Security+ — Part 8: SSO, Privileged Access & Identity Lifecycle
Welcome Back!
Identity is the new perimeter. In a world where users work remotely, applications live in the cloud, and the traditional network boundary no longer means what it used to, controlling who has access to what — and for how long — is one of the most critical things a security team manages. SSO, PIM, and a clean identity lifecycle are how that gets done.
This is Part 8 of the Security+ series. Full notes on GitHub.
Single Sign-On (SSO)
SSO lets users authenticate once and access multiple systems without logging in again for each service.
Benefits
- User convenience — fewer logins reduce password fatigue and the temptation to reuse passwords
- Centralized control — administrators manage access from one place
- Reduced attack surface — fewer credentials in circulation means fewer phishing targets
How It Works
- Federated identity — trust relationships between systems using identity providers (SAML, OAuth, OpenID Connect)
- Token-based authentication — a successful login generates a token that’s accepted across connected services
Risks
- Single point of failure — if the SSO system goes down, access to all connected services is blocked
- Token hijacking — tokens need to be handled securely; a stolen token grants access to everything it covers
MFA on top of SSO is the standard approach — SSO for convenience, MFA to ensure the authentication itself is strong.
Privileged Identity Management (PIM)
PIM manages elevated access — admin and root accounts — across systems and applications. Privileged accounts are high-value targets because whoever controls them controls the environment.
Features
- Just-in-Time (JIT) access — temporary privilege elevation only when needed, automatically revoked after
- Approval workflows — require sign-off before elevated roles are granted
- Session recording — every privileged action is logged and recorded for audit
PIM Benefits
- Minimized attack window — reduces the time any account holds dangerous permissions
- Auditability — supports compliance requirements and forensic investigations
- Separation of duties — enforces role-based controls even at the admin level
Identity Lifecycle: Onboarding & Offboarding
Onboarding
A new user joining the organization needs access provisioned quickly and correctly — the wrong permissions at onboarding create risk that persists for years.
- Identity proofing — verify the user is who they say they are
- Automated provisioning — integrate HR systems via SCIM to reduce manual errors
- Role-based access control — assign permissions based on job function, not individual preference
- MFA enforcement — require multi-factor at first login, no exceptions
Offboarding
When someone leaves, access removal needs to happen immediately — not eventually.
- Account disablement or deletion — remove access the moment employment ends
- Session and token revocation — ensure any active sessions are terminated
- Device recovery or wipe — retrieve corporate hardware or remotely wipe it
- Access removal — SaaS platforms, VPN, cloud services — all of it
- Log archiving — retain access logs for compliance and future investigation
The offboarding step is where organizations frequently fail. A former employee with active credentials is a live threat.
Summary
| Area | Key Focus | Tools & Concepts |
|---|---|---|
| SSO | Centralized authentication | SAML, OAuth2, OpenID Connect |
| PIM | Managed elevated privileges | JIT access, session recording, approval workflows |
| Identity Lifecycle | Provisioning and deprovisioning | SCIM, RBAC, MFA, HRIS integration, token revocation |
These IAM concepts connect directly to Zero Trust — if you haven’t read Part 2 on Zero Trust architecture, the two topics reinforce each other. Identity verification and least privilege access are core ZTA components.
That wraps up the Security+ series. The full study guide is on GitHub if you want to go deeper on any topic.
Stay Curious!