Instead of every application checking passwords itself, applications redirect users to the IdP, which verifies them and returns a token or assertion (SAML, OIDC, Kerberos tickets). The IdP concentrates authentication policy — MFA, conditional access, session rules — in one control point for many services.
Key points
Critical-infrastructure protectionCompromise of the IdP or its signing keys yields tokens for every connected application; harden, monitor, and restrict it accordingly.
Federation standardsPrefer OIDC or SAML federation over local accounts per application so policy, offboarding, and MFA apply consistently.
Important limitationCentralization concentrates both control and risk. An IdP outage or compromise affects everything that trusts it, and it cannot see what users do inside each application after tokens are issued.