> How well does it actually work in practice? This is down to quality of implementation. Is your IdP any good? Do you have good management practices around acc

> How well does it actually work in practice? This is down to quality of implementation. Is your IdP any good? Do you have good management practices around access control? Do your applications check authorization properly? > How does the authorization part work? Role information is passed to applications. It is the responsibility of applications to check authorization, in whichever way the developers of each application see fit. I hope this helps! Please don't hesitate to ask if you have further questions.