June 2026 Summaries

Descope offers various authentication flow options, including embedded login, hosted login, and native flows, each serving different use cases and environments. Embedded login integrates the authentication UI directly into an application, providing a seamless user experience without redirection, which is ideal for applications where maintaining the same domain is crucial, such as fintech or consumer apps. Hosted login, on the other hand, redirects users to an external URL managed by Descope for authentication, ensuring credential isolation and simplifying compliance, which is beneficial for third-party platforms or when a centralized login page is desired. Mobile apps benefit from Descope's native flows, which render authentication within a webview, preserving the app's look and feel without exposing credentials to the app's frontend. These options can be used in combination, allowing teams to deploy the most suitable method for their specific needs while maintaining a consistent backend configuration managed by Descope.

ForgeRock, an enterprise identity and access management platform, has traditionally been favored by large organizations due to its extensive customization capabilities and support for complex IAM requirements. However, following a merger with Ping Identity and the rebranding of its products, many organizations are reassessing their identity infrastructure needs in light of modernization and operational simplicity. With the evolving landscape of identity requirements, including the need for flexible authentication, tenant-aware identity, and adaptive MFA, companies are exploring alternatives that offer cloud-native capabilities and reduced complexity. Descope is highlighted as a strong candidate for those seeking to modernize identity systems with its cloud-native CIAM platform, visual workflows, and comprehensive support for modern identity use cases. Other alternatives like Auth0, Amazon Cognito, Firebase Authentication, Keycloak, and Ory are also considered based on factors such as cloud integration, self-hosting preferences, and specific enterprise needs. These alternatives offer varying degrees of flexibility, operational overhead, and integration capabilities, catering to diverse organizational requirements as they navigate the transition from legacy IAM platforms.

As applications grow and require more nuanced, relationship-driven permissions, traditional Role-Based Access Control (RBAC) often falls short, leading to "role explosion" and cumbersome attribute checks. This transition necessitates the adoption of Relationship-Based Access Control (ReBAC), which focuses on the relationships between users and resources rather than static roles. ReBAC, exemplified by Google's Zanzibar system, allows for fine-grained authorization by modeling permissions as a schema of types and relations, supporting dynamic environments where access follows ownership, membership, and delegation. Descope facilitates this transition from RBAC to ReBAC by enabling organizations to iteratively model existing latent relationships, define schemas of types and relations, and incrementally migrate data and authorization logic. This approach provides more structured, queryable, and auditable access controls, suitable for collaborative applications, multi-tenant platforms, and hierarchical systems, without the need for a complete overhaul of existing authorization models.

Authentication is a critical aspect of user experience in modern applications, as it is often the first interaction users have with a product. A seamless and branded authentication process can enhance trust and satisfaction, while rigid or generic experiences can create friction. Various platforms offer solutions to build custom authentication experiences, focusing on different aspects like flexibility, security, integration, and developer experience. Descope provides a flexible approach with visual workflows and embedded components, allowing for branded and seamless login experiences. Auth0 offers a mature platform with extensive customization for hosted login experiences, while Microsoft Entra External ID integrates well with Microsoft ecosystems for enterprises. Amazon Cognito provides cloud-native authentication within AWS, and Supabase offers developer-friendly, API-first solutions. Firebase Authentication is ideal for mobile-first applications within the Google ecosystem, Keycloak offers open-source control for self-hosted environments, and Ory provides API-first, headless architecture for full customization. Choosing the right platform depends on your product's specific needs, such as branding, integration, and scalability, to ensure authentication aligns with the overall design and user journey.

Azure AI Foundry, a managed platform by Microsoft, is enhanced by Descope, which provides a cloud-neutral agent identity management system that complements Microsoft Entra Agent ID. While Entra Agent ID handles agent registration, Conditional Access, and token issuance for Microsoft resources, Descope fills in the gaps by offering issuance-time policy enforcement, a credential vault for non-Microsoft services, and an OAuth 2.1 authorization server for broader resource management. Descope addresses limitations in Entra External ID, such as lacking CIBA and Dynamic Client Registration, by offering features like asynchronous human approval and resource-level access control. The integration of Descope with Microsoft Entra Agent ID allows for a unified identity chain, where Entra attests an agent's identity and Descope governs its actions on a per-request basis, centralizing enforcement at the point of token issuance. This collaboration ensures that agents can securely operate across multiple clouds while maintaining robust identity and authorization controls.

