The security team has asked for a technical briefing on how authentication works with SailPoint.

The statement is correct. In SAML federation, the Entity ID uniquely identifies a participant in the trust relationship. When Identity Security Cloud is configured to use an external Identity Provider, the Identity Provider Entity ID entered in SailPoint must correspond to the EntityID specified in the IdP's SAML metadata.

This identifier helps Identity Security Cloud determine which trusted Identity Provider issued the authentication assertion. If the configured Entity ID does not match the expected IdP identifier, authentication processing can fail because the received federation information does not correspond to the configured trust relationship.

Administrators must also configure other SAML components correctly, including the Identity Provider login endpoint and signing certificate. The signing certificate enables Identity Security Cloud to validate the authenticity and integrity of SAML assertions received from the IdP.

It is also important to distinguish between the IdP Entity ID and the Identity Security Cloud Service Provider Entity ID. Each identifies a different side of the SAML relationship.

Study Guide Reference: Access Management — SAML Authentication, Identity Provider Configuration, Entity IDs and Federation Trust.

===============