PortalGuard Single Sign-On (SSO) is an authentication solution that provides users with access to multiple applications through a single authentication point. It supports both on-premises and cloud-based applications, including legacy systems and thick client applications that typically lack support for standard identity federation protocols. The product supports a range of open identity federation standards: SAML 2.0, WS-Federation, OAuth 2.0, OpenID Connect 1.0, and CAS 3.0+. It can function as a SAML Identity Provider (IdP), enabling users to authenticate once and access pre-registered web-based accounts. For thick client applications, PortalGuard includes an SSO Concierge feature that passes credentials to those applications on the user's behalf, removing the need for separate logins. Authentication options include multi-factor authentication (MFA) and biometrics, which can be managed under centralized security policies. Directory compatibility includes Microsoft Active Directory, Azure AD, IBM iSeries, LDAP-compliant directories, and custom SQL user repositories. Kerberos SSO is available for domain-joined workstations, extending to AD domain-joined Macs, enabling a passwordless desktop login experience when combined with MFA. PortalGuard also includes a Self-Service Password Management (SSPR) feature that allows users to reset, recover, and change passwords without IT involvement. Real-time activity reporting covers web SSO activity, login activity, account lockouts, and self-service usage. The interface supports full customization for branding and user experience consistency across devices.