Federated Identity and Access Management (IAM) systems enable users to access multiple independently administered services through shared identity and authentication mechanisms. Although federation improves usability, scalability, and centralized identity governance, it also creates security dependencies across identity providers, service providers, authentication protocols, token exchanges, and trust relationships. A compromise at one component may consequently propagate across organizational boundaries. This paper proposes a STRIDE-based cybersecurity framework for systematic threat detection in federated IAM environments, with particular emphasis on federated Single Sign-On (SSO) and Multi-Factor Authentication (MFA). The framework maps major federated IAM components and trust boundaries to the STRIDE threat categories of spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege. The methodological design combines architectural threat decomposition, trust-boundary analysis, threat-to-control mapping, and structured assessment of observable security events. Statistical concepts concerning correlated binary outcomes are incorporated to support future empirical evaluation where authentication or detection observations are non-independent. The proposed framework identifies identity-provider compromise, assertion or token manipulation, authentication-event repudiation, sensitive identity-information exposure, federation service disruption, and privilege escalation as principal threat classes. The analysis indicates that security controls should not be evaluated independently at individual components because federated authentication creates interdependent attack surfaces. The framework therefore provides a structured foundation for threat detection, risk prioritization, and security-control validation in federated IAM architectures.