After monthly patching, a large number of users who are logged onto the network report that application links from a company's intranet site, which previously opened directly into the website, are…

SSO depends on tightly coupled configurations such as Kerberos delegation, SAML trust relationships, or integrated Windows authentication settings that patches can inadvertently modify or reset. When these settings are disrupted, users lose the seamless pass-through authentication they previously had and are instead challenged for credentials by each application, which matches the large-scale, post-patch behavior described.

Password expiration would affect individual users gradually over time rather than causing a simultaneous, widespread prompt for credentials immediately after a patching event.

Account lockout would prevent affected users from logging in at all rather than simply prompting them for credentials when accessing application links.

Certificate expiration typically produces browser security warnings or connection errors rather than credential prompts, and it would not be directly triggered by a routine monthly patching cycle.