Identity Providers and Their Role

5 minutes 5 Questions

An Identity Provider (IdP) is a trusted system or service responsible for creating, maintaining, and managing digital identities while providing authentication services to applications and resources. In the context of Microsoft Security, Compliance, and Identity, identity providers play a central and foundational role in modern security architectures. **What Identity Providers Do:** Identity providers authenticate users by verifying their credentials (such as usernames, passwords, biometrics, or multi-factor authentication tokens) and then issue security tokens that contain claims about the user's identity. These tokens are used by applications and services to authorize access without requiring each application to manage credentials independently. **Key Roles of Identity Providers:** 1. **Centralized Authentication:** IdPs serve as a single source of truth for identity verification, eliminating the need for multiple credential stores across different applications. 2. **Single Sign-On (SSO):** Users authenticate once with the IdP and gain access to multiple applications and services without re-entering credentials. 3. **Federation:** IdPs enable trust relationships between different organizations, allowing users from one organization to access resources in another through federated identity protocols like SAML, OAuth 2.0, and OpenID Connect. 4. **Security Enhancement:** By centralizing authentication, IdPs enable consistent enforcement of security policies, including multi-factor authentication (MFA), conditional access, and risk-based authentication. **Microsoft's Identity Provider - Azure Active Directory (Azure AD/Microsoft Entra ID):** Microsoft Entra ID (formerly Azure AD) is Microsoft's cloud-based identity provider. It manages identities for millions of organizations and supports authentication for Microsoft 365, Azure services, and thousands of third-party applications. Identity providers are essential to the Zero Trust security model, where the principle of 'never trust, always verify' requires every access request to be authenticated and authorized through a trusted IdP. This shift from traditional network-based perimeter security to identity-based security makes identity providers the new control plane for modern security infrastructure.

Identity Providers and Their Role – A Complete Guide for SC-900

Why Identity Providers Matter

In today's cloud-first world, organizations need a centralized and secure way to manage who can access their resources. Identity Providers (IdPs) are the backbone of modern authentication and authorization. Without an IdP, every application would need to maintain its own user database, manage its own passwords, and enforce its own security policies — leading to inconsistency, security gaps, and a poor user experience. Understanding Identity Providers is essential for the SC-900 exam because they form the foundation of how security, compliance, and identity work together in Microsoft's ecosystem.

What Is an Identity Provider?

An Identity Provider (IdP) is a service that creates, maintains, and manages identity information while providing authentication services to applications. Think of an IdP as a trusted authority that vouches for a user's identity. When a user tries to access an application, the application doesn't verify the user's credentials itself — instead, it delegates that responsibility to the IdP.

Common examples of Identity Providers include:
- Microsoft Entra ID (formerly Azure Active Directory) – Microsoft's cloud-based identity and access management service
- Active Directory Federation Services (AD FS) – An on-premises identity provider from Microsoft
- Google Identity – Google's identity platform
- Facebook Login, Apple ID – Social identity providers
- Okta, Ping Identity – Third-party identity providers

How Identity Providers Work

Identity Providers operate using a trust-based model. Here is the typical flow:

1. User Requests Access: A user attempts to access an application or resource (called a Service Provider or Relying Party).

2. Redirect to IdP: The application redirects the user to the configured Identity Provider for authentication.

3. Authentication: The IdP prompts the user for credentials (username/password, multifactor authentication, biometrics, etc.) and verifies the user's identity against its directory.

4. Token Issuance: Upon successful authentication, the IdP generates a security token (such as a SAML assertion, OAuth token, or OpenID Connect ID token) that contains claims about the user's identity and attributes.

5. Token Sent to Application: The token is sent back to the application. The application trusts the token because it trusts the IdP.

6. Access Granted: The application reads the claims in the token and grants or denies access based on the information provided.

This process relies on a trust relationship between the Identity Provider and the Service Provider. The Service Provider must be configured to trust tokens issued by the IdP, and the IdP must be configured to issue tokens for the Service Provider.

Key Concepts Related to Identity Providers

Federation: Federation is the process of establishing trust between two or more identity domains. When organizations federate, users in one domain can access resources in another domain without needing separate credentials. Federation relies on Identity Providers and standard protocols such as SAML 2.0, WS-Federation, and OpenID Connect (OIDC).

Single Sign-On (SSO): SSO is one of the primary benefits of using an IdP. Once a user authenticates with the Identity Provider, they can access multiple applications without re-entering credentials. The IdP maintains the session and issues tokens for each application the user accesses.

Claims-Based Identity: Tokens issued by IdPs contain claims — pieces of information about the user such as their name, email address, group memberships, and roles. Applications use these claims to make authorization decisions.

Authentication Protocols:
- SAML (Security Assertion Markup Language): An XML-based protocol commonly used for enterprise SSO
- OAuth 2.0: An authorization framework that allows third-party applications to obtain limited access to a service
- OpenID Connect (OIDC): An authentication layer built on top of OAuth 2.0, widely used for modern web and mobile applications

Microsoft Entra ID as an Identity Provider

For the SC-900 exam, Microsoft Entra ID is the primary Identity Provider you need to understand. Key points include:

- It is a cloud-based identity and access management service
- It supports SAML, OAuth 2.0, OpenID Connect, and WS-Federation protocols
- It provides SSO to thousands of pre-integrated SaaS applications (e.g., Microsoft 365, Salesforce, ServiceNow)
- It supports multifactor authentication (MFA) and Conditional Access policies
- It can act as an IdP for both internal users (employees) and external users (partners, customers) through Microsoft Entra External ID (B2B and B2C)
- It supports hybrid identity scenarios where on-premises Active Directory is synchronized with Entra ID using Microsoft Entra Connect

The Role of Identity Providers in Zero Trust

Identity Providers are central to the Zero Trust security model. In Zero Trust, identity is the primary security perimeter. The IdP:
- Verifies every user explicitly before granting access
- Enforces least-privilege access through token claims and Conditional Access
- Enables continuous evaluation of user risk and session health
- Integrates with threat intelligence to detect compromised identities

Common vs. Decentralized Identity

While traditional IdPs are centralized (the IdP stores and manages identities), the industry is also moving toward decentralized identity, where users control their own identity using standards like verifiable credentials. Microsoft supports this through Microsoft Entra Verified ID. For the SC-900 exam, know that decentralized identity shifts control from organizations to individuals while still relying on trust frameworks.

