Domain 3 of the SSCP exam focuses on access control and authentication mechanisms. Authentication methods and identity management solve the fundamental problem of knowing who is trying to enter a system and what they should be allowed to do once inside. Without these controls, anyone could masquerade as anyone else, and sensitive data would have no protection at all.
Jump to a section
A simple way to picture Authentication Methods and Identity Management
A hotel night manager is the single person responsible for every key, every guest record, and every access decision between midnight and dawn. The manager does not guess who a guest is; the guest must prove their identity with a passport or booking confirmation at the desk. That proof is authentication. Once the manager is satisfied, they issue a physical key card programmed to open only that guest's room and the gym, not the staff offices or the boiler room. That key card is an authorisation token. The manager also keeps a log of every key issued, every room entered, and every lost key reported. When a guest checks out, the manager deactivates that key card immediately, so it cannot be used again. If a guest reports a stolen key, the manager cancels the old key and issues a new one with a different code. The manager also periodically reviews who has access to which floors — a sales representative who left three months ago should not still have a master key. This entire process — proving who you are, deciding what you can do, tracking what you did, and revoking access when you leave — is exactly identity and access management in IT. The manager never hands out keys without proof, never lets one key open every door, and never forgets to turn off a key when someone departs. That discipline is what keeps the hotel (and the network) secure.
Authentication is the process of proving that you are who you claim to be. Identity management is the entire lifecycle of creating, maintaining, and deleting digital identities. Together, they form the gate that decides who gets into a system and what they can do there.
Let us start with the three factors of authentication. This is the foundation of everything you need to know. The three factors are:
Something you know (a password, a PIN, an answer to a security question)
Something you have (a smart card, a hardware token, a mobile phone that receives a one-time code)
Something you are (a fingerprint, a facial scan, a retina scan, your voice pattern)
Using only one factor is called single-factor authentication. Using two or more is called multi-factor authentication, or MFA for short. The SSCP exam will hammer home that MFA is far stronger than any single factor. For example, if your password is stolen (something you know), the attacker still cannot log in because they do not have your phone (something you have) to receive the second code.
Now let us look at the identity management lifecycle. This is the process an organisation follows to manage digital identities from creation to deletion. It has five main stages:
Provisioning: The IT department creates a new user account when someone is hired. They assign a username, an initial password, and the appropriate permissions based on their job role.
Authentication: The user proves their identity every time they log in. This is where passwords, biometrics, or tokens are used.
Authorisation: After the user is authenticated, the system checks what they are allowed to do. Authorisation is not the same as authentication. A user might be authenticated (their password is correct) but not authorised to view the payroll database.
Maintenance: Over time, the user's role may change. They get promoted, move to a different department, or take on new responsibilities. IT updates their permissions to match. This is called an access review or recertification.
De-provisioning: When the user leaves the company, their account is disabled or deleted. Any access tokens, keys, or certificates associated with that identity are revoked. This is critical because former employees who still have active accounts represent a huge security risk.
A major concept tied to authentication is the difference between identification, authentication, and authorisation. Identification is when you claim an identity (I am Alice). Authentication is when you prove that claim (here is my password that only Alice should know). Authorisation is what the system lets you do after you are proven to be Alice (Alice can read her own email but cannot delete the server logs). Many beginners confuse these three, but the SSCP exam will test them separately.
Another critical idea is single sign-on, or SSO. SSO allows a user to log in once and gain access to multiple applications without re-entering their password. For example, when you log into your Google account, you can access Gmail, YouTube, and Google Drive without authenticating again. Behind the scenes, SSO uses a central authentication server that issues a token. That token is then presented to each application as proof that you already logged in. The exam loves to test the security trade-off: SSO is convenient but creates a single point of failure. If the SSO server is compromised, every connected application is compromised.
Federated identity is a related concept. Federation allows users from one organisation to use their credentials to access resources in another organisation. For example, a university student might use their university login to access a library database hosted by a different institution. This works because both organisations trust a common identity provider. The most common standard for federation is Security Assertion Markup Language, or SAML, and another is OpenID Connect, which is built on top of OAuth 2.0. The SSCP exam expects you to know that OAuth 2.0 is an authorisation framework, not an authentication protocol, and that OpenID Connect adds the authentication layer on top of it.
