Directory, single sign-on and MFA: the identity provider job explained

What does the directory do?

A directory stores people, groups and attributes such as department and manager. Other tools read it: governance to know who someone reports to, detection to know what normal looks like. Many organizations still run Active Directory on premises alongside a cloud identity provider. JumpCloud also offers cloud LDAP and RADIUS for systems that expect a directory protocol.

How does single sign-on work?

Single sign-on lets a person sign in once and reach many applications. The application trusts the identity provider through a protocol: SAML, common in older enterprise applications, or OpenID Connect (OIDC), built on OAuth 2.0 and common in newer ones. Okta lists 8,000+ pre-built integrations, Microsoft's Entra app gallery lists thousands of applications, Google lists thousands of pre-integrated SAML and OIDC apps, and Ping lists 350+ connectors. Ping's pricing page also lists Kerberos, LDAP and a RADIUS gateway for older systems.

What makes MFA phishing-resistant?

MFA adds a second factor, but not every factor resists phishing: a code typed into a fake page can be replayed. Microsoft lists phishing-resistant methods including Windows Hello for Business, Platform Credential for macOS, passkeys, FIDO2 security keys and certificate-based authentication. Okta describes FastPass as passwordless and states it can meet FedRAMP High and NIST AAL3 requirements on properly configured devices. Google lists Titan Security Keys and passkeys.

How do access policies decide?

Policies decide when to allow, challenge or block a sign-in. Microsoft calls its policy engine Conditional Access, which needs Entra ID P1; risk-based policies need P2. Okta's Adaptive MFA uses context from devices, networks, locations and behavior. JumpCloud sells conditional access as an add-on.

Where does this job stop?

An identity provider can create accounts in connected applications over SCIM, but it does not decide whether access is still needed, find applications that were never connected, or protect admin credentials. Those are the next jobs. Silverfort adds MFA to systems that cannot redirect to an identity provider, such as command-line tools and OT, which is why it shows as Partial for this job on the job page.

What should you check when choosing?

• Which sign-in protocols your important applications support.
• Which MFA methods your people can use, and whether they resist phishing.
• Published minimums and caps: Okta's $1,500 annual minimum, Ping's 5,000-user minimum, and the 300-user maximum on JumpCloud Platform Essentials.
• What your productivity suite already includes: Microsoft lists Entra ID P1 as included in Microsoft 365 E3 and Business Premium.