Documentation / Platform glossary / Identity provider
An identity provider is the system an organization trusts to authenticate its people and vouch for who they are to other applications. It holds the authoritative account record, so it — not each individual application — determines who has access and under what conditions.
An identity provider performs three functions. It maintains accounts, holding the authoritative record of who exists and their current status. It authenticates, verifying credentials and any additional factors. It issues assertions, producing signed statements that applications can verify without seeing the credentials themselves.
In most enterprises the provider is the corporate directory or an SSO service layered over it, and it is where authentication policy is actually enforced: multi-factor requirements, device conditions, session lifetime, and location restrictions apply once at the provider rather than being reimplemented in every application.
The assertion is what applications consume. It states who authenticated, when, sometimes how, and often which groups they belong to. Because it is signed by a party the application trusts, the application can act on it — and its validity window is deliberately short, which is why an assertion is not a durable credential.
The property that matters operationally is authoritative lifecycle. When someone leaves and their directory account is disabled, every application trusting that provider stops admitting them. Applications holding their own credentials each need separate action, and the ones that get missed are how access outlives employment.
Enterprises want new platforms to join their existing identity estate rather than create another account store to govern. A product that insists on its own credentials adds an authentication policy to enforce, a deprovisioning step to remember, and an access review to conduct.
The evaluation question is therefore whether the platform accepts the organization's provider as authoritative — including for account lifecycle — not merely whether it offers a login page.
QueryTek authenticates enterprise users through the organization's approved identity provider rather than maintaining a parallel credential store, and resolves the authenticated identity to the correct tenant workspace. Provider configuration is handled during onboarding.
