Design Single Sign On Flows

Trust, Privacy & Ethics · authentication, enterprise, trust

Updated 2026-07-28

Remind the user how they signed up last time. Most repeat login failures are someone typing a password into an account that was created with a provider.
Show the provider on the sign-in screen and again on the account page, so the answer is available before and after the confusion.
Do not present five equal buttons. Lead with the method this user or this organisation actually uses and keep the rest available but quieter.
Say what will be shared before sending the user away. Consent screens are written by the provider, so the expectation has to be set by you.
Return the user to where they started. Losing the original destination after a redirect is the most common and most avoidable flaw in the whole flow.
Handle the mismatch cases explicitly:

Never leave the user on a blank page after a redirect. If something failed, say which step failed and offer another route in.
Support the enterprise requirement without punishing everyone else. Enforced sign-on for a domain should be invisible to users outside it.

Sign-in is the first thing every user does and the only step where failure means they see nothing else of the product.