Identity provider (IdP)
An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta. Cyber Essentials Plus calls this an authentication service and checks MFA once for each one. Its administrators and users need MFA under A7.16 and A7.17.
- Term
- Identity provider
- Also known as
- IdP, Identity platform, Authentication service
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.16AUTO-FAILA7.17AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term identity provider mean in Cyber Essentials?
An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
How does identity provider apply to Cyber Essentials?
In plain terms
An identity provider works like a passport office. It checks who you are once, issues something other places trust, and those places let you in without checking you again from scratch. When you click "Sign in with Microsoft" or "Sign in with Google" on a work app, the identity provider is doing the checking. It sits behind single sign-on.
What Cyber Essentials asks
The scheme does not use the term, but the identity provider is itself a cloud service that stores and processes your organisation's data, so it belongs on your A2.9 list. Because it controls access to everything behind it, its accounts matter most:
- MFA must be applied to all administrators (A7.16) and all users (A7.17) of your cloud services. A No to either is an automatic fail.
- Cloud service administration must be done with separate accounts (A7.6).
- Leavers must have their accounts deleted or disabled (A7.3). Disabling a leaver at the identity provider cuts off every app that relies on it.
The Cyber Essentials Plus test specification says: "Where multiple cloud services share an authentication service this test only needs to be performed once for each authentication service." Test case 4 then checks that users and administrators are prompted for MFA.
What an assessor looks for
A clear picture of which cloud services sign in through the identity provider and which have their own separate logins. Services outside the identity provider need MFA checked on their own.
See CE Plus test 4 and the Google Workspace setup guide. Related: single sign-on, conditional access, global administrator.
Related terms
- Single sign-on (SSO)Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
- Conditional accessConditional access is a set of rules in a cloud sign-in system that decides who can sign in, from where and on what device, and when to ask for extra checks such as MFA.
- Global administratorA global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
- Multi-factor authentication (MFA)Multi-factor authentication (MFA) is a method of authenticating a user which uses two or more verification factors.
Frequently asked questions
An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
In the 2026 Danzell question set, identity provider comes up at A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Identity provider relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.