Single sign-on lets a user authenticate once with a central identity provider and then access many applications without logging in again. The IdP issues a signed token or assertion that each application trusts, so credentials are entered in one hardened place rather than scattered across every app. This shrinks the password attack surface and centralizes policy like MFA.

Federation is a trust relationship between an identity provider and one or more service providers (or between two IdPs across organizations) so that identities authenticated in one domain are accepted in another. It is what lets an employee use their corporate identity to sign into an external SaaS app. Federation is established by exchanging metadata, signing certificates and agreed claim mappings.

In SP-initiated SSO the user starts at the application, which redirects them to the identity provider to authenticate — the safer, more common pattern. In IdP-initiated SSO the user starts at the IdP portal and launches into the app with an unsolicited assertion, which is convenient but historically prone to replay and login-CSRF issues. The labs show why SP-initiated is preferred.

JIT provisioning creates or updates a user account in the application the first time they sign in via SSO, using attributes from the SAML assertion or OIDC token. It avoids pre-provisioning every possible user, but you must map attributes carefully and pair it with de-provisioning (usually via SCIM), or leavers linger. The advanced SSO labs cover attribute mapping and its edge cases.

Because SSO funnels authentication through one identity provider, that provider becomes the ideal place to enforce conditional access — evaluating device, location, risk and application sensitivity before issuing the token. This is how you layer MFA, device compliance and risk-based blocking across every federated app at once. The conditional access lab builds a coherent policy set.

Hybrid identity keeps on-premises Active Directory as a source of truth while synchronizing or federating with a cloud IdP like Entra ID, so users have one identity across both worlds. The bridge — directory sync, password hash sync, pass-through authentication or federation — is a high-value target, because compromising it can mint cloud tokens. The hybrid bridge lab hardens that route.

Key risks include weak or missing assertion signing and validation, overly broad redirect URIs, session fixation, replay of IdP-initiated assertions, and unclear single logout so sessions outlive their welcome. Correct signature validation, exact redirect matching, short token lifetimes and proper front- and back-channel logout mitigate most of them — themes the federation and session labs reinforce.