The central service is the identity provider (IdP), for example Microsoft Entra ID, Keycloak, Authentik or Okta. Applications (service providers) no longer check passwords themselves; they trust a signed assertion from the IdP. The usual protocols are SAML 2.0 and OpenID Connect.
Operationally this gives you one place for password rules and MFA, instant revocation of all access when someone leaves, and fewer password tickets. The price is a central dependency: if the IdP is down, nobody gets into the applications.
Typical setup problems: clock skew between IdP and application, wrongly mapped attributes (email instead of username), and local admin accounts forgotten during the switch that are then missing as break-glass access.