diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Why more companies are entrusting identity to the experts in the name of security and growth


Every organization that uses a login box must have some form of identity and access management (IAM) system to keep track of users and control access to data and services. But in recent years, managing identity has become more complex. Today, identity management is inextricably bound to issues of security, user experience (UX), and scalability.

To cope with the challenge of maintaining IAM systems, more and more organizations are turning to Identity-as-a-Service (IDaaS) providers.

But what exactly is Identity-as-a-Service? What do these providers offer that can help businesses navigate such a challenging environment?

In this piece, we’ll define identity as a service &mdash; its core components and the reasons why it’s a rapidly growing segment of Software-as-a-Service (SaaS).

## IDaaS Defined

When an organization creates or updates an application, they have to choose which functionalities to write themselves and which to entrust to a third party. For instance, if you’re writing an application that takes payments, it’s often more time- and cost-effective to use a platform like Square rather than making your own payment system from scratch. 

The same holds true if your application requires users to log in. Given the complexities of logins and the many ways that identity management touches on analytics and security, it’s often simplest to purchase an IDaaS solution that integrates into your software and handles these issues for you.

IDaaS providers offer cloud-based solutions for IAM functions. 

When you purchase an IDaaS service, you’re essentially purchasing an API (Application Programming Interface). In the simplest terms, an API is a set of programmed rules for how software components or applications interact, like a translator or mediator. 

In the case of IDaaS, the API mediates the authentication flow between the end-user and the customer’s application(s). IDaaS may also be used to mediate Authorization to certain areas of the application or to access certain data within the application(s) your company is building.  

When we talk about managing identity, we’re referring to the identities of three basic classes of users:

* Customer identity and access management (CIAM), which applies to end-users.
* Workforce IAM, which manages your staff and their access to internal applications.
* B2B IAM, which lets businesses integrate identity with their business partners and enterprise customers.

Each of these classes requires a different approach, and an organization may subscribe to an IDaaS provider for all of them or just one.

There are a few core features common to virtually all IDaaS providers. These include:

* Multi-factor authentication (MFA)
* Biometrics
* Single Sign-On (SSO)
* User management and access control

We’ll get deeper into all those terms below.

### Multi-Factor Authentication (MFA)

[MFA](https://auth0.com/docs/mfa) is an increasingly popular way of verifying a user’s identity. It’s more secure than the traditional username/password method of logging in since [passwords are vulnerable to multiple types of attacks](https://auth0.com/blog/what-is-broken-authentication/#:~:text=Auth0%20Docs&text=Broadly%2C%20broken%20authentication%20refers%20to,to%20masquerade%20as%20a%20user.).

MFA requires users to log in with more than one piece of identifying information (i.e., a push notification in addition to a password).

Users must share some combination of the following credentials to log in:

* Knowledge: Something the user knows (such as a password)
* Possession: Something the user has (such as a cell phone)
* Inheritance: Something the user is (such as a fingerprint or retina scan)

The most common form of MFA is two-factor authentication (2FA), though you may customize an MFA solution to ask for more credentials depending on the security risk.

Despite numerous reports on [the benefits of multi-factor authentication for stopping data breaches](https://auth0.com/blog/how-two-factor-authentication-can-help-financial-institutions-reduce-data-breaches/), widespread adoption is still surprisingly low &mdash; though it has increased significantly in recent years:

![2fa-blog](https://images.ctfassets.net/23aumh6u8s0i/3UNdOb3k1qtTTy3vXU2NhJ/ca5386396ac47062473b3562d3314c9f/2fa-blog)

One of the reasons for the lagging adoption rate is that designers are wary of creating extra friction at login, especially for B2C authentication. But third-party IDaaS providers offer more customizable MFA options, like [step-up or adaptive authentication](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/). These approaches to MFA only ask for extra credentials if a user meets a certain risk profile; for instance, logging in from a new IP address or changing payment information.

### Biometrics

Biometrics means the use of an “inheritance” criteria &mdash; something the user is as a means of verification. If you’ve ever unlocked your smartphone with your thumbprint, you’re familiar with biometrics.

