Cybersecurity glossary
What is Identity and Access Management (IAM)?
Learn what Identity and Access Management (IAM) is, how identity lifecycle, authentication, authorization, and governance fit together, and which IAM practices reduce breach impact.
Definition
Identity and Access Management (IAM) is the discipline and technology set that creates, maintains, authenticates, authorizes, audits, and eventually retires digital identities for people, devices, and workloads across an organization’s systems.
Why IAM is a security control plane
Most modern intrusions abuse identities rather than exotic memory bugs. Identity and Access Management (IAM) is the control plane that decides which human and machine identities exist, how they authenticate, what they can reach, and whether that access still makes sense tomorrow.
When IAM is weak, every other control—WAF, EDR, encryption—protects a door that attackers already walked through with a valid key.
The IAM capability map
Identity lifecycle
Create, change, and retire accounts for employees, partners, customers, and workloads.
Authentication
Passwords, MFA, passkeys, certificates, and federation prove identity claims.
Authorization
Roles, attributes, policies, and scopes limit actions on resources.
Governance
Access reviews, SOD checks, and certification keep entitlements honest.
Privileged access
Vaulting, just-in-time elevation, and session recording for admins.
Visibility
Audit trails for login, consent, elevation, and sensitive data access.
How IAM operates day to day
Authoritative sources define people and orgs
HR, contractor systems, or CI pipelines become sources of truth for who should exist.
Provisioning creates or updates accounts
Directories, IdPs, and SCIM connectors grant baseline access for the role.
Users and workloads authenticate
SSO, MFA, and workload identity establish sessions or tokens.
Policies authorize requests
Applications and cloud platforms evaluate roles, attributes, and scopes.
Reviews and offboarding close the loop
Unused access is removed; leavers lose sessions and credentials quickly.
Human vs non-human identities
| Identity type | Examples | Common gap |
|---|---|---|
| Workforce | Employees, contractors | Slow mover/leaver updates |
| Customer / CIAM | End-user accounts | Weak recovery and bots |
| Privileged | Domain admins, cloud owners | Standing permanent admin |
| Workload / machine | Services, CI bots, RPA | Shared secrets, no owner |
IAM improvement checklist
- Maintain an inventory of human and non-human identities with clear owners.
- Enforce phishing-resistant MFA at the IdP for privileged and remote access.
- Automate joiner-mover-leaver with SCIM or equivalent connectors.
- Replace standing admin with just-in-time and time-bound elevation.
- Run periodic access certifications for sensitive roles and SaaS OAuth grants.
- Centralize auth and admin audit logs in a SIEM with retention suited to investigations.
- Separate duties for identity admins, security reviewers, and system operators.
- Treat customer identity and workforce IAM as related but differently risk-modeled programs.
The practical takeaway
IAM is how digital trust is issued, constrained, and withdrawn. It spans directories, SSO, cloud policy, privileged access, and governance—not a single login screen.
Invest in lifecycle automation, strong authentication, least privilege, and auditable access changes; those four themes prevent more real breaches than almost any perimeter upgrade.
Related security terms
Identity Provider (IdP)
Central service that authenticates users and issues identity assertions.
Authentication, Authorization and Accounting (AAA)
Runtime control loop closely related to IAM outcomes.
Privileged Access Management (PAM)
Specialized IAM controls for elevated administrative access.
System for Cross-Domain Identity Management (SCIM)
Protocol commonly used to provision identities into SaaS apps.
Least Privilege
Core IAM principle for limiting entitlements.
Frequently asked questions
What is IAM in simple terms?
IAM is how an organization decides who gets a digital identity, how they prove it, what they can access, and how that access is reviewed and removed when no longer needed.
Is IAM only about passwords and SSO?
No. SSO is one piece. IAM also covers provisioning, roles, privileged access, audits, federation, machine identities, and access certification.
What is the identity lifecycle?
Joiners get accounts, movers change roles and entitlements, leavers lose access. Strong IAM automates these transitions and verifies them continuously.
How does cloud IAM differ from classic IAM?
Cloud IAM adds hyperscaler policy engines, workload identities, and API-driven entitlements, but still needs lifecycle, least privilege, and audit discipline.
What are common IAM failures in breaches?
Standing admin rights, slow offboarding, weak MFA, excessive OAuth grants, orphaned service accounts, and missing logs for privileged actions.
Where should teams start improving IAM?
Inventory identities, enforce MFA on IdP and remote access, remove unused privileges, automate joiner-mover-leaver, and monitor privileged activity.
How do IAM and PAM relate?
PAM is the specialized subset of IAM focused on elevating, vaulting, recording, and tightly controlling administrative access.
References
Explore authoritative guidance and frameworks related to identity and access management (iam).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.