Free tools Windows power users keep installed
One-click scans. No signup required.
When a centralized identity provider (IdP) becomes unavailable, applications that depend on it can become inaccessible even if their own servers and data are healthy. The impact depends on where the authentication flow breaks, whether a user already has a valid session, and whether the application needs a fresh token, identity lookup, or policy decision.
Why an identity failure can look like an application outage
Single sign-on (SSO) makes a shared identity service a dependency for many applications. A typical access path runs from a user through an identity provider or federation service, an MFA method and its delivery channel, token issuance, application authorization and policy checks, and finally an application session. If a shared step fails, users may be unable to get into an otherwise healthy application.
As an Amazon Associate I earn from qualifying purchases.
This is a control-plane problem, not necessarily a failure of the application’s compute or data plane. An app can still be running while it cannot authenticate a new user, renew an expired token, retrieve identity or device information, or obtain the policy decision it requires. Some applications keep honoring an established session; others need to contact an identity or policy service again and may deny access if they cannot.
Where the flow can break
- Identity or federation: The provider, directory lookup, or federation connection cannot authenticate the user.
- MFA: The user cannot complete a challenge because the factor or its delivery channel is unavailable.
- Token issuance or refresh: The provider cannot issue a new token, or the application cannot renew one that is expiring.
- Authorization and policy: A service cannot retrieve identity, device posture, or policy information needed to decide whether to allow access.
- Application session: Access fails at the app even though the app itself may still be serving other requests.
What users can do depends on their session state
| User or request state | Possible effect of an IdP outage | What to check |
|---|---|---|
| Existing session with a still-valid token | The user may continue working until the session or token expires, if the application accepts it without a live identity or policy check. | Whether the token remains valid and whether the app requires a live lookup for the action. |
| Session needs a token refresh | The user may lose access if the refresh request must reach the unavailable provider. | Whether refresh is failing, rather than the application’s underlying service. |
| New sign-in or interactive MFA required | The user may be unable to establish a session, even while other users remain signed in. | Whether the sign-in flow reaches the provider and whether the factor challenge can be completed. |
| Request requires current identity, device, or policy data | The application or access proxy may deny the request if it cannot retrieve required information. | Which lookup or policy dependency is unavailable and whether the configured behavior is fail-open or fail-closed. |
“SSO is down” therefore does not describe one universal state. An already-issued token is not the same thing as a fresh authentication, and an application’s response depends on its token handling and policy design.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What real incidents show about dependency chains
Cloudflare’s postmortem for June 12, 2025 reports an incident lasting 2 hours 28 minutes that affected Workers KV, WARP, Access, Gateway, Images, Stream, Workers AI, Turnstile and Challenges, AutoRAG, Zaraz, and parts of its dashboard. Cloudflare described Workers KV as a critical dependency for configuration, authentication, and asset delivery. The incident included identity synchronization failures and Gateway behaviors tied to retrieving identity and device-posture data.
Cloudflare says Access is designed to fail closed if it cannot successfully fetch policy configuration or a user’s identity. In specified Gateway scenarios during the incident, users with valid active authentication tokens were unaffected, while people who needed a new session or a token refresh could not proceed. The postmortem also reports that service-token, mutual-TLS, and IP-based policies were unaffected in that incident. These details describe Cloudflare’s products and that event; they are not guarantees about other providers or configurations.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Backup authentication has specific coverage and conditions
Provider-managed backup authentication can reduce disruption, but it does not necessarily provide a universal emergency sign-in path. Microsoft states: “The Microsoft Entra backup authentication system is made up of multiple backup services that work together to increase authentication resilience if there’s an outage.” Microsoft’s documentation describes supported scenarios and eligibility conditions rather than an unrestricted substitute for normal authentication.
Application patterns matter
Microsoft Entra’s documented backup system supports selected authentication patterns, including specified OAuth native-app, OIDC ID-token-only, and identity-provider-initiated SAML cases. The documentation lists OIDC access-token requests and service-provider-initiated SAML among unsupported patterns. An organization needs to check each application’s actual authentication flow instead of assuming that SSO coverage means backup coverage.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Eligibility depends on prior use
In the documented eligibility path, a user must have authenticated to the same application on the same device within the preceding three days, among other conditions. This is a prior-authentication window, not a promise that a session lasts three days or that a first-time user can sign in during an outage. Users who need interactive authentication are not covered by that path.
