Choosing an identity service
If your service will be accessed by UK citizens and residents outside the education sector you should use the Gov.UK One Login service to minimise the number of government logins the citizen needs to have.
If your service needs to take advantage of the additional data that is provided by DfE Sign-in then you should use that instead.
DfE Sign-in is also mandated for authorisation of users who are representing organisations that are recognised by the department (also referred to a B2B authorisation).
For DfE staff you will need to authorise via EntraID so that access so your service can be linked to the on and offboarding process for staff members.
You should record the decisions as to which authorisation methods you are using as an Architectural Decision Record.
Other user types
If the users you need to authenticate are not covered by the options above you are going to need to create an authentication path suitable for your use case. Please consult with the portfolio SIRAs and technical architecture to help review options and see if your use case has been encountered previously.
Resilience
When using any external sign-in service you should decide what will happen if the external service is unavailable. As a default you should be able to enter a maintenance mode if a service you are dependent on is unavailable.
You may want to invest in fallback mechanisms such as authentication by email or username and password.
Whatever you choose you need to document how to handle the disruption in your service documentation. You may also want to provide design decisions via your design history or architectural decision records.
Multi-factor authentication (MFA)
MFA is recommended for all authentication paths and must be used for users who have access to high-risk or privileged functionality or data.
MFA may be provided by your chosen authentication provider in which case it is your responsibiity to ensure that the configuration is correct to enforce MFA.
You also may want to create an MFA path within your service to help confirm high-risk actions such as deletions or service configuration alterations.
See also Authentication guidance