Several SaaS providers support identity federation for authentication. Which of the following would BEST assist in enabling federation?

SAML is an open XML-based standard that defines how identity assertions are created, signed, and exchanged between an Identity Provider (IdP) and a Service Provider (SP), which is the exact mechanism that enables federated authentication. When a user authenticates once with their IdP, SAML assertions carry that authentication context to SaaS providers, enabling SSO without each provider needing to manage user credentials. It is the foundational protocol for enterprise identity federation and is natively supported by major SaaS platforms and identity providers such as Azure AD, Okta, and Google Workspace.

NTLM (NT LAN Manager) is a legacy Windows challenge-response authentication protocol designed for local network authentication, and it does not support cross-domain or cross-organization identity federation.

MFA (Multi-Factor Authentication) is an additional verification layer that can be layered on top of a federated identity solution but does not itself enable federation or the trust relationships between identity and service providers.

PKI (Public Key Infrastructure) provides the certificate-based cryptographic underpinning that can be used within SAML to sign assertions, but PKI alone does not define the federation protocol, assertion format, or SP/IdP trust model needed for federation.