IT-Ops Field Notes

How to Set Up 2FA and SSO Across Small-Business Tools on a Budget

Published

“We should really turn on 2FA everywhere” is easy to say and, past about five SaaS tools, annoying to actually manage — a different authenticator entry per app, no central place to disable a departing employee’s access, and enterprise SSO pricing that assumes a budget you don’t have. This is a staged plan: what to do for free today, what to add once you outgrow per-app 2FA, and where a small paid step actually earns its cost.

Search intent

Someone searching this is a small-business owner or the one IT-adjacent person on staff who wants MFA and ideally single sign-on across their tools (email, accounting, project management, etc.) without paying enterprise-IdP per-seat pricing meant for companies with a dedicated identity team.

Stage 1: Per-app 2FA with a free authenticator (do this today, costs nothing)

Before anything about SSO, make sure every tool that supports it has 2FA turned on individually. This is the highest security return for the least effort and applies regardless of team size:

  • Use a free TOTP authenticator app — Aegis (Android, open source) or 2FAS (iOS/Android, open source) if you want something auditable, or Google Authenticator / Microsoft Authenticator if you’d rather use what’s already familiar.
  • Turn on passkeys (FIDO2/WebAuthn) wherever a tool offers them instead of TOTP codes — they’re phishing-resistant, free, and increasingly supported by mainstream SaaS logins (Google, Microsoft, GitHub, and a growing list of business tools).
  • For your highest-value accounts (email, domain registrar, cloud/hosting provider, financial tools), add a hardware security key as a second factor rather than relying on TOTP alone — a phished TOTP code is still usable by an attacker for a short window; a hardware key isn’t phishable the same way. See YubiKey vs Google Titan vs SoloKeys for which specific key to buy.

YubiKey 5 NFC 2-pack placeholder — swap for a real link once an affiliate account exists. Budget one key per person who touches admin-level accounts, plus a backup key stored somewhere separate.

This stage alone closes most of the practical risk (credential-stuffing and phished passwords) and needs no infrastructure — just discipline in turning it on per tool and documenting which accounts have it.

Stage 2: When per-app 2FA stops scaling

The pain shows up around 8-10 SaaS tools and 3+ people: no central place to see who has access to what, no fast way to cut access when someone leaves, and everyone re-entering 2FA codes tool by tool. That’s the signal to add a free-tier identity provider rather than jumping straight to a paid enterprise IdP:

  • “Sign in with Google” / “Sign in with Microsoft.” If your team already lives in Google Workspace or Microsoft 365, the cheapest real SSO is simply using that account as the login for every other tool that supports OAuth/OIDC sign-in — no extra product, no extra cost beyond the Workspace/365 subscription you already pay for. Turn on 2-Step Verification / MFA at the Google Workspace or Microsoft Entra ID level once, and it protects every connected app’s login.
  • JumpCloud’s free tier. If your tools don’t all support “sign in with Google/Microsoft,” or you want directory-style user management (one place to add/remove a person from everything), JumpCloud has historically offered a free tier scoped to a small number of users/devices — check current limits before committing, since free-tier terms shift. It supports SSO (SAML/OIDC) to a wide app catalog plus MFA policy enforcement.
  • Cloudflare Zero Trust (Access). If part of what you’re protecting is self-hosted apps (not just SaaS), Cloudflare’s Zero Trust free tier can sit in front of them and enforce SSO login (via Google, GitHub, email OTP, or other identity providers) before a request even reaches your server — useful alongside a reverse proxy for internally hosted tools.

Stage 3: Self-hosted, if you already run a homelab/server cluster

If you’re already self-hosting other small-business tools, a self-hosted identity broker avoids per-user SaaS fees entirely, at the cost of you maintaining it:

  • Authentik — open source, supports SAML/OAuth2/OIDC/LDAP, a reasonably approachable admin UI, active development. A common choice for small self-hosted stacks.
  • Keycloak — open source, backed by Red Hat, more enterprise-oriented feature set (fine-grained realms/roles) at the cost of a steeper learning curve.
  • Authelia — lighter-weight, designed to sit in front of a reverse proxy (Caddy or Nginx Proxy Manager) rather than act as a full SSO broker for external SaaS — a good fit specifically for gating self-hosted apps, less so for centralizing login to Gmail or QuickBooks.

Self-hosting only pays off once you’re already running the infrastructure and comfortable maintaining another service’s updates and backups — it’s not the budget option if this would be your first self-hosted server.

What “on a budget” should not mean

Don’t skip 2FA on individual tools while waiting to set up SSO “properly” — Stage 1 takes an afternoon and closes real risk immediately, while Stage 2/3 planning can take weeks. And don’t buy full enterprise-tier SSO (the kind with per-user monthly fees, SCIM provisioning, and conditional-access policies) until you’ve actually outgrown the free tiers above — that tier is priced for companies with dedicated IT/security headcount, not a 5-15 person shop.

Bottom line

Turn on free per-app 2FA (TOTP or passkeys) everywhere today — that’s the non-negotiable first step regardless of budget. Add hardware keys for your highest-value accounts. Once you’re managing SSO across 8+ tools, move to a free-tier IdP (your existing Google/Microsoft account, or JumpCloud/Cloudflare Zero Trust free tiers) before considering a paid enterprise identity product — and only go self-hosted (Authentik/Keycloak) if you’re already running infrastructure you’re comfortable maintaining.