[spyrosg]

No a fan of Microsoft systems, but they have GS-API/Kerberos and AD FS 3. Unix users will want SSH key management, but apart from that, Microsoft made efforts to help people spread single sign-on to much of their infrastructure.

If your payroll system has a web interface, you can have an applicative firewall in front replay your stored credentials as a hacky SSO (after checking your identity another way, of course).

[colemickens]

The payroll system, as well as security group / mailing list systems are all completely useless in anything but IE (not even Edge).

And Kerebos does nothing for these 2FA woes sadly.