[samatcloudflare]

Happy to help. We can use our network, specifically our Access product, to check for identity. When a user requests an application, our network can stop that request and ask the user to show ID.

The difference is that we don't issue that identity. We aren't an identity provider, like Okta or Azure AD. Instead, teams integrate our Access product with their identity provider which tells us which sources of identity to trust (in the same way a bouncer or border guard doesn't create your identity card for you, but they know what a valid one looks like).