Descope enhances Google Vertex AI by providing a cloud-neutral identity management system that complements Google's Agent Identity, which assigns SPIFFE-based cryptographic identities to agents within Google Cloud. While Google Identity Platform handles user sign-in with authentication, it lacks the granular authorization capabilities that Descope introduces, such as issuance-time policy enforcement, a credential vault, and an OAuth 2.1 authorization server for resources beyond Google Cloud. Descope's system evaluates authorization at token issuance and offers a centralized directory for managing agents across different cloud environments, providing a unified approach to token management, application authorization, and sensitive action approvals using CIBA. By integrating Descope with Google Vertex AI, organizations can enjoy a more comprehensive identity management framework that accommodates both Google and non-Google services, thereby ensuring a more robust and flexible security model for AI agents.

Amazon Bedrock's AgentCore serves as AWS’s managed platform for operating production agents, offering workload identity management and credential storage through a token vault, but it faces limitations when extending beyond AWS's ecosystem. Descope complements AgentCore by providing a cloud-neutral agent directory, comprehensive credential vaulting, and an OAuth 2.1 authorization server that covers capabilities absent in Cognito, such as Client-Initiated Backchannel Authentication (CIBA) and Dynamic Client Registration (DCR). Integrating Descope with AgentCore allows for more granular policy enforcement and observability across multiple cloud environments, enabling seamless management of agent identities and authorization processes. While AgentCore excels in AWS-specific operations including IAM and SigV4 authorizations, Descope enhances cross-cloud functionality by offering a unified directory and credential management for agents operating in different runtimes. Both systems can be used in tandem to leverage their respective strengths, making it easier to manage and secure agents across diverse cloud infrastructures.

Descope Policies have been significantly enhanced, providing a robust policy engine that governs access to enterprise resources or downstream connections for applications, OAuth clients, and AI agents. These policies, acting as an access governance layer, allow organizations to define and enforce authorization rules at the token boundary, ensuring agents can only access requested scopes after authorization checks. Policies can be tailored using conditions based on various attributes like user roles, client names, and client statuses, allowing for precise access control. They can target connections, such as OAuth and API key-based services, granting access to specific parts of a connection, or targeting resources, enabling scoped and delegated access to MCP servers and product APIs. Real-world use cases illustrate how single-client policies can restrict access to specific tasks, or how multi-grant type policies can differentiate actions based on whether a human is involved. Overall, Descope Policies offer a flexible and easy-to-administer solution for managing secure access to protected resources.

The Descope Agentic Identity Hub introduces a comprehensive identity support system for autonomous agents, allowing them to securely authenticate and access resources without human intervention. This support addresses the challenges of identity management for non-interactive agents, which require secure methods to avoid identity anti-patterns such as hard-coded secrets, long-lived API keys, and OAuth tokens, which can lead to vulnerabilities. By providing dedicated, auditable identities with policy-backed access, Descope enables organizations to govern both external and internal autonomous agents efficiently. The system allows for the registration, authentication, and management of autonomous agents as OAuth clients, ensuring they have just-in-time access to needed resources while maintaining a clear audit trail of activities. A practical example is highlighted with n8n workflows and a BigQuery MCP server, illustrating how agents can be authenticated and authorized through Descope to perform tasks securely and efficiently without holding sensitive credentials.

The Descope MCP Server is a newly announced remote server designed to connect AI assistants with the Descope identity platform, enabling users to manage identity infrastructure using natural language commands. It supports both build-time and operate-time work in a single session, facilitating seamless transitions from planning to deployment. The server's functionality spans a wide range of operations, including managing users, tenants, authentication flows, and audit logs, with a security model that ensures write operations are only performed with explicit user consent through a time-bound elevation process. The Descope MCP Server is accessible via various MCP clients, and sessions are company-scoped, allowing users to switch between projects within the same company. Comprehensive logging of authentication events and session details is provided for audit purposes.

Descope Skills provide AI agents with specialized knowledge to accurately and efficiently build identity and authentication systems, addressing common concerns about AI reliability in software development. These skills equip agents with reusable expertise for handling tasks such as authentication, authorization, migrations, auditing, and infrastructure management, which reduces repeated explanations and enhances consistency across projects. By utilizing Descope Skills, developers can streamline the creation of production-ready identity workflows, avoid typical pitfalls associated with generic AI outputs, and ensure that agents produce secure, scalable, and well-functioning systems. Descope Skills are accessible on platforms like GitHub and can be easily integrated into existing projects, offering a structured solution for improving AI-driven development processes.