![biometrics](https://images.ctfassets.net/23aumh6u8s0i/4H45r7da3K3WplJ96rXE8B/ea359f09fc4bd01419eebdc67f09f29d/biometrics)

In addition to thumbprints, other biometric authentication methods include iris or retina recognition, full [facial recognition](https://www.syte.ai/blog/brief-history-image-search/), fingerprint, hand, and DNA usage.

Many organizations are excited to use this technology and have turned to IDaaS providers to implement it rather than trying to train their in-house teams on this specialized branch of knowledge.

### Single Sign-On (SSO)

[Single Sign-On (SSO)](https://auth0.com/single-sign-on) allows users to log in to one application and then automatically be logged in to other designated applications. Most people are familiar with SSO through Google, since signing in to one Google property such as YouTube grants you access to Gmail and other applications. SSO is popular for companies with multiple brands since it allows for greater user visibility, as well as reduced friction. There are also use cases for SSO in workforce and B2B identity management.

![Single Sign-On (SSO) in action](https://images.ctfassets.net/23aumh6u8s0i/6t0LdnTcofxK6ekdSpDEja/a7376b8f04ca074a0d88dd1470d3be55/sso-desktop.jpeg)

### User management and access control

One essential element to any IAM system is the ability to control who is permitted to access data by provisioning users with different roles. IDaaS systems simplify this process by centralizing identity and putting these controls into a single location like a user dashboard. That’s a significant advantage in making sure sensitive data stays in the right hands since it’s much less prone to error than an IT team manually controlling access to individual applications.

## Why Enterprises Choose IDaaS

IDaaS is undergoing a period of exponential growth as more companies—from startups to multinational corporations—decide to outsource identity. The IDaaS market is [predicted to grow](https://www.marketsandmarkets.com/Market-Reports/identity-as-a-service-market-32235637.html) from $2.5 billion in 2019 to $6.5 billion in 2024.

Why this shift toward third-party identity solutions? The reasons include the need to meet legal requirements, manage security risks, and implement an identity solution designed around scalability and extensibility.

### Data privacy law compliance

One of the reasons that IDaaS has become so important recently is the rush to comply with new data privacy regulations. These include the [EU’s General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA)](https://auth0.com/resources/whitepapers/GDPR-vs-CCPA), and others.

Organizations that fail to comply with these regulations can face stiff penalties. For instance, under GDPR, organizations without secure and transparent data practices can be fined up to 20 million euros or 4% of annual global turnover &mdash; whichever is higher.

![GDPR compliance checklist](https://images.ctfassets.net/23aumh6u8s0i/4XXboWYzyp7LPl5BulfQsM/4a439e75374582bfe2a5cea60fb02120/gdpr-compliance-checklist)

Data privacy laws often grant users more rights over their data. These rights vary depending on the law, but they may include:

* A new right to data portability
* An extended right to be forgotten (also called the right to erasure)
* The right to opt in or out of data collection and sales

These rights translate to a new set of obligations for organizations. It’s now essential to have a centralized repository of user data to satisfy reporting requirements and protect sensitive data according to current best practices. Data privacy laws are rapidly evolving, and managing compliance can be a full-time job, especially for organizations with uses in multiple jurisdictions.

Managing compliance is a major undertaking for any company. However, relying on an IDaaS partner can keep track of even siloed identity stores. A centralized identity solution can deliver lower maintenance costs and greater peace of mind. Although an IDaaS provider can’t ensure your organization will be fully compliant, IDaaS tools can certainly help.

### Increased security With IDaaS

In recent years, identity has become a major source of [high-profile hacks and data breaches](https://auth0.com/blog/the-11-biggest-data-breaches-of-2020-so-far/). In fact, Verizon’s [2020 data breach report](https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf) found that over 80% of breaches from hacking involved brute force attacks or the use of lost or stolen credentials.

The best protection against [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) like [credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) are the features IDaaS providers specialize in: MFA, brute force and anomaly detection, and rigorous access control.

### Extensibility, adaptability, scalability

Legal and security concerns are the most frequently mentioned benefits of partnering with an IDaaS provider, but a sophisticated approach to identity can also help growing companies boost their bottom lines. Organizations with custom-built IAM solutions frequently find that maintaining these systems and adapting them to new needs and partners takes months of developer time.

