Which scenario is recommended for the implementation of single sign-on (SSO)?

• A. Activating and creating FAW in the same cloud account where Fusion Application is available
• B. Activating FAW in a different cloud account from Fusion Application
• C. SSO is optional
• D. Use separate accounts for different services

Answer: (A)

Single sign-on works most reliably when the identity provider and the application share the same cloud account. When FAW (the identity-provider integration) lives in the same account as Fusion Application, the authentication boundary is straightforward, and you can configure and maintain the SSO connection in one place. This leads to a simpler trust relationship, consistent user provisioning, and uniform security policies (like MFA) across the app and its identity source. Tokens and sessions don’t have to cross between separate cloud accounts, which reduces latency, potential misconfigurations, and administration overhead.

If FAW were in a different cloud account, you’d need cross-account federation, which introduces extra layers of trust setup, token exchange, network considerations, and ongoing management. That added complexity makes SSO harder to configure correctly and maintain reliably. So the recommended approach is to activate FAW in the same cloud account where Fusion Application is available.