Finally, we have the concept of directory services. A directory service is a central database that stores information about users, groups, computers, and other network resources. The most famous example is Microsoft Entra ID (formerly known as Azure Active Directory). When a user tries to log in, the system checks their credentials against the directory service. If the credentials match, authentication succeeds. The directory also stores group memberships, which are used to determine authorisation. For example, the group "Sales" might have read access to the sales database, while the group "Managers" might have write access. Adding a user to the correct group is far easier than setting permissions for each user individually.
In summary, authentication methods decide how a user proves their identity, and identity management decides how that identity is created, maintained, and destroyed. The exam will ask you to distinguish between authentication and authorisation, to identify the three factors, to recognise the stages of the identity lifecycle, and to understand the basic operation of SSO, federation, and directory services.
User Registration
A new user is added to the directory service (e.g., Microsoft Entra ID). This creates a digital identity with attributes like username, email, and department. No access is granted yet.
Credential Creation
The user is assigned an initial password (something they know) and possibly a hardware token or authenticator app registration (something they have). This step establishes the factors the user will use to authenticate.
Group Assignment
The user is added to one or more security groups based on their job role. Permissions are managed at the group level, so the user inherits access rights automatically. This is the beginning of authorisation.
Logon and Authentication
The user enters their username and password. The system validates the password against the directory. If MFA is enabled, the user must complete a second factor, such as entering a code from an authenticator app. Only after both factors are verified does authentication succeed.
Authorisation and Access
After authentication, the system checks the user's group memberships and permissions to determine which resources they can access. The user sees only what their groups allow — no more, no less.
Periodic Access Review
At regular intervals (e.g., quarterly), a manager or compliance officer reviews each user's access rights. Outdated or excessive permissions are removed. This is the maintenance phase of the identity lifecycle.
Account De-provisioning
When an employee leaves, their account is disabled immediately. Active sessions are terminated, and tokens are revoked. After a retention period (e.g., 30 days), the account is deleted from the directory. This prevents orphaned accounts.
An IT professional working in a mid-size company of 500 employees is tasked with setting up the authentication and identity management system from scratch. The company has just moved to the cloud and uses Microsoft Entra ID as its directory service. The IT pro's first job is to plan the provisioning process. They work with HR to ensure that whenever a new employee is hired, an automated script creates a user account in Microsoft Entra ID. The script assigns the user to the correct group based on their department (Sales, Engineering, Finance) and sets an initial temporary password that expires on first login.
Next, the IT pro configures authentication policies. They decide that all users must use multi-factor authentication. For most users, MFA means a password plus a code sent to their mobile phone via an authenticator app. For executives and IT administrators, the IT pro requires a hardware security key (something you have) in addition to the password. This is called risk-based or step-up authentication.
The IT pro then sets up single sign-on. They configure the company's email, project management tool, and CRM system to trust Microsoft Entra ID as the identity provider. When a user logs into their laptop in the morning, they authenticate once. After that, clicking a link to the CRM system does not prompt for a password again because the CRM system trusts the token from Microsoft Entra ID.
Every quarter, the IT pro runs an access review. They generate a report showing each user's current group memberships and permissions. The report is sent to each department manager, who confirms that everyone in their department still needs the access they have. If a user changed roles six months ago but still has permissions from their old role, the manager flags it, and the IT pro removes those permissions. This is the maintenance phase of the identity lifecycle.
When an employee resigns, the IT pro receives a notification from HR. Within one hour, the user's account is disabled. The IT pro also runs a script that revokes all active sessions and tokens for that user, so they cannot stay logged in on their phone or laptop. After 30 days, the disabled account is deleted entirely. This is the de-provisioning process.
The IT professional also uses these tools and techniques on a daily basis:
A privileged identity management (PIM) tool that grants temporary admin rights only when needed and logs all use.
An automated system that alerts if an account has not been used for 90 days (dormant accounts are a security risk).
A policy that requires password complexity (12 characters, at least one number, one uppercase, one special character) and forces a change every 90 days.
A conditional access policy that blocks logins from countries where the company has no employees.
All of these actions are routine, daily tasks. They map directly to the identity management lifecycle and the authentication concepts tested on the SSCP exam.
