How does single sign-on SSO enhance security in an architecture

Question

We are considering implementing Single Sign-On (SSO) for our application architecture, but I’m wondering how exactly it enhances security. Does it reduce the attack surface by limiting the number of credentials that need to be managed, or are there other ways SSO improves overall system security? I’m interested in understanding the benefits and potential challenges of adopting SSO in a complex environment.