County employees should sign in once to reach a state benefits portal without separate local passwords on that portal. Which approach best describes this design?

County employees reaching a state benefits portal should authenticate once through a trusted identity provider rather than maintaining a separate local password on that portal. Federation and single sign-on using SAML (or comparable federation protocols) let the county IdP assert the user's identity to the relying party portal, so authentication happens at the trusted desk and the portal consumes a signed assertion instead of storing yet another password database. That design reduces password sprawl, centralizes MFA and disablement for municipal staff, and matches how inter-agency portals commonly integrate.

Storing every portal password in a shared spreadsheet concentrates secrets in a high-value, weakly controlled file and destroys individual accountability. Disabling authentication on the benefits portal for convenience exposes citizen and employee benefits data to anyone who can reach the site. Forcing a new unique portal password that never syncs with county identity recreates password-fatigue risk and leaves termination lag when county accounts are disabled but portal locals remain.

Exam caveat: federation trusts the IdP—compromise or misconfiguration of federation metadata, certificates, or assertion validation can become a systemic SSO risk. SAML describes the assertion exchange; it does not by itself authorize fine-grained app permissions inside the portal.

Operational check: validate SAML trust (entity IDs, certificates, ACS URLs) between county IdP and the state portal, confirm MFA is enforced at the IdP, and test that disabling a county account immediately blocks portal access without leftover local portal credentials.