The SSCP exam tests authentication methods and identity management primarily through scenario-based questions. You will not be asked to recite definitions from memory. Instead, you will read a short scenario and be asked to choose the best answer. The exam loves to test the difference between identification, authentication, and authorisation. A common trap question describes a user who enters a username (identification) and a password (authentication), and then the system checks if the user is in the payroll group (authorisation). The exam will ask what the final step is called. The answer is authorisation.
Another favourite topic is the three factors of authentication. The exam will list something like "a fingerprint, a smart card, and a PIN" and ask you to categorise each. Remember the mnemonic: Know (PIN), Have (smart card), Are (fingerprint). A common distractor is referring to a PIN as "something you have" because it is stored on a card. That is wrong. A PIN is something you know.
Multi-factor authentication is tested heavily. The exam expects you to know that MFA uses two or more DIFFERENT factors. Using two passwords (both are something you know) is not MFA. Using a password and a fingerprint is MFA because they are from different factors.
Single sign-on and federation appear regularly. A typical question might describe a company that uses one login to access both internal applications and a partner's application. The exam will ask what technology enables this. The answer is federation, specifically SAML or OpenID Connect. A trap is to answer "OAuth 2.0" when the question asks about authentication. Remember: OAuth 2.0 is for authorisation, not authentication.
The identity management lifecycle stages are tested in order. A question might ask what happens immediately after a user is terminated. The best answer is disabling the account, not deleting it. Deleting comes later after a retention period. Another common question asks about the risk of orphaned accounts — accounts that belong to former employees or contractors that were never disabled. The correct answer is that they are a security risk because an attacker could compromise them.
Directory services and Microsoft Entra ID often appear. You should know that a directory service stores objects (users, groups, computers) and that group-based access control simplifies permissions management. A typical question describes an administrator who adds a user to the "Finance Readers" group, and suddenly the user can access the finance share. The exam asks why. The answer is that the group has the necessary permissions, and the user inherited them through group membership.
Key concepts to memorise for the exam:
MFA requires two or more different factors.
Federation relies on a trusted third-party identity provider.
SSO uses tokens to avoid repeated authentication.
Provisioning creates the identity, de-provisioning destroys it.
Authorisation always follows authentication.
Microsoft Entra ID is a cloud-based directory service (not a traditional on-premises Active Directory).
Trap patterns to watch for:
Questions that list three items and ask which is NOT an authentication factor. A common trap is "your date of birth" — that is something you know, but it is not a secret, so it is not a good factor. The exam may still treat it as something you know.
Questions that confuse authentication with encryption. If a question mentions hashing passwords before storing them, that is about password storage, not authentication methods.
Questions that use the term "two-step verification" instead of "two-factor authentication". Two-step verification can use the same factor twice (e.g., password plus SMS code that you also receive on the same phone), which is not true MFA. The exam will penalise you for calling it MFA if both steps rely on the same factor.
Authentication proves who you are; authorisation decides what you can do after you are authenticated.
Multi-factor authentication uses at least two different factors from the three categories: something you know, something you have, and something you are.
The identity management lifecycle consists of five stages: provisioning, authentication, authorisation, maintenance, and de-provisioning.
Single sign-on improves user convenience but creates a single point of failure if the central authentication server is compromised.
Federation allows identities to be used across organisational boundaries through trusted identity providers, typically using SAML or OpenID Connect.
De-provisioning an account on termination is critical: disable immediately, then delete after a retention period, to prevent orphaned accounts.
OAuth 2.0 is for authorisation, not authentication; OpenID Connect adds the authentication layer on top of OAuth 2.0.
These come up on the exam all the time. Here's how to tell them apart.
Authentication
Verifies who you are (identity check).
Occurs before authorisation in the access sequence.
Uses factors like passwords, biometrics, or tokens.
Authorisation
Determines what you can do (permissions check).
Occurs after authentication succeeds.
Uses access control lists, group memberships, or roles.
Single Sign-On (SSO)
Works within a single organisation's identity domain.
Uses a central authentication server that issues tokens.
Simplifies user experience but creates a single point of failure.
Federation
Works across multiple organisations with separate identity domains.
