# What Is IDaaS (Identity-as-a-Service)?

Source: https://startwithidentity.com/guides/fundamentals/what-is-idaas/
Last updated: 2026-06-23
License: content by Start with Identity. Cite the source URL.

---

IDaaS stands for Identity-as-a-Service: identity and access management delivered from the cloud as
a subscription. Instead of installing and running identity servers in your own data center, you use
a provider that handles authentication, single sign-on, multi-factor authentication, and user
provisioning for you. It is the cloud-delivery model of [IAM](https://startwithidentity.com/guides/fundamentals/what-is-iam/).

## What IDaaS includes

- **Authentication and SSO.** One login for many applications, using standards like
  [SAML](https://startwithidentity.com/standards/saml-2-0/) and [OpenID Connect](https://startwithidentity.com/standards/openid-connect/).
- **Multi-factor authentication.** Push, one-time codes, and phishing-resistant passkeys.
- **Lifecycle provisioning.** Creating, updating, and removing accounts across connected apps,
  usually via [SCIM](https://startwithidentity.com/standards/scim-2-0/).
- **Directory services.** A cloud directory of users and groups, or synchronization with an
  existing one such as Active Directory.
- **Access policies.** Conditional and risk-based rules that decide when to allow, challenge, or
  block access.

## How it differs from on-premises IAM

The capabilities are similar; the operating model is not. With on-premises IAM you own the servers,
the patching, the scaling, and the disaster recovery. With IDaaS the provider runs all of that, and
you consume identity through APIs and standard protocols. That shifts effort from infrastructure
maintenance to configuration and integration, and it scales elastically as you add users and apps.

## Workforce vs customer IDaaS

IDaaS comes in two flavors. **Workforce IDaaS** secures employees and contractors, emphasizing
governance, provisioning, and integration breadth; the leaders are Okta, Microsoft Entra, and Ping.
**Customer IDaaS**, usually called [CIAM](https://startwithidentity.com/guides/fundamentals/what-is-ciam/), secures external
users at much larger scale and prioritizes frictionless registration, consent, and privacy.

## When IDaaS is the right choice

IDaaS suits almost any organization that wants to avoid running identity infrastructure, needs to
connect cloud applications quickly, or wants strong security without a large identity operations
team. Very large enterprises with complex legacy estates often combine IDaaS with other components
into an [identity fabric](https://startwithidentity.com/guides/fundamentals/what-is-identity-fabric/) rather than relying on a
single platform. For a comparison of the leading platforms, see our analysis of the
[top IDaaS platforms](https://startwithidentity.com/articles/top-5-identity-as-a-service-platforms/) and
[workforce identity platforms](https://startwithidentity.com/articles/top-6-workforce-identity-platforms/).