Engineers sign in to the cloud management console, the monitoring platform and the CI/CD system with separate local accounts, each with its own password. Several accounts belonging to former staff are still active. What should the security team implement?

Console-based and administrative tool access is high-value access and belongs under centralized identity. Federating the cloud management console, monitoring platform and CI/CD system with the corporate identity provider through SSO means engineers authenticate once with their corporate identity, the IdP enforces multifactor authentication and conditional access, and disabling a person in the directory removes access to all three tools at once, addressing the orphaned accounts. Local accounts can then be removed, leaving only tightly controlled break-glass accounts. Synchronizing one password across separate local stores increases the impact of a single compromise while keeping three independent account lifecycles, so leavers are still missed. Monthly account exports emailed to security are a slow, manual detective control; they may find orphans weeks later but do not prevent them, and the lists themselves become sensitive data in mailboxes. Longer passwords and lockout make guessing harder but do nothing for former staff who already know their passwords, and they do not provide MFA. Exam caveat: this objective concerns access controls for local and remote administration in Domain 5; the outline explicitly adds SSO to that list in 2026. Operational check: confirm that each tool's local sign-in is disabled except for documented break-glass accounts, that the IdP requires MFA for these applications, and that disabling a test user blocks access to all three tools.