How Federated Identity Management works: Benefits, challenges, and use cases

Most enterprises have already solved federated identity management for software. An employee signs in once with a trusted identity provider and can access multiple applications without separate credentials for each one. Then that same employee walks to the front door, and the building runs on a different identity record, entered by hand, in a system the identity team never sees.

That gap is where access management fails. A leaver is disabled in the directory at 9 a.m. while the badge still opens the server room at 5 p.m. A contractor's account expires in the IdP, but nobody tells the access control system.

Acre closes that gap. Acre Access Control connects to the identity provider you already run through SAML single sign-on, SCIM 2.0 provisioning, Okta Cardholder Sync, and Entra ID / Active Directory integration, so physical access follows the same identity lifecycle as every other system in your federated identity program. This guide covers where Acre fits in a federated identity architecture and what to confirm before you connect doors to your identity provider (IdP).

Note: If your identity provider already controls access to every application but badges are still updated by hand, your offboarding is only as fast as the last manual change. Acre Access Control connects to that identity provider through SAML single sign-on, SCIM 2.0 provisioning, Okta Cardholder Sync, and Entra ID / Active Directory integration, so door access is created, updated, and removed along with the rest of the identity lifecycle. Talk to the Acre team to review your identity architecture and plan a pilot.

Why Federated Identity Management Breaks Down at the Door, and How Acre Fixes It

Federated identity management (FIM) lets a single identity work across domains. It relies on trust relationships between an identity provider and the service providers that accept its assertions, allowing users to authenticate once, access multiple services, and gain access to resources in other domains without duplicate accounts. Centralized authentication of this kind cuts administrative overhead, reduces password fatigue and password resets, and lets security teams enforce security policies in one place instead of many.

Physical security is often left outside that trust relationship. Many access control systems keep their own user database, operator logins, and offboarding process. The result is two sets of digital identities for the same person, and identity verification that is only as current as the last manual update.

Acre treats the identity provider (IdP) as the source of truth. Acre Access Control, Acre's cloud access control platform, is delivered as SaaS, is API-first, and integrates with enterprise identity management systems. In practice, that means:

• Operators sign in to Acre Access Control with corporate credentials through single sign-on, instead of a separate username and password.
• People records are created, updated, and deactivated from the IdP through SCIM 2.0.
• Okta and Entra ID / Active Directory populations can be synchronized, with credentials issued automatically.
• Acre Identity by TDS extends the same identity-led approach to visitors and contractors.

Acre does not replace your IdP. It makes physical access control part of the federated identity program you already operate.

Federated Identity Management vs. Single Sign-On (SSO): What Acre Delivers for Each

Buyers often ask whether federated identity management is the same as SSO. It is not, and the difference shapes what to expect from a vendor.

Single sign-on (SSO) lets a user access multiple applications within a single organization's domain after one login. Familiar examples of SSO include signing in to Microsoft Entra ID once and opening every Microsoft 365 app, using one Google Workspace login for Gmail, Drive, and Calendar, or launching business applications from an Okta dashboard. SSO consolidates logins, so people no longer manage multiple usernames and passwords, which is why it is the most common answer to password fatigue.

Federated identity management goes further. It enables access across multiple organizations and multiple domains by establishing trust between separate parties. Federated SSO is single sign-on delivered through that federation: users authenticate with a trusted identity provider in one domain and reach federated services run in another. SSO is the experience. Federated identity is the trust model that lets that experience cross organizational boundaries.

Acre Access Control sits on the service provider side of that model. Your IdP performs user authentication, and Acre accepts the result and applies it to the platform. That gives buyers both parts: federated SSO for the people who administer the system, and identity synchronization for the people who walk through the doors.

How Federated Identity Management Works With Acre Access Control

Acre Access Control uses four documented capabilities to connect to enterprise identity management. These are the key components of a federated identity deployment with Acre, and most organizations combine more than one.

SAML Single Sign-On for Operators and Administrators

Acre Access Control includes single sign-on in its user interface, so operators do not need multiple credentials to work across corporate systems. Acre's Knowledge Base documents SSO configuration using the SAML protocol with Microsoft Entra ID (formerly Azure AD) and Google Workspace as the identity provider (IdP).

