What is federation?
Federation is a formalised trust relationship between systems: one party, the identity provider (IdP), is responsible for confirming who the user is, and the connected services (service providers) trust its word. When you sign in to a cloud service with your work account, the service sends you to the identity provider, which verifies the login and sends a signed token back. The service never sees your password, only the proof.
The result: one identity, one password, one MFA setup across systems that otherwise have nothing to do with each other.
Federation vs. SSO
Single sign-on is the experience: log in once, get access to everything. Federation is the mechanism behind it when SSO has to work across organisational boundaries: between your company and a cloud vendor, or between two companies. Within a single environment, SSO can be achieved without federation; across domains and ownership, it requires the federated trust relationships.
The classic real-world case is B2B collaboration: an external consultant is invited as a guest in your Teams and signs in with their own work account. You never create a password for them. You trust the consultant's identity provider. If the consultant leaves their firm and the account is closed there, their access to your environment is automatically revoked too.
SAML and OpenID Connect
Two standards dominate:
- SAML 2.0: the older, XML-based standard, still widespread in enterprise systems and public-sector solutions.
- OpenID Connect (OIDC): the modern alternative, built on top of OAuth 2.0, which handles the authorisation itself. OIDC is the standard in new applications and apps.
In the everyday life of a Danish SMB, Microsoft Entra ID is typically the identity provider that speaks both languages: employees' Microsoft accounts become the key to the finance system, the HR platform, the CRM and the rest of the cloud portfolio.
The gain and the responsibility
Federation moves security to where it can be managed: central MFA and conditional access policies apply to all services at once, offboarding becomes one click instead of a hunt through 30 systems, and password reuse across services disappears. But it also makes the identity provider the crown jewel: if it is compromised, the attacker has the key to everything. That is why federation is inseparable from hardening the identity platform, zero trust principles and monitoring of logins.
How MI Support IT can help
We design and operate federated identities with Entra ID at the centre: SSO to your cloud services, secure B2B guest access, central MFA and conditional access, and a hardened identity platform as part of your IT security and Microsoft 365 environment. Contact us if your logins still live in 30 different systems.