CardSpace provides a consistent UI designed to help people to easily and securely use these identities in applications and web sites where they are accepted.

Resistance to phishing attacks and adherence to Kim Cameron's "7 Laws of Identity"[1] were goals in its design.

The user selects a card to use, and the CardSpace software contacts the issuer of the identity to obtain a digitally signed XML token that contains the requested information.

Other transactions may require a managed information card; these are issued by a third-party identity provider that makes the claims on the person's behalf, such as a bank, employer, or a government agency.

During the 2000s, identity providers that didn't wish to build STS could obtain one from a variety of vendors, including PingIdentity, BMC, Sun Microsystems, Microsoft, or Siemens.