From SSO and multi-factor authentication to identity providers and permissions, authentication is now a fundamental part of many digital platforms.

Authentication has always been about answering a simple question: are you really who you say you are?

How we answer that question has become considerably more sophisticated.

Websites and digital platforms increasingly connect with customer portals, member services, learning platforms, CRMs, business applications and other systems containing information that shouldn't be available to everyone.

As these digital ecosystems become more connected, authentication and identity management need to be considered as part of the platform architecture from the beginning — not added as an afterthought.

Authentication and authorisation aren't the same thing

The terms are often used interchangeably, but they solve different problems.

Authentication establishes who a user is.

Authorisation determines what that authenticated user is allowed to see or do.

A digital platform might authenticate everyone through the same identity provider but give different users very different permissions.

An employee, administrator, customer, member or external partner might all successfully sign in while receiving access to completely different information and functionality.

For complex digital platforms, both authentication and authorisation need to be designed carefully.

Something you know, have or are

One useful way of understanding authentication hasn't changed much since we first wrote about the subject.

Authentication factors generally fall into three broad categories.

Something you know

Traditionally, this means a password or PIN.

Passwords remain common, but relying on a password alone creates obvious risks. Passwords can be reused, stolen, exposed through phishing or compromised through data breaches.

That's why organisations increasingly combine passwords with additional authentication factors.

Something you have

This could be a phone, authentication application, security key or another trusted device.

Proving possession of something provides an additional layer of security because obtaining a user's password alone may no longer be enough to access their account.

Something you are

Biometric authentication uses characteristics such as fingerprints or facial recognition.

For users, biometrics can make authentication considerably more convenient, particularly when they're used to securely unlock credentials stored on a trusted device.

The appropriate authentication method depends on the application, users, information being protected and level of risk involved.

Multi-factor authentication

Multi-factor authentication, or MFA, requires users to authenticate using more than one independent factor.

Rather than relying solely on something the user knows, such as a password, access can also require something they have or something they are.

MFA can significantly strengthen account security, but not all authentication methods provide the same level of protection.

The appropriate approach should be determined by the sensitivity of the system, the users accessing it and the organisation's broader security requirements.

Making authentication easier with SSO

Security isn't the only consideration. User experience matters too.

As organisations introduce more digital systems, people can end up managing multiple usernames and passwords across different platforms.

Single sign-on (SSO) can provide a much simpler experience.

Instead of requiring a separate identity for every application, a website or digital platform can connect with an organisation's existing identity provider.

For organisations already operating within the Microsoft ecosystem, for example, this may involve integrating a digital platform with Microsoft Entra ID.

Users authenticate through the organisation's established identity environment and can then access connected applications according to their permissions.

The result can be both more secure and considerably easier for users.

Authentication is an integration

Authentication shouldn't be considered in isolation from the rest of the digital platform.

A website might need to connect with an identity provider to establish who someone is, a CRM to understand their relationship with the organisation and another business system to determine which information or services should be available to them.

That makes identity an important consideration when designing integrations between systems.

The earlier these requirements are understood, the easier it is to design the appropriate architecture.

Think about roles and permissions

Signing in is only the beginning.

Once a user's identity has been established, the platform needs to determine what they can do.

That might involve relatively simple roles such as administrator and content editor, or considerably more sophisticated permission models based on an organisation, membership, subscription, customer account or employee role.

These requirements should be mapped during discovery rather than gradually added during development.

Questions to consider include:

• Who needs to authenticate?
• Which identity provider will be used?
• What information should different users be able to access?
• Which actions can they perform?
• Where does the source of truth for those permissions live?
• What happens when someone's role or relationship with the organisation changes?
• How is access removed?

The answers can have significant implications for the architecture of the platform.

Authentication shouldn't make the experience harder than necessary

Security requirements can introduce friction.

The objective isn't to eliminate that friction at the expense of security. It's to make authentication proportionate, understandable and as seamless as possible.

Users should understand why they're being asked to sign in, what happens when authentication fails and how they can recover access.

Where SSO is appropriate, users shouldn't be asked to maintain another unnecessary set of credentials.

Good authentication design considers security and UX together.

Authentication in complex digital platforms

At Digital Garden, authentication requirements frequently form part of larger website and digital platform projects.

For example, the University of Sydney's Sydney Executive Plus platform supports authenticated learning experiences and different user groups within a broader enterprise technology environment.

Projects like these demonstrate why authentication needs to be considered alongside the CMS, user experience, data, permissions and external systems rather than treated as a standalone feature.

Designing secure, connected experiences

Modern websites increasingly sit within larger digital ecosystems.

Authentication may connect a Drupal platform with Microsoft Entra ID, a customer or member portal with a CRM, or an internal platform with an organisation's existing identity environment.

There isn't one authentication model that's appropriate for every organisation.

The right approach depends on who needs access, what they're accessing, how sensitive it is and how the digital platform connects with the organisation's wider technology environment.

Understanding those requirements early allows authentication to become an integrated part of the experience — secure enough to protect what matters, without making it unnecessarily difficult for the people who need to use it.