For instance, in 2019, Apple mandated that [every app on the App Store had to include “Sign in with Apple” as a login option](https://developer.apple.com/news/?id=09122019b). Companies with bespoke IAM systems scrambled to meet this requirement, and many found that their systems were rigid and full of legacy code. Most IDaaS providers, on the other hand, included this as a simple update.

Having an extensible identity platform is also essential to integrating users during [Merger and Acquisition (M&A) deals](https://auth0.com/blog/why-your-ma-strategy-has-to-include-an-iam-solution/) and in deals between enterprises. Two organizations with IAM systems that can’t talk to one another can’t benefit from each other’s data, but an IDaaS provider can act as a translator between different back ends.

## What’s Ahead For IDaaS

IDaaS is an increasingly important segment of SaaS, propelled by new regulations, heightened security risks, and excitement about new technology.

Even organizations that typically adopt a "Do it yourself" (DIY) attitude about building their own features are beginning to recognize the value of relying on third-party identity providers. They can make that switch at any stage: during initial product development, prior to release, or at an inflection point at which they see the limits of their in-house IAM system.

The definition of IDaaS will continue to evolve as providers add new features, but the need for specialized expertise to handle these matters will remain constant.

<include src="asides/AboutAuth0" />


What Is IDaaS?

andres

I’ve been at Auth0 since 2017. I’m currently working as a Product Manager for the Auth0 FGA and OpenFGA products. Previously, I worked in the teams that owned the Login and MFA flows. <br>
I spent my entire 20+ year career building tools for developers, wearing different hats. When I'm not doing that, I enjoy spending time with my family, singing in a choir, cooking, or trying new kinds of local cheese.

Product Manager

Andrés Aguiar

Leverage Auth0’s extensibility to send SMS MFA messages using the provider that best aligns with your business



Auth0 supports different options for enabling MFA to protect user account access: push notifications, authenticator apps like Google Authenticator, and one-time codes delivered through email, SMS, or third party products such as Duo.

Until now, Auth0 has integrated with Twilio as an SMS provider, which has been a great solution for our customers. However, some customers require additional flexibility when selecting SMS providers. For example, larger organizations may use a single provider for multiple purposes and want to leverage that provider for SMS MFA to consolidate payments and enjoy volume discounts.

Organizations have a number of SMS providers they can choose from depending on their business needs. There are a number of factors to consider when selecting an SMS provider: 

* **Cost:** Some SMS providers may offer more favorable pricing and pricing models than others based on the region or country to which you want to send messages.
* **Integration with your existing software infrastructure:** You may already have a provider that helps you consolidate a single view of all the communications with your users, and you want to keep using it.
* **Compliance:** You might require certain certifications from your SMS provider, which not all vendors can provide.
* **Quality of service:** Some SMS providers may have better deliverability rates than others based on the region or country of the receiver.

Selecting the right provider can yield considerable cost savings to your business and deliver a better user experience to your customers. With this in mind, we are pleased to announce that **you can now use _ANY_ provider** for delivering SMS MFA messages. Auth0 is **the first cloud identity product** that gives you that option.

## Extending Auth0

Auth0 has a powerful and scalable extensibility platform where you can write your own code that can be executed when needed. One of the extensibility points is Auth0 Hooks, which are serverless functions that Auth0 calls when a certain event happens.

You can write code to send SMS messages in our new "Send Phone Message Hook." 

To achieve this, you need to follow three simple steps:

* Create a new "Send Phone Message" [Hook from the Hooks Dashboard’s section](https://manage.auth0.com/dashboard/#/hooks) and give it a name. In this case, you'll be creating one to deliver messages using [AWS’s Simple Notification Service](http://aws.com/sns).

![Simple Notification Service 1](https://images.ctfassets.net/23aumh6u8s0i/4pGiT6S8Awe5kDzwsih44N/093c530a25c70d7945df5b130dc7b86a/1_create-new-hook)

![Simple Notification Service 2](https://images.ctfassets.net/23aumh6u8s0i/5k4AYgPss1iRbZmBFUaSU6/da0b0a2d2bca64872926b17be0870cd9/2_new-hook)

* Write the code to send a text message or use a [full example of how to send text messages with Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns).

