Draft OMB Memo Would Make Login.gov the Default Sign-On Across Federal Websites

The Office of Management and Budget has circulated a draft policy that would require federal agencies to use Login.gov for most public-facing services, including any website or digital platform that asks users to authenticate.

Under the draft, sent to agencies for review on Monday, agencies get 60 days to give OMB an inventory of existing public-facing websites with authentication, and six months to develop a broader digital identity risk management review. The memo requires the use of Login.gov but does not bar agencies from offering other authentication methods alongside it.

OMB Director Russell Vought cited the absence of a governmentwide digital identity strategy and an executive order on improving digital design in government. The draft argues the current patchwork raises costs and burdens the public. “As the use of Login.gov for identity verification increases, the government realizes cost efficiencies from economies of scale and a reduction in duplicative verification costs,” it says.

The General Services Administration would take on a coordinating role, convening quarterly meetings with agencies, publishing an implementation guide, hosting industry days with commercial digital identity providers and reporting back to OMB. Agencies would adopt those best practices and start reporting user volume and performance metrics.

Login.gov launched in 2017 to satisfy a statutory single sign-on requirement. A roadmap published in December 2025 put it in use at more than 50 federal and state agencies, with work underway to integrate mobile driver licences. The most recent published usage figures, from October 2024, list over 100 million accounts and more than 300 million sign-ins a year. Agencies have kept alternatives in place, with the IRS using ID.me and Medicare.gov offering a choice of Login.gov, ID.me and CLEAR.

The service has been adding capability and suppliers through the year. Xcelerate and Socure won a $163 million call order for identity proofing in July, LexisNexis Risk Solutions expanded its role this month, and GSA is separately seeking device fingerprinting to separate people from bots and AI agents.

Whether a memo changes agency behaviour is a separate question. Jeremy Grant, a former senior executive adviser for identity management at NIST and now at Venable, said there is “a large stack of OMB IT policy memos over the years where agencies have not faced many consequences for not following them, or for slow-rolling implementation.” He added: “The real question is: What will they do to enforce the memo?” A House panel heard in July that the federal identity model cannot keep up with AI-driven fraud. GSA and OMB did not respond to a request for comment.

Sources: FedScoop

–

By the ID Tech Editorial Team