What software manages SSO and MFA across cloud applications?

The software that manages Single Sign-On (SSO) and Multi-Factor Authentication (MFA) across cloud applications is generally referred to as an **Identity Provider (IdP)** or an **Identity and Access Management (IAM) solution**.

These solutions act as a central authority for user identities and authentication, allowing users to log in once and access multiple cloud applications without re-entering credentials, while also enforcing strong MFA policies.

Here are the main categories and leading examples:

1. **Cloud Identity Providers (IdP) / Identity as a Service (IDaaS):**

These are purpose-built cloud services designed to be the primary identity store and authentication service for your organization, especially for cloud applications.

* **Microsoft Entra ID (formerly Azure Active Directory):** A widely used cloud-based identity and access management service that provides SSO, MFA, and conditional access for thousands of SaaS applications, Microsoft 365, and custom applications.

* **Okta:** A leading independent IdP that offers a comprehensive suite of identity services, including SSO, Adaptive MFA, Universal Directory, Lifecycle Management, and API Access Management for a vast ecosystem of cloud applications.

* **Ping Identity:** Offers a suite of identity solutions, including PingOne (IDaaS) and PingFederate (on-prem/hybrid), providing SSO, MFA, and API security.

* **OneLogin:** Another popular IDaaS provider offering SSO, MFA, user provisioning, and directory services.

* **Google Cloud Identity:** Provides identity and access management for Google Workspace and other cloud applications, including SSO and MFA capabilities.

2. **Hybrid IAM Solutions:**

These solutions bridge on-premises identity stores (like Active Directory) with cloud applications, often using agents or connectors. Many of the IdP/IDaaS providers listed above also offer strong hybrid capabilities.

* **Microsoft Entra ID Connect:** Synchronizes on-premises Active Directory with Microsoft Entra ID, enabling SSO and MFA for cloud apps using existing on-prem identities.

* **Okta, Ping Identity, OneLogin:** All offer agents or connectors to integrate with on-premises directories.

3. **MFA-Specific Solutions (often integrated with an IdP):**

While most IdPs have built-in MFA, some solutions specialize in advanced MFA and are often integrated with an existing IdP or directory service.

* **Duo Security (Cisco Duo):** Primarily an MFA provider that integrates seamlessly with various IdPs, VPNs, and cloud applications to add a strong second factor to logins.

**Key Features of these solutions include:**

* **Centralized User Directory:** A single source of truth for user identities.

* **SSO (Single Sign-On):** Using protocols like SAML, OAuth 2.0, and OpenID Connect to allow users to log in once.

* **MFA (Multi-Factor Authentication):** Support for various factors like push notifications, TOTP, biometrics, security keys, etc.

* **Conditional Access Policies:** Defining rules based on user, device, location, and risk level to grant or deny access, or require stronger MFA.

* **User Provisioning/Deprovisioning:** Automatically creating, updating, and deleting user accounts in connected cloud applications.

* **Access Governance:** Auditing and reporting on who has access to what.

* **API Integration:** Allowing custom applications to leverage the IdP for authentication and authorization.

When choosing a solution, organizations consider factors like their existing infrastructure (on-prem AD?), the number and type of cloud applications they use, security requirements, scalability, and budget.