What is single sign-on in a cloud environment?¶
Single sign-on allows a user to authenticate once through an identity provider and then access several cloud services without entering separate credentials for each one.
In an organisation, the user may sign in through the employer’s directory and then open email, storage, collaboration and business applications.
What this means in practice¶
The identity provider may make the authentication decision, while the application simply trusts the result. The application may record that the account accessed the service but not how the user originally proved their identity.
The identity provider may hold sign-in records, multi-factor details, device information and security alerts. The cloud application may hold session creation, file access, sharing and other service activity. The organisation may also hold account-allocation and device records.
What this may show¶
This means the evidence may be split.
When investigating activity, identify the identity provider, the relying cloud service, the account identifier used in each system and the timing of both authentication and later activity.
What this does not show on its own¶
The dangerous assumption is that each cloud application holds its own complete login history.
A successful single sign-on event does not automatically prove who was physically present. The user may have an active session, a trusted device, stolen credentials or a compromised token.
Also check whether the user had several linked applications. Revoking access to one service may not end sessions in another.
What to do next¶
Do not assume matching timestamps will be exact. Systems may use different time zones, processing delays or event formats.
Key takeaway
With single sign-on, the authentication evidence may sit with the identity provider while the activity evidence sits with the cloud service, so obtain and reconcile both.