An identity layer built on OAuth 2.0 that lets applications verify who a user is, not just what they may access. It adds the ID token — a signed JWT describing the authenticated user — plus standard endpoints for discovery and key retrieval. Modern web and mobile sign-in against providers such as Entra ID is almost always OIDC.