IT Glossary
An identity provider (IdP) authenticates users and issues trusted tokens to apps. Learn how an IdP works, IdP vs SP, and how Corma governs IdP access.
July 3, 2026
An identity provider (IdP) is a system that creates, stores, and manages digital identities and authenticates users on behalf of connected applications. When a user logs in, the IdP verifies their credentials and issues a trusted token (via SAML or OpenID Connect) to the service provider. Common identity providers include Microsoft Entra ID, Okta, Google Workspace, and JumpCloud.
An identity provider and a service provider play opposite roles. The IdP authenticates the user, holds the identities and credentials, and issues the trusted token. The service provider delivers the application, holds the protected resource, and consumes and trusts that token.
A company makes Microsoft Entra ID its IdP, so every SaaS login routes through it with MFA. The IdP becomes the control point: disable a user there and access drops everywhere connected. The catch is coverage. Apps not federated to the IdP, and apps bought without IT, sit outside that control. Mapping which apps actually trust the IdP is the first step to using it as a true single point of control.
The identity provider authenticates the user and issues a trusted token. The service provider is the application that consumes that token and grants access.
Yes, and many do (for example one for staff and another from an acquisition). Governing access consistently across multiple IdPs is a common challenge.
Only the apps federated to it. Non-federated and shadow apps stay outside IdP control until they are discovered and connected.