When a user attempts to open Acre Access Control, the flow follows the standard federated authentication pattern:

1. The user signs in to the corporate IdP with existing credentials.

2. After successful authentication, the IdP issues a signed SAML assertion and passes it through the user's browser.

3. Acre Access Control, acting as the service provider, validates the assertion and opens the session.

User credentials stay within the IdP's domain and are not shared with the access control platform. Acre documents this as IdP-initiated SSO, which means the login starts from the IdP. User access to the platform is then managed from the IdP's admin center, and Acre publishes service provider details for USA, Canada, and EU regions, which is useful when planning across multiple regions.

SCIM 2.0 Provisioning for the Identity Lifecycle

SSO covers who can sign in. Provisioning covers who exists. Acre Access Control offers SCIM-based provisioning through a Gallery package, allowing identity providers to automatically create, update, and deactivate users in the platform using the SCIM 2.0 protocol.

When a record changes in the IdP, the change is reflected in Acre Access Control. Acre positions this around keeping physical access aligned with identity lifecycle changes, reducing manual user management, and accelerating onboarding and offboarding across multiple systems. For a buyer, deactivation matters most. A leaver removed in the IdP no longer depends on someone remembering to revoke a badge.

Okta Cardholder Sync With Automatic Credential Issuance

For organizations standardized on Okta, Acre provides an Okta Cardholder Sync package in the Acre Gallery. Since Acre Access Control v25.12.4, a script in that package automatically issues a credential when a new person is added through Okta sync. A new hire created in Okta arrives with a credential already issued, with no manual step in between.

Entra ID and Active Directory Integration

Acre Access Control integrates with Microsoft Entra ID / Active Directory through LDAP. Acre's Professional Services team tailors the integration to each organization, with real-time synchronization of cardholders. The automation can assign a badge type, apply access levels, record custom data, and distribute mobile credentials.

Because the automation assigns access levels, organizations that use role based access control can align user permissions at the door with the roles already defined in the directory. Where an identity system is not yet connected, Acre Access Control also supports bulk person imports from CSV templates with built-in validation.

SAML, OAuth 2.0, and OpenID Connect: Where Acre Fits Among Federation Protocols

A common question is the difference between SAML and federated identity management. Federated identity management is the overall framework: the trust relationships, policies, and technology that let identities work across domains. Security Assertion Markup Language (SAML) is one of the security protocols that carries out that framework.

FIM uses protocols like SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC). SAML exchanges signed security assertion documents between an IdP and service providers, which is how service providers authenticate users without holding their passwords. OAuth 2.0 handles delegated authorization through an access token. OpenID Connect adds an identity layer on top of OAuth 2.0. All three rely on security tokens rather than shared passwords, which keeps sensitive authentication data inside the IdP's domain.

For Acre Access Control, the documented single sign-on method is SAML, and the documented provisioning standard is SCIM 2.0. If your federated identity design depends on a protocol or IdP beyond those covered here, raise it with the Acre team before design begins. Federated systems require careful management of certificates and metadata between the IdP and its service providers, so confirm compatibility in a pilot.

Extending Federated Access to Contractors, Partners, and Visitors With Acre Identity by TDS

One of the main reasons enterprises adopt identity federation is cross-organization access. FIM simplifies secure access for external partners and suppliers, allowing users from a partner to authenticate with their own organization's IdP and access resources without separate credentials or duplicate accounts.

Physical sites face the same population: contractors, agency staff, auditors, and visitors who need time-limited resource access in real spaces. Acre Identity by TDS is the layer Acre provides for that. It sits above access control to unify how people are welcomed, verified, credentialed, and protected across multi-site environments, bringing visitor, contractor, and employee flows together.

Acre Identity by TDS works as an add-on to Acre Access Control. It also supports mixed estates through compatibility with third-party systems, including Genetec, C-Cure, Lenel, and 10 other access control platforms. That matters after a merger, or across business units that run different systems, because identity workflows can be unified without rip-and-replace of the access control underneath.

