I'd feel _more_ sketched out if a provider was handling it themselves. I don't know how much I want someone unqualified handling the storage of this themselves...
Outsourced to Ping? Ok. Outsourced to some identity SaaS I never heard of that just closed their series B? Pass.
But then obviously I'd expect Microsoft to own their own identity story, and if they ever didn't I would immediately suspect I wasn't actually even dealing with Microsoft.
What seems really sketchy to me is the third party together with a lot of the language in the press release - Roblox does not store raw ID document nor the selfie data.
Outsourced to Ping? Ok. Outsourced to some identity SaaS I never heard of that just closed their series B? Pass.
But then obviously I'd expect Microsoft to own their own identity story, and if they ever didn't I would immediately suspect I wasn't actually even dealing with Microsoft.