An organization is selecting a SaaS provider to replace its legacy, in house Customer Resource Management (CRM) application. Which of the following ensures the organization mitigates the risk of…

Multi-factor authentication strengthens the security of the login process but still requires users to maintain a separate credential set for the SaaS application, not eliminating the credential sprawl problem.

Encrypting password transmission and storage protects credentials from interception and data breaches but does not remove the need for users to manage a distinct username and password for the SaaS platform.

Secure hash file exchange is a file integrity verification mechanism and has no relevance to user authentication or the management of identity credentials across applications.

Role-based access control defines what resources and actions are permitted after a user has already authenticated and does not address how users prove their identity or whether they need a separate credential to do so.

Directory services federation, implemented via protocols such as SAML 2.0 or OIDC, establishes a trust relationship between the organization's on-premises or cloud identity provider and the SaaS application, so users log in once with corporate credentials and are granted access without a separate SaaS account. This directly eliminates the risk associated with managing a parallel set of credentials - including password reuse, orphaned accounts, and deprovisioning delays - because the SaaS application defers all authentication decisions to the authoritative corporate directory. Centralized identity management also simplifies access revocation when an employee leaves the organization.