![Amazon SNS](https://images.ctfassets.net/23aumh6u8s0i/2pqPsBOiS1bOBaOMX9gtzh/88c2847a5495b6620fa4b719bff6efa5/3_sns-hook)

* Configure the SMS MFA Factor to deliver messages using the Phone Message hook:

![SMS MFA](https://images.ctfassets.net/23aumh6u8s0i/2QTRc0KOhiqTxPWbxrTBWw/8fcfda5305900bf23e1280314164b9af/4_sms-provider)

## Using Your Vendor of Choice

We included documentation on how to implement SMS Delivery with [Amazon SNS](https://auth0.com/docs/mfa/send-phone-message-hook-amazon-sns), [Twilio](https://auth0.com/docs/mfa/send-phone-message-hook-twilio), [Infobip](https://auth0.com/docs/mfa/send-phone-message-hook-infobip), [TeleSign](https://auth0.com/docs/mfa/send-phone-message-hook-telesign), [Vonage](https://auth0.com/docs/mfa/send-phone-message-hook-vonage), [Mitto](https://auth0.com/docs/mfa/send-phone-message-hook-mitto), and [Esendex](https://auth0.com/docs/mfa/send-phone-message-hook-esendex). Just copy and paste the examples in your Hook code and start sending messages using your product of choice.

## Enhance Security With MFA
Auth0 provides the most usable and friction-free multi-factor authentication experience in the market. 

You get a state-of-the-art end-user experience for enrolling and authenticating with multiple factors, like push notifications and one-time password (OTP) apps, right out-of-the-box.

Just enable multi-factor authentication in the Auth0 Dashboard and immediately improve the security of your applications and users!

<include src="asides/AboutAuth0" />


Enable SMS MFA Using Any Provider

andrew-akers

I'm a product marketing manager who loves learning about technology, information security, and identity. My goal is to turn that knowledge into positive outcomes for our customers. Before Auth0, I was a product marketing manager at Cisco in the network security division. In my spare time, you can find me spending time with my family, reading, writing, and working on endless home improvement projects.

Product Marketing Manager

Andrew Akers

Email MFA powered by Universal Login is here to help you improve your user's experience.


Ever try to log into an application with multi-factor authentication, only to realize that your phone was dead? It is incredibly frustrating to realize you either need to find a phone charger or dig up your MFA recovery code just to check your email.

The problem is even worse for the app owner. When a user can't log in, they can't interact with your app. This can result in lower adoption, engagement, and money, especially for consumer-facing applications.

[With the latest release of Universal Login](https://auth0.com/blog/introducing-the-new-auth0-universal-login-experience/), Auth0 can solve this problem with email as a backup MFA factor.

<script src="https://fast.wistia.com/embed/medias/kfdckzkaiu.jsonp" async></script><script src="https://fast.wistia.com/assets/external/E-v1.js" async></script><div class="wistia_responsive_padding" style="padding:92.5% 0 0 0;position:relative;"><div class="wistia_responsive_wrapper" style="height:100%;left:0;position:absolute;top:0;width:100%;"><div class="wistia_embed wistia_async_kfdckzkaiu videoFoam=true" style="height:100%;position:relative;width:100%">&nbsp;</div></div></div>
<br>
## How Does it Work?

When a user tries to authenticate and is prompted for MFA, they can click try another method and select Email. Auth0 will then send an email to the user's verified email address with a one-time password, which they can use to authenticate.

There are a few prerequisites for email MFA:

-   The app must be using Auth0's [New Universal Login experience](https://auth0.com/docs/universal-login/new)

-   Email must be enabled in the Auth0 [management dashboard or via the management API](https://auth0.com/docs/multifactor-authentication/api/email)

-   The user's email address must be verified

-   The user must have some other method of MFA enabled

![Auth0 Management Dashboard showing Email MFA enabled](https://images.ctfassets.net/23aumh6u8s0i/5JBvrPGUYW7qfri402dz7p/dfcbc655b59756dfb2f6dbf54f041cca/jgwxzr97i321lfas4aav)

## What about Email as the Only MFA Factor?

Currently, email MFA is only available as an optional backup multi-factor method. The user must have another method as the primary form of multi-factor authentication. Enabling email MFA as a standalone multi-factor method is on the Auth0 roadmap.