Descope provides a flexible identity management framework tailored for B2B CIAM platforms, addressing the need for both shared-user and tenant-level user models. While the shared-user model is suitable for most SaaS products, allowing users to maintain a consistent identity across multiple tenants, certain scenarios such as white-label reselling, franchise networks, and regulated multi-brand operations require tenant-level isolation where a single user can have distinct identities across different tenants. Descope's tenant-level users feature enables this by isolating login credentials, MFA states, and user profiles per tenant, ensuring complete independence and compliance with specific business needs. This feature integrates seamlessly with Descope's existing enterprise readiness suite, including SSO, RBAC, SCIM provisioning, and more, without disrupting existing B2B authentication functions. Organizations needing full isolation can enable this setting in their project configurations, ensuring users are siloed per tenant, while others can maintain the default shared-user setup, allowing for seamless transitions across workspaces.

As applications scale to millions of users, authentication becomes a crucial component, impacting conversion rates, security, and user experience. High-scale applications require identity systems that provide fast signups, reliable logins, and adaptive security, while also supporting enterprise federation and handling traffic spikes. Key considerations include the system's architecture, growth expectations, performance needs, and long-term identity management plans. Various platforms such as Descope, Auth0, Microsoft Entra External ID, Amazon Cognito, Firebase Authentication, Keycloak, and Ory offer different strengths, including scalability, customization, and integration capabilities. Descope is noted for its flexible, scalable authentication infrastructure, accommodating high-scale workloads through visual workflows and comprehensive identity orchestration. Each platform suits different needs based on factors like the existing cloud environment, customization requirements, and desired developer experience, with choices ranging from managed services to open-source solutions that provide full control over identity systems.

Kinde is an authentication platform designed for developers to quickly add login and user management features to applications without building identity infrastructure from scratch, appealing mainly to startups and early-stage applications. However, as applications grow, developers often seek alternatives due to Kinde's limitations in enterprise readiness, customization, and scalability. Modern applications increasingly demand flexible authentication orchestration, enterprise onboarding, adaptive MFA, and tenant-aware identity, which Kinde struggles to adequately provide. This has led teams to explore alternatives like Descope, Auth0, Amazon Cognito, Firebase Authentication, Keycloak, and Ory, each offering various strengths such as enterprise federation, customization capabilities, and integration flexibility to meet complex identity and access management needs. Descope, in particular, is highlighted for its comprehensive CIAM platform that unifies authentication, authorization, and identity orchestration, offering a more scalable and enterprise-ready solution compared to Kinde's lighter-weight approach.

The EU AI Act is a groundbreaking regulatory framework that establishes comprehensive rules for artificial intelligence systems, focusing on transparency, accountability, security, risk management, and human oversight. It applies to both AI providers who build or supply AI systems and deployers who use third-party AI models or integrate AI into products and workflows, emphasizing the need for organizations to understand where AI is used, who can access it, and how its decisions are managed. The Act uses a risk-based model, applying stricter requirements to systems with higher potential for harm, and sets compliance deadlines starting in August 2026. As organizations navigate these regulations, identity management becomes crucial for securing AI systems, with tools such as authentication, authorization, delegated access controls, and audit logging playing essential roles. Descope offers solutions to help organizations meet these requirements by providing identity, access management, and workflow orchestration capabilities designed for modern AI applications, ensuring compliance and security in the evolving landscape of AI governance.

World Password Day, celebrated annually on the first Thursday of May since 2013, aims to raise awareness about digital hygiene and encourage password security audits. Despite growing consumer awareness, passwords remain a significant security vulnerability, with a third of consumers reporting account compromises in the past year. The FIDO Alliance promotes World Passkey Day, highlighting the adoption of passkeys as a more secure alternative. Their 2026 report shows that consumer awareness of passkeys has reached 90%, with 75% enabling them on at least some accounts, while 68% of organizations are implementing passkeys for employee authentication. The transition to passkeys is driven by the need for enhanced security, faster logins, and reduced support costs, with early adopters reporting improved security postures and employee satisfaction. However, barriers such as legacy system compatibility and budget constraints persist. The report suggests that organizations can overcome these obstacles by integrating passkeys with existing infrastructures, as demonstrated by companies like Descope, which offer simplified implementation solutions.