Exam Tips: Answering Questions on Identity Providers and Their Role

1. Know the definition: An Identity Provider is a service that authenticates users and issues security tokens. If a question asks what an IdP does, remember: it creates, stores, and manages digital identities and provides authentication services.

2. Understand federation: Exam questions may describe a scenario where two organizations need to share resources. The answer typically involves federation between their Identity Providers. Remember that federation establishes a trust relationship so users don't need separate accounts.

3. Distinguish authentication from authorization: The IdP handles authentication (verifying who you are). Authorization (what you can do) is typically handled by the application using claims from the token. Don't confuse the two.

4. Know the protocols: If a question mentions XML-based tokens or enterprise SSO, think SAML. If it mentions modern web/mobile apps, think OpenID Connect. If it's about delegated authorization (e.g., an app accessing resources on behalf of a user), think OAuth 2.0.

5. Microsoft Entra ID is the star: Most SC-900 questions about IdPs will center on Microsoft Entra ID. Know its capabilities: cloud-based, supports multiple protocols, provides SSO, supports MFA and Conditional Access, and works for both internal and external identities.

6. Look for SSO keywords: If a question describes a scenario where a user logs in once and accesses multiple applications, the answer relates to SSO enabled by an Identity Provider.

7. External identity scenarios: Questions about giving partners or customers access to your resources often point to Microsoft Entra External ID (B2B/B2C), which allows external IdPs (like Google or Facebook) to be used for authentication.

8. Trust relationships are key: Remember that the Service Provider must trust the Identity Provider. If a question asks about how an application verifies a user's identity, the answer involves the trust relationship with the IdP and the security token.

9. Hybrid identity: If a scenario involves both on-premises and cloud resources, think about Microsoft Entra Connect synchronizing on-premises AD with Entra ID, allowing a single identity to work across both environments.

10. Eliminate distractors: In multiple-choice questions, look out for answers that confuse IdP responsibilities with firewall or network security functions. An IdP deals with identity and authentication, not network-level security controls.

Summary

Identity Providers are foundational to modern security architecture. They centralize authentication, enable SSO, support federation across organizational boundaries, and are critical to implementing Zero Trust. For the SC-900 exam, focus on understanding what an IdP does, how Microsoft Entra ID functions as an IdP, the protocols involved (SAML, OAuth, OIDC), and how IdPs enable secure access for both internal and external users. Mastering these concepts will give you a strong foundation for answering exam questions on this topic confidently.
Test mode:
Start practice test

SC-900 - Identity Providers and Their Role Example Questions

Test your knowledge of Identity Providers and Their Role

Question 1

Which statement accurately describes the demarcation of responsibility between an Identity Provider and a connected service provider?

Correct Answer: The Identity Provider authenticates the organizational principal and issues cryptographic claims, while the service provider evaluates those structured claims to authorize access.

The correct answer is right because modern identity architecture separates authentication, handled centrally by an Identity Provider issuing tokens, from authorization, managed locally by the service provider based on those claims.

The other options are incorrect because identity providers do not maintain exhaustive internal application permission matrices, connected service providers do not delegate granular permission evaluation to the identity provider, and service providers do not establish primary global directory session profiles.

The key concept tested is the architectural separation of authentication and authorization in identity federation.

Question 2

What is a primary security advantage of delegating user authentication to an Identity Provider rather than verifying credentials locally?

Correct Answer: It isolates sensitive credential processing so applications only receive secure tokens affirming successful sign-in.

Delegating authentication to an Identity Provider is highly secure because it centralizes credential handling, ensuring that applications never see or store the actual password but instead rely on a secure token proving identity.
Replicating credential hashes increases the attack surface instead of securing it. Allowing individual applications to manage multifactor requirements defeats the purpose of centralized policy management. Transmitting encrypted credentials directly to workloads violates the strict principle of keeping sensitive credentials isolated from the application tier entirely.
The key concept tested is the security architecture of modern centralized authentication.

Question 3

How does a modern Identity Provider signify successful user authentication to external relying parties?

Correct Answer: By generating and transmitting a signed security token verifying the identity.

A modern Identity Provider issues a digitally signed security token to the relying party to securely assert that a user has been successfully authenticated and granted access.
Transferring user credentials directly is highly insecure because relying parties should never see actual passwords. Establishing a continuous mapped connection contradicts the stateless design of modern federation protocols like OAuth or SAML. Synchronizing session logs is merely a background auditing function and cannot serve as a secure, real-time access mechanism.
The key concept tested is the function of security tokens in modern authentication.

More Identity Providers and Their Role questions
42 questions (total)
Start 42 question test

Other Concepts of Security, Compliance, and Identity concepts

Authentication Concepts and MethodsAuthorization Concepts and Access ControlDefense-in-Depth StrategyDirectory Services and Active DirectoryEncryption and Hashing FundamentalsFederation ConceptsGovernance, Risk, and Compliance (GRC) ConceptsIdentity as the Primary Security PerimeterShared Responsibility ModelZero Trust Model and Guiding Principles
All Concepts of Security, Compliance, and Identity questions · SC-900 practice test