Shibboleth facilitates federated access management where the user's home institution authenticates the user and the Service Provider decides, on the basis of attributes received from the home institution, what authorisation, if any, the user has to access a networked resource. The implementation of Shibboleth at Oxford interoperates with MFA-based Single Sign On to enable authenticated access to trusted networked systems (whether the user is within or outwith Oxford)