With single sign-on, applications trust a central identity provider, such as a company's Microsoft or Google account system, to confirm who a user is. People sign in once, typically with MFA, and the identity provider vouches for them to each connected application using standards such as SAML or OpenID Connect.
SSO improves both security and administration. Fewer passwords mean fewer to steal or reuse, MFA can be enforced in one place, and disabling a departing employee's central account removes access to every connected system at once.