Security Risks of Federated Identity Management and How an Acre Deployment Addresses Them

Federation concentrates trust, and buyers should plan for the security risks that come with it. Federated identity helps strengthen security through centralized authentication at the IdP, which reduces the risk of unauthorized access created by scattered accounts and reused passwords. The same centralization means a compromised IdP can have widespread implications across every federated application, and the central IdP becomes a single point of failure if it experiences downtime. Misconfigured certificates and stale metadata can also introduce security vulnerabilities.

Three controls reduce that exposure in an Acre deployment:

• Multi-factor authentication (MFA) at the IdP level. Multi-factor authentication is one of the strongest protections for a centralized login, whether it uses authenticator apps, security keys, or biometric credentials. Because Acre Access Control accepts SSO from your IdP, the multi-factor authentication (MFA) policy you enforce there applies to operator sign-in. Acre also offers MFA options for admin portals.
• Least privilege inside the platform. Federated authentication confirms the user's identity. It does not decide what that user may do, so operator roles and access levels in Acre Access Control should still follow least privilege.
• Outage planning. Ask how administrator sign-in and provisioning behave if the IdP is unavailable, and document a break-glass process with the Acre team.

Traditional authentication methods, where every system holds its own password, are difficult to govern. Federated identity with enforced multi-factor authentication and continuous monitoring of sign-in activity gives security teams one place to strengthen security while maintaining security at every door.

Compliance and Audit: Identity Assurance for Regulated Sites With Acre

FIM helps meet regulatory requirements for identity assurance, and it supports compliance in regulated industries such as healthcare and finance, where auditors expect proof that access ended when a role ended. Centralized authentication logs simplify compliance audits because sign-in evidence lives in one system. Compliance and governance issues can still arise when identity data is shared across organizational boundaries, so agree data protection scope before you federate with partners.

Acre adds the physical side of that evidence. Acre Access Control provides per-object event history, so teams can review activity for a specific person, door, or controller in context. Combined with IdP logs, that supports identity verification on both sides: who was authenticated, and which doors they used.

Data security matters as much as the audit trail. On data security and compliance posture, Acre's claims are scoped:

• Acre's data protection posture is aligned to GDPR.
• SOC 2 applies to cloud access control (via AWS).
• ISO 27001 certification applies to specific parts of Acre's portfolio, so verify scope for your deployment.

Cloud, On-Premises, and Hybrid: Matching Acre to Your Identity Architecture

The identity capabilities described above belong to Acre Access Control, Acre's cloud-managed platform. That makes it the right starting point when the goal is to bring physical access management into an existing identity and access management program, particularly for organizations that run access management across multiple platforms and sites. Acre Wallet adds mobile credentials over BLE and NFC, which the Entra ID / Active Directory automation can distribute as part of onboarding.

Some sites cannot move access control to the cloud. Acre supports on-premises deployment with platforms such as Access It! and DNA Fusion for organizations that require local infrastructure, air-gapped environments, or data residency within their own environment. If you need directory or IdP integration for an on-premises platform, confirm the supported method for your version with the Acre team.

How to Roll Out Federated Identity Management With Acre

Acre's adoption approach is pilot first, then scale. Applied to identity, a low-risk sequence looks like this:

1. Confirm the source of truth. Decide which IdP, and which attributes, drive physical access management.

2. Enable single sign-on (SSO) for operators. Configure SAML between your IdP and Acre Access Control so administrators stop using separate credentials.

3. Connect provisioning. Use SCIM 2.0, Okta Cardholder Sync, or the Entra ID / Active Directory integration to synchronize people records.

4. Map roles to user permissions. Translate directory groups into access levels and badge types, then test onboarding, role change, and offboarding.

5. Pilot one site, then template. Validate on one building, keep the existing process available during validation, and replicate the configuration across sites.

6. Add visitor and contractor flows. Introduce Acre Identity by TDS once employee identity is stable.

Bring Your Doors Into the Federation You Already Run

If your IdP already governs access to multiple applications but badges are still managed by hand, physical access is the gap in your federated identity management program. Acre Access Control connects to that IdP with SAML SSO, SCIM 2.0, Okta Cardholder Sync, and Entra ID / Active Directory integration, so secure access to buildings follows the same lifecycle as access to systems. Talk to the Acre team to review your identity architecture and plan a pilot.