## How Do I Get Started?

To try email MFA with the New Universal Login experience out, sign up for Auth0 for free and click on Multifactor Auth in the management dashboard. [Follow these instructions for enabling Email MFA.](https://auth0.com/docs/multifactor-authentication/api/email)

<include src="asides/AboutAuth0" />


No Phone? No Problem! Email MFA Is Here

Because paying “per user” doesn't factor in activity levels, you could be drastically overpaying



Depending on your industry, the traditional identity and access management (IAM) provider's pricing structure could be costing you millions of dollars every year.

It comes down to how they define a “user.” Most IAMs charge on a direct per-user rate: $2 a user per month, $4 per user per month, and up from there.

What they don't do is distinguish between registered user and **active user**, someone who actually uses your product once a month(or more).

The VC Fred Wilson has observed that for virtually all web and mobile companies, only 30% of those who register/download the product are active on a [monthly basis](http://avc.com/2011/07/301010/).

For companies in some specialized industries, that percentage can dip even lower. In fields like insurance or healthcare, most “users” active once or twice a year, if that.

Despite this, the majority of IAMs still charge them every single month for _every single user_ they have on the books:

![Charges](https://images.ctfassets.net/23aumh6u8s0i/2gat7Vqlu8f4IO19MNOkW1/2b58b3ee103d1b471485cb3c06a4d998/charges)

![Another pricing](https://images.ctfassets.net/23aumh6u8s0i/6M9oumKecPGjdWwrE9oUDo/7e3f0bdc3178ff903c1c53f10576e007/another-charges)

![Centrify App Services](https://images.ctfassets.net/23aumh6u8s0i/5TKis1bZyerxCzl6hJbYGC/3b6b0f5f6d9591a06b383ff77e3032ea/centrifyappservices)

This pricing system can cost businesses millions of dollars a year because while they may have a total of 5 million users signed up with their service, only a given 100,000 use the service with any regularity.

Or, because while hundreds of thousands may need to have accounts in order to protect sensitive information (like healthcare information or financial records), few need to sign in on a monthly basis. Or, some do, but they're mostly other healthcare providers using enterprise connections, not consumers.

For many types of businesses, paying “per user” as if all of these kinds of usage were the same simply doesn't make sense.

### What Gyms and IAMs Have In Common

For many types of businesses, the “per user” identity management pricing model is the worst of the classic seat-based pricing model combined with the psychology of the gym membership.

The business model of many gyms today relies on people [not showing up.](http://www.npr.org/sections/money/2014/12/30/373996649/why-we-sign-up-for-gym-memberships-but-don-t-go-to-the-gym) People sign up for yearly gym memberships, ambitiously. Then, they neglect to actually go. The fact that a majority of gym members do not regularly visit the gym drives prices down for everyone, and so the slackers subsidize everyone else.

While not exactly the same type of business, Americans only visit their doctors [4 times a year](https://www.forbes.com/sites/niallmccarthy/2014/09/04/americans-visit-their-doctor-4-times-a-year-people-in-japan-visit-13-times-a-year-infographic/#56a1f24ee347). Even if you assume that people will interact with their healthcare provider's online dashboard upon each occasion of them visiting, that's still only 4 logins per year. If you're paying your IAM a flat fee per “user” every month, but only a handful of those users use your product every year, you're paying for a lot of services you don't really need.

Avoiding the topic of consumption when talking about pricing is a [common problem](https://hbr.org/2002/09/pricing-and-the-psychology-of-consumption). Companies try to get you to pay upfront for services, knowing you probably won't use them to the fullest extent possible.

