. Or should I be considering different levels? First, we talked about a five to 10 person business, but maybe you base it off of not employees, but revenue size or how many business units you have. Are there anything that I should consider specific characteristics or specific priorities I guess that I should consider when I decide on one of these?

David Kakish

Absolutely, absolutely. Generally speaking, everybody wants to be sort of in that top right hand corner, that’s kind of the leader. You’ve got the best ability to execute and you’ve got the best vision. But funny enough, and it’s funny that you asked that question in the bottom left hand one where unquote people don’t want to be there. They’re considering those niche players or niche players. And so to me, if they’re focused on my niche, absolutely I want to work with that. So that’s something to keep in mind. Now, there aren’t really any niche players in this specific vertical, so I would definitely look in the top right hand corner. And especially in this industry where people say financial services and they think it’s all encompassing. Well, an RIA is very different than a trading company, very different than a bank, very different than a credit union and so on. And so generally speaking, if they don’t focus on your niche, then you want to be in the top right hand corner.

Todd W. Darroca

So in your opinion, who’s the number one that I should be? That’s the best top of the line.

David Kakish

If people have listened to me for a while, they’re probably not surprised.

Todd W. Darroca

Who is it, David? I can just guess. So

David Kakish

For us, and for me, the clear winner is Microsoft and people love to talk trash about Microsoft. They’re the easy target. And I’m sharing a Gartner report where they’re in the top right hand corner, but there’s really three reasons. Number one is I love that they’re in the leader quadrant in the Gartner report. That’s a third party objective survey. The second thing is there’s a lot of enterprise or big business security built in. So I know we’re talking about SSO, but actually this report by Gartner is the magic quadrant for access management. Think of this as sort of identity management and not just single sign on. And I’m going to give you a really simple example. If it’s detected that Todd, all of a sudden you logged in and you are Austin, and now you logged in and you were in Denver for whatever reason, it’s going to force the multi-factor authentication because it’s saying, hang on, that doesn’t make sense.

Why is Todd logging in from two places at once for most of our RIAs, the entire businesses in the us So we restrict access to only within the us. There’s no reason for anybody to access it from France or whatever. And so there’s a lot of what I would call enterprise security built in, and I touched upon to that. And then the third reason is really pricing. It’s probably already part of your Microsoft subscription and you don’t know it. So if you have the Microsoft Enterprise E three or E five subscription, this is already part of your subscription. If it’s not, Microsoft has a product, they just changed the name of it. So I’m going to put a disclaimer, I don’t know what they’re going to stick with in the future, but now it’s called Microsoft entra single sign-on, and you can go and you can buy that. What

Todd W. Darroca

A sexy name that is.

David Kakish

Yeah, they literally, they just made this change, but whatever. That’s fine. I’m just going to call it the SSO and the pricing. The pricing, right. I’m going to pop it here real quick. I don’t have it memorized, but if you get sort of the, the premium version of that, it’s $9 per employee per month if you get that. So just again, it might be part of your subscription check into that, but if it’s not, then you can get that single sign on as sort of a, you have to do the math. Is it better to upgrade, right? Or is it better to buy it as a standalone? But we’ll leave that up to the listener how to do that.

Todd W. Darroca

So what impresses you about Microsoft’s SSO from a security perspective?

David Kakish

Yeah, I think again, one of the big things is just, again, I call it big business or enterprise security. There’s just so much that’s kind of built in here. And again, it’s just think of locking in access for outside the us. That’s a pretty big deal. If you have a really critical application, locking access to inside the office or specific IP addresses from home or things like that is really nice. The other one that I really like is that secure direct integration between the Microsoft and the software vendors. And what I mean by that is everybody wants to, excuse me, everybody wants to integrate, have a direct integration with Microsoft, and I’m not talking about some Zapier integration or third party integration or something like that. I mean, having that direct integration is really good. And then I guess I’ll leave you with this thought.

And again, all of my accounts are protected by Microsoft security and best practices, but the thing that not a lot of people realize is this whole concept, identity management and protection, you’ve probably heard about something called active directory or Azure Directory Services. This is what over 90% of Fortune 1000 companies are using. And so if they’re using it, if over 90% are using this technology, we take that same technology, that enterprise technology, and we extend it to your RIA with five employees, 25 employees, 10 employees and so on. So for me, I know people talk about SSO, but for me it’s really about identity management and protection. And SSO is a component of that.

Todd W. Darroca

So obviously you’re recommending it to your clients, and I’m sure that some of your clients probably already have this within their system or their technology stack. So how are your clients using that? If you give us a little insight into that, and then what are you hearing from them as far as what they’re liking about it or even what they’re not liking about it? But

David Kakish

Yeah, I mean, listen, we use that here too. I use that personally and I’ve become very, very dependent on that. I use it all the time, and I think we’ve touched upon some of these things, but for me, remember, my computer is already compliant to my company. So I log into my computer, my computer meets the IT compliance requirements, all that fun stuff. I open up the browser, any browser, and then when I open up that browser, I can go and I can click in the top right hand corner where it says my apps, my applications, and then I get that dashboard of all the different applications that I use. I’ve created for demo purposes, I created separate dashboards, but let’s just say a really great, and so for me as an employee, that’s it. I turn on my computer, I do what I needed to log in securely, and then I open up my browser regardless of what the browser is, and then I can access all of my web-based applications. It’s kind of like a dashboard for the business. Phenomenal, fantastic, and productive. The really nice thing too is if I am not part of the accounting team and I don’t need to use QuickBooks online, I won’t even see that application listed right there.

