Start with the problem each control solves
More proof? MFA. Fewer sign-ins? SSO. Cross-domain trust? Federation. No password? Passwordless.
MFA: combine independent factor categories
Multifactor authentication requires two or more different factor categories, such as something you know, have or are. A password plus a PIN is not MFA because both are knowledge factors. A password plus a hardware security key combines knowledge and possession.
Knowledge
Password, PIN or passphrase. Easy to deploy, but susceptible to guessing, reuse and phishing.
Possession
Hardware key, smart card, authenticator device or device-bound cryptographic credential.
Inherence
Fingerprint, face or another biometric characteristic used to verify the person.
Context is not automatically a factor
Location, device health and risk can strengthen adaptive policy, but exam questions may distinguish contextual signals from classic factor categories.
MFA reduces risk, but factor choice matters. Push fatigue, intercepted codes and social engineering can weaken some methods. Prefer authenticators that bind the response to the legitimate service when phishing resistance is required.
SSO: one sign-in, multiple approved applications
Single sign-on lets a user authenticate once and access multiple connected services without entering credentials for each one. The identity provider maintains or represents the authenticated session; each application still makes authorization decisions.
SSO improves usability and can centralize policy, logging and account termination. It also concentrates impact: if the central session is stolen or the identity provider is unavailable, many applications may be affected. Protect the identity provider with strong authentication, short and risk-aware sessions, monitoring and recovery procedures.
SSO reduces authentication prompts. It does not automatically add another factor, grant authorization or create trust between unrelated organizations.
Federation: trust identity from another security domain
Federation allows a relying application to accept identity information issued by a trusted identity provider. The application validates the signature, issuer, audience, time limits and other conditions before using claims for authorization.
Federation does not mean every claim should be trusted. Map only required attributes, validate tokens correctly and keep authorization at the relying service least-privileged.
Passwordless: remove the shared memorized secret
Passwordless authentication replaces the password with another method, often a device-bound public-key credential unlocked by a local biometric or PIN. The server stores a public key rather than a reusable password verifier, and the private key remains with the authenticator.
Not every passwordless method provides the same assurance. Magic links and one-time codes remove password entry but can remain vulnerable to mailbox compromise, interception or phishing. FIDO-based credentials are designed to bind authentication to the correct service origin.
With a well-designed passkey flow, the fingerprint or face usually unlocks the credential locally. The biometric template is not sent to every website as the authentication secret.
Worked scenario: employees and a partner use one cloud portal
Requirement: Employees should sign in once to approved cloud tools, a partner company should use its own accounts, and high-risk access should resist phishing.
- Centralize employee identity: use the company identity provider as the authentication authority.
- Require strong proof: use device-bound, phishing-resistant authentication for sensitive access.
- Provide SSO: let the verified company session reach approved applications without new password prompts.
- Federate the partner: configure explicit trust with the partner identity provider instead of creating shared accounts.
- Limit claims and access: accept only necessary identity attributes and map the partner to a restricted role.
- Monitor the trust path: log issuer, subject, application, authorization result, device and session risk.
Passwordless authentication and MFA strengthen proof. SSO improves the employee journey. Federation connects the partner domain. Application roles still enforce least privilege.
Practice checks with explanations
A user signs in once and opens three company applications without new prompts. What is the clearest control?
SSO. The clue is one authenticated session reused across connected services.
A supplier uses its own corporate identity to access a restricted customer portal. What enables the trust?
Federation. Separate identity domains exchange and validate trusted identity information.
A site replaces passwords with device-bound public-key credentials. What changed?
Passwordless authentication. The user no longer presents a memorized shared secret to the service.
Common Security+ exam mistakes
- Calling two passwords or a password plus PIN multifactor authentication.
- Assuming SSO automatically provides MFA or authorization.
- Calling OAuth 2.0 an authentication protocol without OpenID Connect.
- Assuming federation requires copying partner passwords into the local directory.
- Calling every emailed code phishing resistant because it is passwordless.
- Ignoring token issuer, audience, signature and expiration validation.
- Granting broad application access because identity verification succeeded.
Frequently asked questions
Does SSO provide multifactor authentication?
Not by itself. SSO reduces repeated sign-ins by reusing one authenticated session. The identity provider can require MFA during that sign-in, but SSO and MFA solve different problems.
Is federation the same as SSO?
No. Federation creates trust between separate identity domains. SSO describes the user experience of signing in once and accessing multiple services. Federation can enable SSO across organizations, but either concept can be discussed independently.
Does passwordless always mean phishing resistant?
No. Passwordless removes the memorized password, but resistance depends on the authenticator and protocol. A device-bound FIDO credential is designed to resist credential phishing, while an emailed one-time code can still be intercepted or socially engineered.
What is an identity provider?
An identity provider authenticates a subject and issues an assertion or token that a relying application can validate. The application then applies its own authorization rules to the verified identity and claims.
Can one solution use MFA, SSO, federation and passwordless together?
Yes. A workforce can use a passwordless authenticator with a second factor or contextual control, sign in once at an identity provider, and use federation to reach trusted cloud applications.
Official references
Use the NIST SP 800-63B authentication guidance, the OpenID Foundation explanation of OpenID Connect and the official CompTIA Security+ page to confirm current terminology and exam scope.