Draft OMB memo mandates agency use of Login-dot-gov on government websites

The Office of Management and Budget is circulating a new draft policy that would enforce the use of Login-dot-gov, the federal government’s single sign-on service, “for most public facing services,” including websites and digital platforms that require authentication.

According to a draft version of a memo sent Monday to agencies for review, agencies would have 60 days to provide OMB with an inventory of existing public-facing websites with authentication, and six months to develop a broader digital identity risk management review as part of the mandatory shift to Login.

In the draft memo viewed by FedScoop, OMB Director Russell Vought cited the lack of a governmentwide strategy for managing digital identity and President Donald Trump’s executive order on improving digital design in government as justifications for the new policy. It argues the current patchwork of digital-identity solutions used by federal agencies results in increased costs and is a hassle to Americans seeking to get government information.

“As the use of Login.gov for identity verification increases, the government realizes cost efficiencies from economies of scale and a reduction in duplicative verification costs,” the draft memo said. “Increased use…also supports the government’s security posture, enabling deployment at scale of leading technologies and security practices to prevent and respond to emerging threats.”

The most recent usage numbers on its recently defunct frequently asked questions site say the service hosts over 100 million user accounts and more than 300 million sign-ins annually, as of October 2024.

The draft memo also tasks the General Services Administration with convening quarterly meetings with agencies to get feedback on the service and publish a guide on best practices for implementation, hosting industry days with commercial digital-identity providers and reporting to OMB on “opportunities…to further customer experience.”

Agencies in turn would be required to adopt GSA best practices for implementing Login and begin reporting on user volume and performance metrics around their usage of the system. 

Login, which launched in 2017, was created to fill a statutory requirement for agencies to establish a single sign-on platform for government website logins. According to a December 2025 roadmap, the service was used at over 50 federal and state agencies and work to expand the platform was ongoing, including integrating mobile driver’s licenses.

Despite having the service as an option, agencies still choose to provide other verification methods as well. Notably, the IRS uses ID.me as a verification service for those accessing tax returns, and Medicare.gov has three different identity verification services that users may choose from: Login, ID.me and CLEAR. 

Login also has areas that could be improved, as documented by the Government Accountability Office. 

In June 2025, for example, GAO said Login made strides to close the gap between it and commercial products, but there were still issues with the service’s data-protection practices. It recommended testing its data backups to prevent loss of information in the event of a breach.

Earlier this month, GSA announced that it was collaborating with the Trump-created National Design Studio to improve its user experience ahead of the 10th anniversary of the service. 

A government IT leader who reviewed the document and was granted anonymity to be more candid said the draft memo’s aim to push the government closer to single sign-on has always been a goal, and they were supportive of its contents.

They theorized that the draft could be a byproduct of outgoing Federal Chief Information Officer Greg Barbaccia’s unique presence at the GSA. Barbaccia, who has plans to leave government at the end of the month, also served as acting director of GSA’s Technology Transformation Services. 

A GSA official, who was also granted anonymity to be more candid, said the memo has been in the works for many months, but it was a goal to have it completed before Barbaccia left government. While his dual positions may have helped this effort to come to fruition, they said, the future is more uncertain with a new TTS lead and no current picks for federal CIO. 

Sam Corcos, the Treasury Department’s CIO who entered the federal government as a member of the so-called Department of Government Efficiency, recently took up the reins of TTS and replaced Greg Hogan as acting assistant commissioner of Login. In a move similar to Barbaccia’s dual roles, Corcos will remain at Treasury while working three jobs at GSA.  

Login may also be facing staffing issues like other federal programs, the GSA official said. While scaling up the infrastructure to meet demand could be feasible, having enough support staff might not be, they said.

GSA and OMB did not respond to a request for comment by the time of publication.

Jeremy Grant, a former senior executive advisor for identity management at the National Institute of Standards and Technology and now managing director of technology business strategy at law firm Venable, said the draft OMB memo as written appears to continue efforts to implement a single sign-on service across the federal government that began in the waning days of the Obama administration and continued under the first Trump and Biden administrations. 

But he said that while that is a noble goal and the OMB memo may prompt greater adoption by federal agencies, it’s not a given. There is “a large stack of OMB IT policy memos over the years where agencies have not faced many consequences for not following them, or for slow-rolling implementation,” he said.

“From a customer experience perspective, it certainly makes sense to make it easier for people to use a single login across all of their interactions with the federal government,” Grant said. “But the real question is: What will they do to enforce the memo?”