Identity as a Service (IDaaS)
Identity as a Service (IDaaS) is identity and access management delivered from the cloud as a subscription: the provider runs the directory, single sign-on, MFA, and user provisioning, and you consume them over standard protocols such as SAML, OpenID Connect, and SCIM instead of operating identity servers yourself.
IDaaS is a delivery model, not a separate discipline. The capabilities match on-premises IAM; what moves to the provider is patching, scaling, and availability, while configuration, access policy, and integration stay your responsibility. Most workforce identity platforms, such as Okta and Microsoft Entra ID, are IDaaS, and most CIAM platforms are delivered the same way for customer-facing apps. The trade-off is concentration: a single IDaaS tenant fronts every application, so its admin accounts and session tokens become the highest-value targets in the estate.
See also: what is IDaaS, what is workforce identity, workforce identity, SSO, IAM platforms compared
Related on Start with Identity
- GlossaryIdentity Federation
Identity federation is a trust arrangement in which one party, the [identity provider](/glossary/identity-provider/), authenticates a user and another party, th
- GlossaryIdentity Provider (IdP)
A system that authenticates users and issues assertions or tokens vouching for their identity to other applications. In federated single sign-on, the identity p
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet administrative FortiCloud SSO authentication bypass across accounts
An attacker with their own FortiCloud account and registered device could log in as admin to other customers' Fortinet devices with FortiCloud SSO enabled. CWE-