Hi DISCLAIMER: I belong to the company that is a distributor of Stealthbits (part of Netwrix) in Southern Europe, so I just going to mention this option. Stealthbits based the privilege assignments in activities, instead of the access. That's why they call their solution…

SSO is one of the most secure ways to authenticate a user. However, as usual, it depends on how the deployment is made.  The access to the SSO platform (Microsoft, OneLogin, Okta, ...) should be protected with a strong 2FA/MFA method, passwordless if possible On the other…