Identity and Access Management (IAM)

Technical explanation

IAM covers identity proofing and onboarding, account lifecycle management, authentication, authorisation, federation, privileged access, access review, and audit. Policies evaluate subjects, resources, roles or attributes, authentication strength, device or contextual signals, and the requested action. IAM applies to people, services, workloads, APIs, and increasingly AI agents.

Business relevance

Effective IAM reduces unauthorised access, supports least privilege, enables secure collaboration, and provides evidence for audits and incident response. Weak identity controls are a common path to data exposure and operational compromise.

Implementation example

An organisation connects applications to a central identity provider, requires phishing-resistant MFA for administrators, automatically removes access when employment ends, and reviews privileged roles quarterly.

Limitations and common misconceptions

IAM does not eliminate insider threats, software vulnerabilities, or poor data governance. Centralisation can create a high-impact dependency, while excessive role complexity and stale entitlements can undermine otherwise strong authentication.

Topics

Sources