Home > Integrated Products > VxRail > Guides > Architecture Guide—VMware Cloud Foundation on VxRail: VCF 5.x on VxRail 8.x > Isolated SSO workload domains
Isolated SSO WLDs give administrators the option to configure new WLDs using a separate Single Sign On (SSO) instance. This scenario is useful for large enterprises that need workload isolation and for Managed Service Providers (MSPs) who can allocate WLDs to different tenants with their own SSO domains. Isolated SSO domains are each configured with their own NSX instance. The added benefit is that configuring WLDs as an isolated WLD also allows the option to configure a separate identity provider (Active Directory or LDAP).