Cloud SSO is not sufficient: What else do you need?

Cloud-based IAM/IAG initially succeeded through Cloud Single Sign-On (SSO), enabling users to reach cloud services, on-premises web applications, and even partner applications via a portal. Authentication commonly relies on SAML or OAuth, often paired with OpenID Connect, as core identity federation standards. However, SSO alone is necessary but no longer sufficient. Pressure for higher efficiency and lower costs is pushing cloud identity services to expand beyond login to full Identity and Access Management (IAM) and Identity and Access Governance (IAG) capabilities.

Two forward paths emerge. One is cloud-based IAM/IAG delivered as a service that adds Identity Provisioning and Access Governance, functioning either as a strong integration layer with traditional on-premises IAM/IAG or eventually as its replacement. The other is a broader Identity-as-a-Service (IDaaS) model that combines identity federation, self-service registration, directory services, and access management, and is positioned as especially effective for managing non-employee populations (“externals”) such as partners, vendors, contractors, and clients.

In practice, cloud IAM/IAG must become an integral part of the organization’s access management and governance portfolio, supporting both cloud and on-premises apps with full functionality. A common deployment model has employees and contractors accessing datacenter applications directly or via portals while also reaching cloud services, with partners and other externals coming into datacenter apps through the cloud-based system, which can also connect them to additional cloud services.

Because convergence between these approaches may come later, the recommended strategy is to choose one direction now based on current needs. Delaying action risks years of costly catch-up and potential future organizational damage.

• Cloud Single Sign-On allows access to cloud services, on-premises web applications, and partner web applications through a portal.
• Login for cloud SSO is provided via SAML or via OAuth, often under another service such as OpenID Connect.
• Cloud-based IAM must extend beyond username/password logins to cover access management and access governance needs.
• Two future options are identified: cloud IAM/IAG with provisioning and governance, or an IDaaS combination of federation, self-service registration, directory services, and access management.
• Cloud IAM/IAG can integrate with traditional on-premises IAM/IAG or serve as a direct replacement.
• IDaaS is positioned as the better approach for integrating non-employee users such as partners, vendors, contractors, and clients.
• Employees and contractors can access datacenter resources directly or through web portals while also reaching cloud services.
• Clients, vendors, and partners can reach datacenter applications via the cloud-based identity system.
• Research cited indicates many IAM/IAG services and suites are wholly or partially cloud-based.
• Benefits attributed to the trend include more efficient IAM and less expensive IAM.

• “This is good. This is necessary. But this is not sufficient.”
• “Demands for greater efficiency and lower costs means that the cloud-based services must do more.”
• “Beyond providing username/password logins for other cloud-based services, Cloud IAM needed to become an integral part of the entire Access Management and Access Governance portfolio for the organization.”
• “Full functionality for both on-premise and cloud-based services and apps is a necessity for today’s cloud-based identity services.”
• “While the two may converge, we recommend you choose one or the other now – based on your current needs – as any convergence will be accompanied by a direct path from these solutions.”
• “Those that do not begin now to move in these directions may be doomed to playing ‘catch up’ for many years to come.”
• “Failure to do so could seriously damage your organization in the future.”
• “But over time we’ve discovered that more was needed.”