ExamWizardzExamWizardz
Start free
Security

What is identity provider?

An identity provider (IdP) is a service that authenticates users and sends signed assertions or tokens to the apps that trust it, enabling single sign-on.

What is an identity provider?

An identity provider holds user accounts or connects to the directory that does, checks credentials, applies sign-in policy such as MFA and device compliance, and then vouches for the user to other applications. The applications that trust the IdP are called service providers in SAML or relying parties in OpenID Connect. Because each app accepts the IdP's word instead of keeping its own password list, users sign in once and reach many apps. That is single sign-on (SSO). Common cloud IdPs include Microsoft Entra ID (formerly Azure Active Directory), Google Cloud Identity and Okta. On-premises, Active Directory Federation Services (AD FS) can fill the same role for Active Directory.

How a sign-in through an IdP works

A typical SAML web sign-in:

  1. The user opens a cloud app (the service provider).
  2. The app redirects the browser to the IdP.
  3. The IdP authenticates the user with a password, MFA and any device or location checks, or reuses a session the user already has. Reusing that session is what makes SSO feel automatic.
  4. The IdP sends a digitally signed assertion back to the app through the browser.
  5. The app verifies the signature with the IdP's certificate, reads the user's identity and group or role claims, and opens a session.

Protocols you will see

  • SAML (Security Assertion Markup Language): XML-based signed assertions, common for business web apps.
  • OpenID Connect (OIDC): an identity layer built on OAuth 2.0 that issues ID tokens in JSON format; common in modern web and mobile apps and behind "Sign in with Google" or "Sign in with Microsoft" buttons.
  • OAuth 2.0: grants an app limited access to resources on the user's behalf. It is an authorization protocol, not a sign-in protocol by itself, a frequent point of confusion.

Identity providers and identity synchronization

Many organizations keep users in on-premises Active Directory and use a cloud IdP for Microsoft 365 or Google Workspace. Microsoft Entra Connect synchronizes AD users and groups to Entra ID, and sign-in can use password hash synchronization, pass-through authentication or federation. Google Cloud Directory Sync does a similar job for Google environments. When sync breaks, a user may exist on-premises but not in the cloud, or the sign-in name (UPN) may not match. A synced account still needs the right license before cloud services such as email work.

Benefits and risks

  • Benefits: one place to enforce MFA and conditional access, fewer passwords to reuse or forget, central sign-in logs, and fast offboarding, since disabling one account cuts access to every connected app.
  • Risks: the IdP becomes a high-value target. A compromised IdP account, or an IdP outage, affects every connected app, so admin accounts need strong, preferably phishing-resistant MFA, and account recovery must be tightly controlled.

When SSO fails, isolate the layer: authentication at the IdP (password, MFA, policy block), the trust between IdP and app (certificates, URLs, clock), or authorization inside the app (role or group mapping, license).

Identity provider vs. related terms

  • Directory service (Active Directory, LDAP): stores accounts and groups. An IdP authenticates users and issues assertions, often backed by a directory.
  • SSO: the user experience of signing in once. The IdP is the component that provides it.
  • Federation: the trust relationship that lets an IdP's assertions be accepted by apps or other organizations.

Identity provider on the CompTIA A+ exam

Identity providers sit behind two Core 2 (220-1202) topics: objective 2.1, logical security, where SSO, SAML, directory services and identity and access management appear, and objective 1.11, setting up cloud productivity suites, where identity synchronization and licensing come up. If users sign in once and reach email, files and SaaS apps, think SSO through an IdP. If disabling one account must cut access everywhere, a central IdP is the reason that works. If a user can sign in to the portal but an app says access denied, check authorization or licensing, not the password. If a new on-premises user is missing from Microsoft 365, check directory synchronization.

Studying for CompTIA (Security)?

ExamWizardz turns the official objectives into a guided study plan — with practice tests, realistic PBQs, and a readiness score. Start free.

Start studying free

Related terms

Active Directory

Active Directory is a directory service developed by Microsoft that enables the management of identities, computers, and other resources within a network or domain.

federated identity

Federated identity is a system that allows users to securely access multiple applications and services using a single set of credentials across organizational boundaries.

Identity synchronization

The automated process of maintaining consistent user identity information across multiple systems, directories, and applications to ensure that user credentials, attributes, and access permissions remain synchronized in real-time or on a scheduled basis.

Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is a cloud-based identity and access management service that provides authentication and authorization for cloud and hybrid environments, enabling secure sign-on and resource access across Microsoft and third-party applications.

OAuth

OAuth is an open standard for authorization that allows users to grant limited access to their resources on one site, to another site, without sharing their credentials.

SSO

Single Sign-On (SSO) is an authentication method that allows users to securely access multiple applications and systems with a single set of login credentials.

← Back to the full CompTIA glossary