March 17, 2025

Why your SaaS provider might be holding back your Zero Trust security strategy

Chris Harvey

Security Solutions Specialist at Data^#3 Limited

Connect

When evaluating Software as a Service (SaaS) applications, organisations increasingly prioritise security and the adoption of Zero Trust principles to safeguard their data. A critical component of this approach is using an external Identity Provider (IDP), such as Microsoft Azure Active Directory (Azure AD), to manage authentication and access control. However, many SaaS providers charge additional fees for integrating their applications with external IDPs – creating unnecessary roadblocks to security.

The role of IDPs in Zero Trust Security

An external IDP is a system that manages authentication for users outside of the SaaS application itself, ensuring the organisation retains full control over usernames, passwords, and security policies. In most organisations, their Azure AD directory serves as the single source of truth for user management, centralising identities and policies across all corporate systems and enforcing consistent security policies regardless of the application being accessed.

By integrating SaaS applications with a third-party IDP, organisations not only centralise user management, but they also unlock advanced security features such as conditional access, device trust, and risk-based authentication, leveraging tools such as Microsoft Authenticator and Cisco Duo. Depending on your SaaS provider, this may incur an additional fee – which often creates an unnecessary barrier to implementing critical security enhancements.

Beyond username and password: The role of IDPs and MFA tools

Traditional username and password authentication is inherently insecure. By integrating SaaS applications with external IDPs like Azure AD, organisations gain access to advanced security features that go far beyond basic login credentials. These include:

Conditional access policies: These policies are managed by the IDP (e.g. Azure AD) and allow organisations to enforce rules based on contextual factors such as user location, device compliance, application type, and real-time risk assessments.
Device trust: IDPs, in conjunction with tools like Microsoft Endpoint Manager (Intune), verify that only managed and compliant devices can access applications. This is typically achieved through methods such as:
- Machine certificates: Devices are issued unique certificates by a central Public Key Infrastructure (PKI). These certificates serve as proof that the device is trusted and managed by the organisation.
- Endpoint management: Tools like Intune enforce compliance policies, ensuring devices meet specific security standards (e.g., encryption, up-to-date software) before granting access.
- Device registration: Devices are enrolled into the organisation’s management system, allowing real-time verification of their compliance and trust status.
- Trust signals: Additional factors, such as device health, geolocation, and network IP ranges, can also be evaluated to establish device trust.
Risk-based authentication: Advanced features within IDPs like Azure AD Identity Protection assess login attempts for unusual patterns (e.g. accessing from an unfamiliar location or using a new device). Depending on the risk level, the IDP can enforce additional steps, such as multi-factor authentication or blocking access.
Enhanced multi-factor authentication (MFA): Tools like Microsoft Authenticator and Cisco Duo provide the mechanisms for MFA. These tools integrate with IDPs to verify a user’s identity via app-based notifications, biometrics, or hardware tokens. While the IDP defines the rules, MFA tools enforce them, ensuring users meet the additional security requirements.

Additionally, integrating with an external IDP reduces the risks associated with poor password hygiene. According to Haveibeenpwned.com, billions of credentials have been exposed in SaaS-related data breaches, demonstrating the inherent insecurity of relying on individual applications to manage passwords. When users are forced to create multiple passwords for different SaaS apps, they often resort to bad habits like reusing passwords, choosing weak passwords, or storing them insecurely. By centralising authentication through an IDP, organisations enable employees to use a single, secure corporate password alongside MFA, reducing the likelihood of compromised credentials and improving overall security.

These components work together to support a Zero Trust model, where every access attempt is verified based on multiple factors, not just static credentials alone.

The security risks of relying on SaaS-native authentication

Some SaaS providers offer built in authentication and MFA, but these solutions often lack the flexibility and sophistication of external solutions. For example:

Limited conditional access policies: SaaS-native MFA often does not support contextual security measures like device trust or real time risk assessment.
Weak password management: Users are often required to create separate credentials for each SaaS app, increasing the risk of password reuse, weak passwords, and credential leaks.
Inconsistent security enforcement: Without IDP integration security policies must be manually configured for each application, increasing complexity and risk.

The business case for third-party IDP integration

Integrating an external IDP with SaaS applications isn’t just about security—it’s about operational efficiency and compliance. By leveraging centralised authentication, organisations can:

Reduce administrative overhead: Managing multiple authentication systems is complex and time-consuming. A single IDP streamlines identity management across all SaaS applications.
Improve user experience: Employees benefit from seamless, secure access with a single corporate identity, reducing login friction.
Meet compliance requirements: Many regulatory frameworks (e.g., GDPR, ISO 27001) require centralised authentication and access control measures.

The integration of SaaS applications with external IDPs like Azure AD is essential for organisations looking to enhance their security posture. IDPs provide the foundation for implementing advanced policies like conditional access, device trust, and risk-based authentication. Tools like Microsoft Authenticator and Cisco Duo complement these systems by enforcing MFA requirements, ensuring users meet the conditions defined by corporate policies on Azure.

Secure access is the foundation of cyber security, and it starts with SSO.

When evaluating SaaS providers, organisations should prioritise those that offer seamless Single Sign-On (SSO) integration without hidden costs. Providers that align their pricing with strong security principles demonstrate a genuine commitment to their customers’ Zero Trust strategies.

To protect your organisation effectively, choose SaaS providers that support third-party IDP integration as a standard feature. Secure access is the foundation of cyber security, and it starts with SSO.

Turning Zero Trust strategy into reality

Zero Trust isn’t a switch you flip—it’s a journey of layered security improvements. Many organisations struggle to move from strategy to implementation, especially when SaaS providers create barriers to strong identity management.

A good place to start is Data^#3’s no cost Security Resilience Assessment Workshop where we help you identify practical steps to strengthen your defences. Or reach out to me any time to chat through your security strategy.