--- title: "Identity Federation — Identity Glossary | IDSync" description: "Identity federation is the practice of letting one organization's identity provider authenticate users into another organization's applications — enabling…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Identity Federation", "item": "https://idsync.com/glossary/federation" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/federation", "name": "Identity Federation", "alternateName": [ "Federation", "B2B SSO", "Federated Identity" ], "description": "Identity federation is the practice of letting one organization's identity provider authenticate users into another organization's applications — enabling B2B SSO, customer SSO into partner apps, and cross-domain single sign-on without duplicating accounts.", "url": "https://idsync.com/glossary/federation", "inDefinedTermSet": "https://idsync.com/glossary" } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Identity Federation Architecture # Identity Federation Identity federation is the practice of letting one organization's identity provider authenticate users into another organization's applications — enabling B2B SSO, customer SSO into partner apps, and cross-domain single sign-on without duplicating accounts. Last reviewed 3 months ago Key points - Federation is what makes 'Sign in with your work account' possible across organizations. - Protocols: SAML 2.0 (dominant for enterprise federation), OIDC (modern web/mobile), WS-Federation (legacy Microsoft), SCIM (for user lifecycle alongside SSO). - B2B SSO is the most common modern use case — your customer's IT team configures their IdP to sign their employees into your SaaS app. - Federated trust is one-way: the SP trusts the IdP's signature, not the other way around. - Just-in-time (JIT) provisioning creates the user account on first federated sign-in; SCIM keeps it in sync afterward. ## What is identity federation? Identity federation is the trust pattern that lets users authenticate with their **home organization's IdP** (Okta, Entra ID, Google Workspace) to access **another organization's applications** — without that second organization having to manage their passwords, MFA, or lifecycle. The IdP signs an assertion ("yes, alice@acme.com authenticated with MFA at 09:14 from a managed device"), the receiving application validates the signature against a pre-shared trust (SAML metadata or OIDC discovery), and the user gets in. Federation is what makes multi-organization SSO possible at internet scale. ## Common federation patterns - **Workforce → SaaS** — Acme's employees sign into Salesforce, Slack, GitHub using Acme's Okta. Each SaaS app is configured as a Service Provider in Okta. - **B2B SSO** — Acme is a SaaS vendor; their customer "Globex" wants their employees to sign in with Globex's IdP. Acme implements multi-tenant federation, often via WorkOS, Auth0, Frontegg, or Stytch. - **Cross-cloud federation** — AWS, Azure, and GCP all support OIDC federation so workloads (CI runners, Kubernetes pods) can assume roles without long-lived secrets. - **Government / supply chain** — InCommon (US higher ed), EduGAIN (academia), FICAM (US federal), eIDAS (EU). ## Protocols | Protocol | Where it dominates | | --- | --- | | SAML 2.0 | Enterprise SaaS, government, legacy on-prem apps | | OIDC | Modern web/mobile apps, B2C, workload federation | | WS-Federation | Legacy Microsoft (SharePoint on-prem, ADFS) | | OAuth 2.0 (alone) | Authorization, not authentication — but often paired | ## When buyers care - **B2B SaaS revenue gate** — every enterprise customer will require SAML/OIDC SSO and most will require SCIM. - **M&A integration** — federating identities across the parent and acquired company is faster than directory migration. - **Contractor / partner access** — federate instead of creating guest accounts. - **Reducing the credential blast radius** — no separate password for the partner app means no extra phishing target. ## Common misconceptions - **"Federation = SSO."** SSO is the user experience; federation is the trust model that makes cross-org SSO possible. - **"Federation provisions users."** It usually doesn't on its own — federation handles authentication; SCIM (or JIT) handles provisioning. - **"More federation = more secure."** Only if the upstream IdPs are well-secured. Federating with a partner whose IdP has no MFA imports their risk. ## Editorial note When buying a B2B SaaS product, "SSO + SCIM with your IdP" should be table stakes, not an enterprise add-on. The "[SSO tax](https://sso.tax)" debate exists because too many vendors paywall security. IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Vendor categories [sso](/directory/category/sso)[ciam](/directory/category/ciam)[b2b sso](/directory/category/b2b-sso) ### Related terms [sso](/glossary/sso)[saml](/glossary/saml)[openid connect](/glossary/openid-connect)[scim](/glossary/scim)[identity provider](/glossary/identity-provider) ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) ### Explore tools for this topic Browse vetted vendors in the sso category. [Explore tools](/directory/category/sso) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.