![Payments](https://images.ctfassets.net/23aumh6u8s0i/1F5bb4wuN0iU8mKSZUs4J9/3b97b96d4f0c857573fa1d8a59048cd6/payments)

(Source: [HBR](https://hbr.org/2002/09/pricing-and-the-psychology-of-consumption)) _When you pay annually for a service, your usage drops off steadily throughout the year as the financial impact of payment becomes a distant memory._

However, businesses that mask how much you've spent on a service (vs. how much value you've gotten out of it) often wind up “trading off long-term customer retention for short-term increases in sales.”

Sooner or later, in other words, we realize that we've been paying $50 a month for a gym membership we never use, we do the mental math, and we cancel.

### The Low-Active-User Enterprise

There are many industries out there affected by the kind of inefficient pricing model described above, with insurance and healthcare as two of the most prominent.

Americans file auto collision insurance claims about [once every 17.9 years](http://www.foxbusiness.com/features/2011/06/17/heres-how-many-car-accidents-youll-have.html). They file homeowners insurance claims every [9 to 10 years](http://finance.zacks.com/average-homeowner-file-insurance-claims-8387.html). During the 4 visits Americans make to the doctor annually, they don't log in to their [healthcare provider's online dashboard](https://auth0.com/blog/how-identity-can-empower-healthcare/)—they just hand their identifying information over. And yet in these industries, healthcare and insurance, having continuous, [HIPAA—certified](https://auth0.com/learn/why-hipaa-compliance-is-vital-your-business/), secure identity management is a must.

Let's say you're an insurance company and only about 5% of your overall users actually sign into your online portal each month.

We give away Auth0 support for up to 7,000 active users for [free](https://auth0.com/pricing). However, you could support 140,000 _registered _users on that plan if only 5% of your users log in every month.

When you're ready for multifactor authentication, compliance-ready reporting and enterprise connections, you can upgrade to a fuller plan and _still _pay per active user, just $1,025/mo with 7,000 active users and 100 enterprise customers.

![Auth0 Pricing](https://images.ctfassets.net/23aumh6u8s0i/4v7lWiuk5bHsPTFJatFJc8/e6ec5783cdf3a43e9a5d4556fc863f16/pricing)

If you have 140,000 overall users, but only 5% log in every month, you're still going to pay $4 per _every _user every month. That's $560,000 every month.

That's a price point that just doesn't make sense if you're a business with a low overall active user count. When usage of a product varies so greatly across different industries, per seat pricing models should take that into account.

It's not just insurance and healthcare that face these kinds of problems. Government agencies experience them too, as we can see from a FEMA Request for Information drafted while the agency was in search of a new IAM solution:


**Note:** It is a desire of the Agency to obtain a pricing approach that supports the **variable nature of the size of the FEMA user community**. During periods after large disasters and other events, the Agency user-base may substantially increase in size for a period of time. The vendors should provide creative pricing structures, where possible **such that FEMA does not have to pay / pay less for accounts that are infrequently used**, but still active (e.g., FEMA’s Disaster Reserve Workforce needs quick access when they are activated, but may not be active for long periods of time).

(Source: [FCW](https://fcw.com/articles/2009/01/27/fema-seeks-it.aspx))

FEMA doesn't want their IAM to charge them for hundreds of thousands of users when the total number in the Agency's userbase will be far lower the majority of the time. Nor do insurance providers, healthcare companies, or any business with these kinds of variable levels of activity. When they do, they're effectively subsidizing the price paid by B2C and B2B products with much higher activity-to-user ratios.

### Transparency In Pricing

[Value-based pricing](https://en.wikipedia.org/wiki/Value-based_pricing), as opposed to competitor or cost-based pricing, aims to track the price of a product or service to the perceived value that it delivers to its customers.

We believe transparency and [pay-for-what-you-use pricing](https://auth0.com/pricing) help us get our pricing in line with our value.

If you need [secure login](https://auth0.com/lock), [enterprise connections](https://auth0.com/docs/identityproviders#enterprise), and [multifactor authentication](https://auth0.com/multifactor-authentication), but the level of activity among your user base is unevenly distributed or highly variable, we believe you should pay a different amount than a product where 50% of all users are active on a monthly basis.

Not just because it can be a cost savings for you, but because it means that you're paying for the services you're receiving, and no more, not subsidizing all of the social apps and networks of the world. 


"multi-factor-authentication"