An organization is moving its human resources system to a cloud services provider. The company plans to continue using internal usernames and passwords with the service provider, but the security mana

Two-factor authentication adds a second verification step but does not prevent the service provider from receiving or storing the primary password, failing the core security requirement.

Account and password synchronization explicitly copies or replicates passwords to the service provider's directory, which directly violates the requirement that the provider must not have access to company passwords.

Smartcards with PINs replace passwords with certificate-based authentication, which changes the authentication method rather than preserving the use of existing internal usernames and passwords as required.

Federated authentication uses a trust relationship between the organization's identity provider (IdP) and the cloud service provider, where the IdP authenticates the user and issues a token (e.g., SAML assertion) to the service provider. The service provider trusts the token but never sees or stores the actual password, satisfying the requirement that the provider cannot access company credentials. This preserves the use of existing internal usernames and passwords while keeping credential management entirely within the organization.