A company's employees need access to a business partner's SaaS application. The partner does not want to manage passwords for the company's staff, and the company wants its own MFA requirements and leaver process to govern that access. Which design best meets both needs?
Select an answer to reveal the explanation.
Short Explanation
Federation is like a passport: the partner doesn't issue you its own ID, it trusts the country that issued yours. Your IdP checks the MFA and kills the account when someone leaves, and the partner just honours the assertion. The trap is anything that copies credentials or shares accounts across the trust boundary.
Full Explanation
Federated identity establishes trust between an identity provider and a relying party in a different organization. The company's IdP authenticates the employee, applies its own MFA and conditional access rules, and sends a signed SAML assertion or OpenID Connect token to the partner's SaaS application, which acts as the service provider. The partner stores no passwords, and when the company disables an employee in its directory, that person can no longer obtain assertions, so the leaver process is enforced automatically. Synchronizing password hashes into the partner's application spreads credential material into a system the company does not control, leaves the partner managing local accounts, and bypasses the company's MFA at sign-in. Shared team accounts destroy individual accountability and survive departures unless every password is rotated. Network access by VPN with source-address authentication confuses network location with identity; it gives broad access into the partner's network and still does not identify the individual user. Exam caveat: federation shifts authentication to the IdP, but the relying party still authorizes; the partner's application decides what an authenticated user may do based on attributes in the assertion. Operational check: confirm that assertions are signed and validated, that the partner rejects sign-ins not originating from the company IdP, and that disabling a test user blocks access on the next authentication.