Relies on a trust relationship between identity providers.
Enables cross-organisational access without sharing passwords.
OAuth 2.0
An authorisation framework, not an authentication protocol.
Allows an application to access resources on behalf of a user.
Does not provide information about the user's identity.
OpenID Connect
An authentication layer built on top of OAuth 2.0.
Provides an ID token that contains verified user identity information.
Used for 'Sign in with Google' and similar login flows.
Provisioning
Creates a new digital identity, usually when someone is hired.
Assigns initial credentials and default group memberships.
Sets up access before the user needs to use the system.
De-provisioning
Removes a digital identity, usually when someone leaves.
Disables the account, revokes tokens, and deletes after a retention period.
Prevents orphaned accounts and unauthorised access.
Something You Know
A password, PIN, or answer to a security question.
Can be changed if compromised, but can be forgotten or guessed.
Vulnerable to phishing, shoulder surfing, and brute force.
Something You Are
A fingerprint, retina scan, or facial recognition pattern.
Cannot be easily changed if compromised (e.g., your fingerprint is permanent).
Vulnerable to spoofing and has false acceptance/rejection rates.
Mistake
Multi-factor authentication and two-step verification are the same thing.
Correct
Multi-factor authentication requires at least two different factors (something you know, have, or are). Two-step verification can use the same factor twice, such as a password and a code sent to the same phone — that is still only one factor.
The terms are used interchangeably in marketing, so beginners assume they are identical. The SSCP exam treats them as distinct.
Mistake
OAuth 2.0 is an authentication protocol.
Correct
OAuth 2.0 is an authorisation framework that allows an application to access resources on behalf of a user. OpenID Connect is the authentication layer built on top of OAuth 2.0.
Because OAuth 2.0 is often used in login flows (e.g., 'Sign in with Google'), beginners assume it handles authentication. It only handles delegated authorisation.
Mistake
Once a user account is deleted, all associated data is immediately gone forever.
Correct
Deleting an account usually only removes the authentication entry. The user's data (files, emails) may remain in backups or retention archives. De-provisioning should disable the account first, then delete after a retention period.
People think deletion is instant and total because of how personal accounts work on social media. Enterprise systems have legal and compliance requirements for data retention.
Mistake
A strong password alone is sufficient for protecting a system.
Correct
A strong password is a good first step, but it is not sufficient. Passwords can be stolen through phishing, keyloggers, or data breaches. Multi-factor authentication is required for proper security.
This misconception persists because many consumer services still rely on passwords alone, and beginners have not experienced a breach first-hand. The SSCP exam emphasises defence in depth.
Mistake
Biometric authentication (fingerprint, face scan) is foolproof because everyone's biometrics are unique.
Correct
Biometrics are not foolproof. They can be spoofed with high-quality replicas, they cannot be reset if stolen (unlike a password), and they have false acceptance and false rejection rates. Biometrics are best used as one factor in MFA.
Movies and TV shows often portray biometrics as unbeatable, leading beginners to overestimate their reliability. Real-world attacks on biometric sensors are documented.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
Authentication verifies your identity (who you are). Authorisation determines what you are allowed to do after you are authenticated. You can be authenticated but not authorised to access certain files.
A PIN is always something you know, even if it is stored on a smart card. If you only know the PIN, you still need the card (something you have) to authenticate. The factor is defined by how the PIN is used, not where it is stored.
SSO lets a user log in once and access multiple applications within the same organisation. Federation lets a user from one organisation use their credentials to access resources in a different organisation, based on a trust relationship between identity providers.
Disabling preserves the account for auditing, compliance, and data recovery purposes. If you delete immediately, you lose the ability to trace the user's actions or recover files. A retention period (e.g., 30 days) is standard before permanent deletion.
An orphaned account is a user account that belongs to a former employee, contractor, or student but has not been disabled or deleted. Orphaned accounts are a security risk because they can be compromised and used to gain unauthorised access.
No. Microsoft Entra ID is a cloud-based identity and access management service. Traditional Active Directory is an on-premises directory service for Windows networks. They are related but different products.
You've finished Authentication Methods and Identity Management. Continue through the SSCP study guide to build a complete picture of the exam.
Done with this chapter?