Policy settings affect resilience and security
Microsoft says some Conditional Access settings can limit or reduce backup-system resilience. During outage handling, certain policies cannot be evaluated in real time, so the system may rely on a previous policy evaluation. Disabling resilience defaults can also disable backup authentication for affected users. Review the exact policy behavior and security consequences with the identity and security teams; weakening a control simply to make fallback easier can create a different risk.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
An alternate MFA factor solves only some failures
A second factor can help when the primary factor’s delivery route fails, but it does not by itself establish independence from an IdP outage. In a January 2026 status entry, Okta attributed interruptions to a third-party provider issue affecting email destinations hosted by Microsoft Exchange Online. Some customers may have experienced delayed or failed automated email notifications, including MFA codes and enrollment links. Okta suggested alternate factors such as Okta Verify, security keys, or SMS. That incident concerned email delivery, not an Okta-wide authentication outage.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A FIDO2 security key is one possible alternate factor where the identity provider, user account, device, and configured authentication methods support it. Before relying on any alternate factor, check whether it uses a separate delivery channel and whether users can still reach the identity provider to complete authentication. A different factor is useful only for failure modes it actually bypasses.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Prepare applications and fallback paths before an outage
- Map critical access paths. For each business-critical application, record its authentication pattern, identity provider, federation route, MFA factor and delivery channel, token lifetime and refresh behavior, and critical downstream dependencies.
- Confirm provider fallback eligibility. Check which users, apps, tenant types, and cloud environments qualify for any managed backup authentication. Verify current product documentation rather than extrapolating from another application or user.
- Test distinct failure cases. Exercise an existing valid session, an expired session, a new device, an interactive MFA challenge, token refresh, user or credential revocation, and an outage affecting an MFA delivery channel. Record what users and administrators see in each case.
- Review policy behavior. Identify settings that block fallback or require live policy evaluation. Document the security trade-off and have the appropriate security owners review any proposed change.
- Check alternate-factor independence. Maintain another supported factor where appropriate, and verify that its channel and enrollment process do not depend on the same unavailable service.
- Assign response and recovery ownership. Rehearse incident communications across identity, application, network, and security teams, including who can confirm recovery and who communicates with affected users.
Diagnose the identity path, not just the app’s status
Start by separating provider health from application health. Determine which users and applications are affected, whether existing sessions still work, and whether failures occur at sign-in, MFA, token refresh, identity lookup, or policy evaluation. Check the provider’s service health and status information alongside application telemetry; a healthy application status alone does not establish that its sign-in dependencies are available.
Microsoft’s guidance for investigating unusual Microsoft Entra MFA sign-in activity notes that a rise in MFA sign-ins can reflect application configuration changes, brute-force activity, or regional network issues. Administrators are directed to review health alerts, affected entities, sign-in logs, audit logs, and network health rather than assuming every MFA anomaly is an identity-provider outage.
For incident records and communications, state the affected geography and tenant or customer scope, the start and end times with timezone, affected flows, whether existing sessions continued, the failed component, and what the provider changed. Use the relevant service-status entry or postmortem for event-specific details.
Read identity availability figures in context
Availability statistics are provider-reported measures, not a guarantee that every customer’s full sign-in path will work. Microsoft’s global Entra figures measure successful user authentication and token issuance across aggregated customers and geographies. Microsoft updated its calculation methodology in April 2025, so comparisons across that change require care.
| Figure | What it represents |
|---|---|
| 99.99% | Microsoft’s stated service-level availability target for Entra authentication in current documentation. It is the provider’s target, not an independent prediction for every customer workflow. |
| 99.999% in September 2026 | Microsoft Learn’s global aggregate Entra SLA attainment for that month, shown truncated to three decimal places and interpreted under Microsoft’s published methodology. |
| 99.999% versus 99.998% for April 2025 | Microsoft’s result under the revised calculation versus the prior calculation. Microsoft says the revised method includes successes from resilient infrastructure, such as backup authentication on retry. |
These measures describe Microsoft’s service under its stated methodology; they do not establish a universal probability or frequency of identity outages across providers.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