Todd W. Darroca

Got

David Kakish

It. So there’s a lot of really, really great

Todd W. Darroca

Noise then for me. Yeah, that

David Kakish

Makes sense. Yeah, yeah, exactly. Exactly. I showed you in my demo, I have a lot of applications just for demo purposes, but most people don’t have all those applications listed. And so for me and for our clients, what we love about it is for me as an employee, I am so much more productive. I don’t need to worry about all the different passwords and different things like that. I log into the work-based applications. I’m productive. I do what I need to. And so as an employee perspective, I’m a lot happier. It’s easier. I don’t have to manage all this other stuff on the backend for your chief compliance officer and the people that are looking at the security, it’s a lot more secure. Got it. And then what I want you to think about two scenarios that really come in handy when you hire a new employee, and then when you fire somebody.

So imagine you hire somebody and all of their applications are right there on that browser, and you don’t have to give them the last pass with all the credentials, right? And then we let go of, we Fire Bob, we need to let go of Bob. Bob’s probably working from home or whatever the case might be. We disable his main account and then he can’t access all these other web-based applications. Rather than saying, hang on, where’s my spreadsheet? What did we give Bob access to? Let’s go in and manually disable all of his accounts and things like that. So that’s kind of what we’ve seen that are a pretty big deal. And then I touched upon this before, the highly critical applications, you can really, really, really lock that down. And then the logs, you can kind of look at the logs and then the shared web accounts that you have with multiple employees. Again, think UPS, FedEx and so on.

Todd W. Darroca

When somebody does, one of the things I always think about is implementation of this. How long is it going to take to do it and can I do it myself? So you say if I have a subscription that’s either an E three or E five, I probably already have it. So what is that? Is the setup pretty quick? I just turn it on and it’s all set up, or what does that look like? How much time do I need to make sure to invest?

David Kakish

So we typically set up all of our clients with, is there any onboarding process? There’s a lot of different things we do in the onboarding, and that’s one of them. You’re asking a great question. I don’t get involved in setting this up. I know there’s two different ways to set that up. You can have an admin in your company and the admin sets up all the credentials for all the employees. Again, I’ll pick on the chief compliance officer, but it can be anybody. So Mary is the chief compliance officer. She can set up all 10 employees with this whole single side on solution, and they will not know what that username and password is. So that’s one type of setup. The other type of setup, if you wanted to, employees would know their own username and password and they can kind of set it up themselves.

That’s typically not the best way to set that up, but that is an option to do that. Yeah, there’s a little bit of work to get this set up in the beginning. It’s not plug and play. And so I would encourage you to research it or to talk with your IT provider or reach out to us. We’re happy to help. I don’t want to mislead the listener and say, yeah, it’s kind of like installing office. You do need to set up some things inside your Microsoft tenant to get that going. But what we find amazing, and even for me is it just becomes such part of your operating system, your daily operating system, because you use these every single day all the time. And to the point that I can’t remember, I had an issue once. I’m like, hang on. I’m like, I can’t work. And so the single sign on has become mission critical because that’s how we access our main web-based applications. But yeah, there’s a little bit to set that up. There’s a little bit of work that your CCO would want to do. Most of our listeners are probably not do it yourself. So I’d encourage you to reach out to your IT provider or reach out to us and we’re happy to help.

Todd W. Darroca

Cool. So we’ve covered a lot a lot today. I think this is probably one of the meatier ones that we’ve discussed so far. So tell me, if I were to walk out of my car or whatever, I’ve looked at this podcast or watching it, what are my key takeaways? What are the big three things that I should remember if I’m going to go do an SSO or thinking about pulling that into my tech stack?

David Kakish

Yeah, so the big takeaway, or maybe even better yet, the question for you is why are you not using the Microsoft single sign-on solution for your web-based applications? A lot of RIAs are using the Microsoft platform, right? Not all of them, but many of ’em are. And so my big question that big insight is why are you not using the Microsoft single sign-on solution? It’s better security, it’s better productivity. The answer is you probably don’t know that it’s available, or you probably didn’t know that that’s part of your subscription, or you probably don’t know how to implement that, and that’s okay. I would just encourage you to reach out to your IT provider and just say, Hey, look, I listened to this guy, David, we listened to Todd and David. They’re talking about this SSO stuff. Microsoft has something. Can you help us with it? And if they can help you, fantastic. If not, reach out to us and we’re happy to do it. And if you want to read up more on it, we’re going to include in the show notes, we’re going to include the link to the Microsoft products. You can go read up on it, and then we’ll also include report to the Gartner report. So you can go and do that. But again, the big question, the big takeaway is why are you not using Microsoft Single Sign-on for your web-based applications?

Todd W. Darroca

All right, well, there you have IT folks. That’s a big question. See if you can answer it. Hopefully you can answer it pretty detailed and take some steps forward to get yourself more secure and productive in your team. Of course, David, we’re also going to put a lot of these other resources and links to the previous podcast episodes on our website, ria workspace.com, and just click on the learning center folks and you’ll be able to access all this information. Well, that’s it for this episode for the RIA Tech Talk podcast. We want to thank you so much, and also thanks to RIA Workspace for bringing on this great podcast for our weekly updates to our listeners. And so feel free to reach out to us for more information or questions or topics that you’d like us to cover. Again, we want this to be a two-way conversation, not just me and David being talking heads. So please let us know what you’d like to hear next or things that you’re really interested in us diving into. Again, for David and myself, thanks so much for listening to us and we hope you stay tuned for our next episode with more RIA Tech Insights. So we’ll see you then.

David Kakish

Thank you.