What is an identity provider (IdP)?

An identity provider (IdP) is a service that keeps your staff’s accounts in one place and checks who is signing in. It also sets which people may use each app connected to it.

What is an identity provider?

Okta’s developer documentation describes an identity provider as a service that creates and keeps identity information and then provides sign-in checks to your apps. Microsoft describes Microsoft Entra ID as an identity and access management service that runs in the cloud. It handles sign-in, applies policy, and protects users, devices and apps. Microsoft also notes that if you subscribe to Microsoft 365 or Azure, you already use Entra ID.

What does it handle?

An identity provider does four jobs.

1. It keeps the list of people. Okta’s Universal Directory stores users and the details recorded about them, and can pull that data from other directories and from HR apps.
2. It checks who is signing in. In Microsoft’s description of single sign-on, Entra ID verifies each user and confirms that identity to the app.
3. It sets who may use which app. In Okta, you manage each user’s access to apps and devices, and their groups, through their profile. In Entra ID, users open the apps assigned to them.
4. It passes the result to the app through a standard. The common ones are SAML 2.0 and OpenID Connect, two sets of rules that let an app accept the identity provider’s check instead of asking for its own password.

Using that check to open many apps after one sign-in is single sign-on (SSO).

What does it leave out?

Only apps built to accept SAML or OpenID Connect can take the identity provider’s check. For other apps, both vendors offer a separate feature that stores a username and password and types them into the app’s sign-in page. Microsoft calls it password-based SSO. Okta calls it Secure Web Authentication (SWA), which it describes as single sign-on for web apps that don’t support those standards. The app still checks its own password; the identity provider just enters it.

That feature reaches only people who have an account in the identity provider. So a short-term contractor or a vendor’s staff member you never added gets nothing from it. Shared accounts don’t fit the standards either, because those rules assume each person has their own login. Okta’s SWA settings include one where users share a single username and password that an admin sets. So a shared login goes through the fill-in feature, not through SAML.

Is having one enough?

An identity provider covers your staff list, the sign-in check, and sign-in to the apps that connect to it. Three things fall outside single sign-on. Apps that don’t connect need the fill-in feature. Shared logins remain, such as an app that allows only one admin account. And some people aren’t in the identity provider at all. Shared admin logins that remain when you use Okta or Microsoft Entra ID sorts out what to do with them.