What does SAML stand for?
SAML stands for Security Assertion Markup Language. An XML-based standard for exchanging authentication assertions between an identity provider and a service provider. It is common for enterprise web SSO.
SAML is an XML-based OASIS standard for passing authentication and authorization statements, called assertions, between an identity provider and a service provider. In the usual web flow the browser carries a signed assertion from the identity provider to the application, which trusts it because it holds the provider's certificate. The current version is SAML 2.0.
SAML in practice: an example
A user opens a cloud CRM. The CRM, the service provider, redirects the browser to the company's identity provider. After sign-in the identity provider returns a signed assertion saying who the user is and which groups she belongs to, and the CRM lets her in without ever seeing her password.
What SAML is confused with
SAML vs OAuth and OpenID Connect: what is the difference?
SAML uses XML assertions and is common in enterprise web SSO. OAuth 2.0 is for delegated authorization to APIs, and OpenID Connect adds sign-in on top of it using JSON tokens.
SAML vs SSO: what is the difference?
SAML is a protocol; SSO is what the user experiences when it works. What SSO stands for
Which exams cover SAML?
SAML is on the official CompTIA acronym list for three of the four exams covered here.
- Security+ SY0-801: 4.5 (Security Operations). Listed there as “Security Assertions Markup Language”.
- Network+ N10-009: 4.0 (Network Security).
- A+ 220-1201 and 220-1202: 220-1202 2.0 (Security). Listed there as “Security Assertions Markup Language”.
Each number is a CompTIA exam objective and the name in brackets is its domain. The exam puts the term in a scenario; it does not ask you to recite the expansion.
Check yourself: two practice questions
Written by CertSprint for this page. They are not taken from any exam.
1. In a SAML sign-in, which party authenticates the user?
- The service provider
- The identity provider
- The browser
- The certificate authority
Show the answer
B. The identity provider. The identity provider checks the credentials and issues the assertion. The service provider only validates the assertion's signature and content.
2. Why does a service provider trust a SAML assertion?
- It arrives over UDP
- It is digitally signed by the identity provider
- It contains the user's password
- It was sent from a private IP address
Show the answer
B. It is digitally signed by the identity provider. Trust comes from the signature, verified with the identity provider's certificate. The password never travels to the service provider.
Sources: OASIS: SAML V2.0 Technical Overview; NIST glossary: Security Assertion Markup Language. The acronym and its expansion come from CompTIA's official acronym lists, linked from each exam glossary above. The explanation, example and questions are CertSprint's own, checked against these sources on 11 November 2026.