Identity as a Service (IDaaS)

Businesses are increasingly opting for cloud-based solutions for easier management and better reliability, no matter where the user connects from. Even identity management tools have adopted such a model, called Identity as a Service, or IDaaS.

What is Identity as a Service?

Identity as a Service is where authentication and identity management services are delivered via a subscription model by a third party. Like other “as a service” application delivery methods (SaaS, etc.), IDaaS can be integrated into pre-existing services and applications via APIs or can operate as a standalone product to authenticate users.

IDaaS encompasses a wide range of identity services depending on the solution. These include:

• Single Sign On (SSO)
• Multi-Factor Authentication (MFA)
• User provisioning and lifecycle management
• Centralized policy management
• Real-time monitoring
• Risk-based authentication

The best IDaaS solutions will support most (and preferably all) of the above services and features.

Why IDaaS is important

Over the past decade, cybercriminals have gotten significantly better at cracking authentication platforms, including MFA. For many companies, staying one step ahead of attackers is impossible due to limited resources. IDaaS “outsources” authentication to a third party, who manages the organization’s identity service and frees IT departments of the growing number of identity and access management (IAM) tasks necessary to keep attackers out.

With IDaaS, you also gain the advantage of proactive rather than reactive responses to new threats. As new threats are discovered, everyone is protected immediately. And since your authentication process is in the cloud, your IDaaS provider will block most threats from ever accessing company resources in the first place.

How Identity as a Service works

To use IDaaS, you must purchase a subscription, which gives you access to your provider's configuration portal and/or APIs. Once integrated with your apps and services, you can provide services like a SSO, risk-based authentication, and other authentication processes through the cloud.

When a user logs into an application, the API sends the request to the IDaaS provider. The provider will take several steps, including additional verification, to positively identify the user. Once this occurs, a decision is made to approve or deny the login.

The decision to approve or deny is not solely based on the correct credentials: most IDaaS services also perform risk-based authentication, looking at a variety of signals to identify if a potentially malicious actor is trying to gain access. Users can be denied access, or asked for step-up authentication, if risk levels are detected to be too high.

Most IDaaS systems use a policy-based framework to determine access to specific resources, often providing access to only the resources necessary to complete the given task. For organizations adopting a zero trust framework, such an access strategy is important as it is one of the architecture’s key pillars.

What to look for in an IDaaS solution

• It should use modern authentication methods: Biometrics, cryptographic keys, and risk and context-based authentication provide much better security and certainty of identity. There shouldn’t be a need to use one-time passwords or magic links as primary authentication methods.
• It should be frictionless: Adoption skyrockets when you do something as simple as getting out of your user’s way. The technology exists today to make authentication seamless—which increases overall productivity.
• It should be scalable: The last thing you need is an authentication platform you end up outgrowing. Most IDaaS solutions are scalable because they are on the cloud.
• It should be adaptable: Some solutions are as easy as modifying a few lines of code in your SSO platform. Solutions that offer several ways to integrate their IDaaS offerings into your apps and services are preferable.
• It should be passwordless: Compromised credentials are the single biggest source of data breaches. With modern methods like hardware and software-based security keys, the best IDaaS solutions will use passwordless authentication.

‍