For a federated identity solution, a third-party Identity Provider (IdP) is PRIMARILY responsible for which of the following?

Access Control is a policy enforcement function performed by the relying party or SP, not the IdP; the IdP only provides identity claims, not resource-level access decisions.

Account Management (provisioning, deprovisioning, password resets) is an administrative function typically handled by the organization's directory service or HR system, not the federated IdP's primary role.

In federation, the IdP's core function is to verify the user's identity (authentication) and issue a signed assertion or token (e.g., SAML assertion, JWT) that vouches for that identity to the Service Provider (SP) or relying party. The IdP does not control what resources the user can access - it only attests to who the user is, making authentication its primary responsibility.

Authorization - determining what an authenticated user is permitted to do - is the responsibility of the Service Provider or resource server, which consumes the IdP's identity assertion to make its own access decisions.