When using Security Assertion Markup Language (SAML), it is assumed that the principal subject enrolls with at least one identity provider. The principal subject is the entity that requests access to a resource or service, such as a user, device, or application. The identity provider is the entity that authenticates and asserts the identity and attributes of the principal subject, such as a directory service, a certificate authority, or a social media platform. The principal subject must enroll with the identity provider and obtain a credential, such as a username, password, token, or certificate, that can be used to prove its identity and authorization. References: CISSP All-in-One Exam Guide, Eighth Edition, Chapter 5: Identity and Access Management, page 216. Free daily CISSP practice questions, Question 1.