Identity as a Service (IDaaS)
Identity as a Service (IDaaS) is identity and access management delivered from the cloud as a subscription: the provider runs the directory, single sign-on, MFA, and user provisioning, and you consume them over standard protocols such as SAML, OpenID Connect, and SCIM instead of operating identity servers yourself.
IDaaS is a delivery model, not a separate discipline. The capabilities match on-premises IAM; what moves to the provider is patching, scaling, and availability, while configuration, access policy, and integration stay your responsibility. Most workforce identity platforms, such as Okta and Microsoft Entra ID, are IDaaS, and most CIAM platforms are delivered the same way for customer-facing apps. The trade-off is concentration: a single IDaaS tenant fronts every application, so its admin accounts and session tokens become the highest-value targets in the estate.
See also: what is IDaaS, what is workforce identity, workforce identity, SSO, IAM platforms compared
Related on Start with Identity
- GlossaryIdentity Federation
A trust relationship between identity providers and service providers that lets users authenticate once at their home IdP and access applications at the other p
- GlossaryIdentity Provider (IdP)
A system that authenticates users and issues assertions or tokens vouching for their identity to other applications. In federated single sign-on, the identity p
- GlossaryIGA
Identity Governance and Administration. The discipline of managing who has access to what, why, and for how long. Covers access certification, segregation of du
- CVEFortiCloud SSO SAML bypass on FortiOS, FortiProxy, FortiSwitchManager
A crafted SAML message bypasses FortiCloud SSO (CWE-347). Arctic Wolf saw malicious logins three days after disclosure. CISA added it to KEV on 16 December 2025
- CVEFortinet follow-on SSO SAML bypass after the 59718 patch
A second FortiCloud SSO SAML bypass that hits devices already patched for CVE-2025-59718 and CVE-2025-59719. Actively exploited. CISA guidance 28 January 2026.
- CVEFortiWeb FortiCloud SSO SAML bypass
The FortiWeb twin of CVE-2025-59718. A crafted SAML message bypasses FortiCloud SSO on FortiWeb. Same CWE-347 class, same December 2025 window, same 'patch or d