Notifications
Clear all
Topic starter
12/06/2026 1:01 am
TL;DR: Identity providers centralize authentication, authorization, and single sign-on across users, devices, and services, while SAML and OAuth move identity claims between systems, according to Zluri. The governance gap is not login convenience but whether access decisions, roles, and third-party trust remain tightly scoped as estates scale.
NHIMG editorial — based on content published by Zluri: Access Management Identity Providers, What They Are and How They Work
By the numbers:
- 86% of users find creating new accounts frustrating, with 77% preferring social login or similar solutions.
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job.
Questions worth separating out
Q: How should organisations govern access through identity providers without overcentralising risk?
A: Treat the identity provider as the trust broker, not the final authority.
Q: Why do identity providers still create security risk in mature IAM programmes?
A: Because they centralize decision-making without automatically correcting poor entitlement design.
Q: What breaks when SSO is treated as a complete access control strategy?
A: Teams often stop at successful login and ignore what happens after the assertion or token is issued.
Practitioner guidance
- Separate authentication from authorization decisions Document which controls live in the IdP, which live in the target application, and which depend on token or assertion content.
- Tie IdP events to lifecycle controls Connect joiner-mover-leaver processing, access reviews, and deprovisioning to identity provider changes so account status and entitlement status move together.
- Audit federation scopes and claim mappings Review the attributes, roles, and scopes that travel through the IdP into downstream services, then remove claims that are broader than the receiving system actually needs.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step explanations of SAML, OAuth, and assertion exchange for practitioners implementing federated access.
- Examples of traditional, SaaS-based, and social identity providers in real deployment contexts.
- Operational detail on provisioning, deprovisioning, and access review workflows that sit around an IdP.
- Practical benefits and risks of identity providers for teams comparing centralized login architectures.
👉 Read Zluri's guide to identity providers and access control →
Identity providers and access control: are your controls keeping up?
Explore further
12/06/2026 10:38 am
Identity providers solve access distribution, not access discipline. Centralising login improves consistency, but it does not by itself constrain what the connected estate can do with the resulting session. The governance problem shifts from authentication success to entitlement quality, federation trust, and lifecycle enforcement across downstream systems. Practitioners should treat the IdP as a control point, not a control solution.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
A question worth separating out:
Q: Who is accountable when identity provider trust is mis-scoped across applications?
A: The identity team owns the control design, application owners own enforcement in their systems, and security governance owns review of the end-to-end trust boundary. Accountability fails when organisations assume the IdP alone is responsible for every access decision it helps initiate.
👉 Read our full editorial: Identity providers and access control: where IAM still breaks
