Identity and access management

Four questions, asked of every account

Identity and access management, usually shortened to IAM, follows each account through its life: creating it when someone joins, proving it belongs to the person using it, deciding what it may reach, and removing that reach when the person changes role or leaves. The practitioner's day is less about login screens than about lifecycle. A directory administrator spends it on group memberships, sign-in policies, access requests and the periodic reviews that confirm last year's grants still make sense.

The discipline has grown in weight because the network no longer marks where trust begins. When staff work from anywhere and applications run at a cloud provider, each request is allowed or refused on the strength of the identity and the state of the device, and that decision is only as sound as the directory feeding it.

• **Authentication**: proving who you are with something you know, have or are. Passwords are still everywhere; the craft lies in what surrounds them.
• **Multi-factor authentication**: two different kinds of proof. Factors differ sharply in how well they survive a live phishing page, and current exams test that difference.
• Single sign-on and federation: one trusted login reused across many applications through protocols such as SAML, OAuth and OpenID Connect. Convenient for users, and a single point whose compromise opens everything behind it.
• Authorisation models: role-based, attribute-based and rule-based access, plus the question of who may grant each permission.
• **Least privilege and privileged access**: standing administrator rights replaced by access requested for a task and withdrawn when it ends.
• Governance: access reviews, joiner, mover and leaver processes, and the audit trail that shows both happened. The IAM glossary entry sets out the discipline as a whole.

What the exams test, and the access nobody removed

The CISSP devotes an entire domain to identity and access management and examines it as design: which model suits which organisation, how federation hands trust to a partner, how to provision and withdraw access safely. Microsoft's SC-300 is the most practical exam in the area, built around one vendor's directory, authentication methods and conditional access rules, and it rewards candidates who have configured those in a lab rather than read about them. Security+ touches identity across several domains without owning any of them. The typical beginner's mistake is to see IAM as a login problem and stop once sign-in works with a second factor. Most identity failures are about access that should already have ended: a contractor account active months after the contract, a service account with administrator rights nobody remembers granting, a group created to share one folder that now opens twenty. Those are found by reviewing, not by configuring, and a review nobody acts on finds them twice. From here readers usually go on to network security, the enforcement side of zero trust, or to cloud security, where identity policy makes up most of what a defender controls.