What is the difference between IAM and single sign-on?

Single sign-on is one mechanism inside identity and access management: one login that reaches many applications through a central identity provider. It makes the rest of the discipline possible, and it is not the discipline. Reviews, roles and leaver processes still have to exist.

Why are service accounts a problem?

Because they belong to software, nobody leaves when they stop being needed, they often hold broad rights granted during a project, and they are excluded from the multi-factor and review processes applied to people. In most organisations they outnumber human accounts, and they are governed worse.

How often should access be reviewed?

Often enough that the oldest unreviewed entitlement on a sensitive system is months old rather than years. Quarterly is the common cadence for sensitive applications; the exact interval matters less than having a named owner who actually removes what they do not recognise.

Identity and Access Management (IAM)

Also: IAM, identity management, access management, entitlements

Identity and access management is the set of policies and systems that create, verify, govern and retire identities and decide what each one may reach.

Our take. Most identity programmes are judged on how well they let people in and should be judged on how well they take access away. Joiners are handled because the business notices when they cannot work; leavers and movers accumulate access nobody reviews, and that residue is what an attacker inherits. Measure your identity system by the age of its oldest unreviewed entitlement.

An identity is a record: a person, a service or a device, with attributes and a lifecycle. Access is the set of things that identity may do. Identity and access management is everything that connects the two over time: creating the identity when someone joins or a service is deployed, proving it at each login, granting entitlements according to role and request, reviewing them, and removing them when the job changes or ends. Authentication is a moment inside that lifecycle; the lifecycle is the discipline.

The failure is silent and cumulative

Nobody complains when they keep access they no longer need. A finance analyst who moved to marketing eighteen months ago still has the payroll role; a contractor's account outlived the contract; a service account created for a migration still holds administrator rights on a database that has since been replaced. None of these break anything, all of them are exactly what an attacker who compromises one account is hoping to find, and no product reviews them for you unless somebody configures it to.

Joiner, mover, leaver: the three events every identity process must handle, and the third is where most fail.
Single sign-on: one identity provider authenticating to many applications, so policy lives in one place and there is one account to close.
Roles and groups: access granted by job rather than by individual request, so a mover's change of role changes their access without a ticket.
Access reviews: periodic confirmation by an owner that each entitlement is still needed; tedious, unglamorous, and the control that catches the residue.
Privileged access: administrative rights granted for a time-boxed session with approval, rather than held permanently, so the most dangerous access exists only while it is being used.
Workload identities: the accounts owned by software rather than people, which outnumber human accounts in most organisations and are governed worse.

The vendor certifications in this field examine exactly these mechanics: Microsoft's identity administrator paper spends a quarter of its weight on governance, meaning reviews, entitlement packages and privileged access, and the management-level security credentials ask who is accountable for an entitlement rather than how it is configured. Both reflect the same lesson. The technology of identity is largely solved; the governance of it is where the organisations that get breached differ from the ones that do not.

In practice

A company consolidates forty applications behind one identity provider and declares its identity project complete. Six months later an audit asks a simple question: who currently has access to the payroll system, and did anyone confirm each of them should? Nobody can answer without exporting a list and emailing it around. The project delivered authentication and skipped governance. The fix is an owner for each sensitive application, a quarterly review in which that owner confirms or removes every entitlement, and privileged roles that expire after a session instead of persisting. The first review removes access from a fifth of the list, none of whom had noticed they still had it.

Often confused with

Authentication: Authentication proves who is asking at the moment of login. Identity and access management is the whole lifecycle around that moment, and most of its failures happen long after login works perfectly.
Least Privilege: Least privilege is the rule that each identity should hold only what it needs. Identity and access management is the machinery that grants, reviews and removes access; without the rule it grants too much, without the machinery the rule is a wish.
Zero Trust: Zero trust is an architecture that puts identity at the centre of every access decision. Identity and access management is the system that architecture depends on to know who the identities are and what they may reach.

Key takeaways

→Identity is a lifecycle: join, move, leave. Leavers and movers are where access accumulates.
→One identity provider gives one place to enforce policy and one account to close.
→Access reviews and time-boxed privileged access are the controls that remove residue.

Certifications that test this

Vendor exams whose syllabus covers this concept — facts, cost and a preparation path on each page.

More courses from these shelves

A rotating selection from the course directory, drawn from the subcategories where this concept is taught rather than picked for it. Details, price and the provider link are on the course page.

FAQ

What is the difference between IAM and single sign-on?: Single sign-on is one mechanism inside identity and access management: one login that reaches many applications through a central identity provider. It makes the rest of the discipline possible, and it is not the discipline. Reviews, roles and leaver processes still have to exist.
Why are service accounts a problem?: Because they belong to software, nobody leaves when they stop being needed, they often hold broad rights granted during a project, and they are excluded from the multi-factor and review processes applied to people. In most organisations they outnumber human accounts, and they are governed worse.
How often should access be reviewed?: Often enough that the oldest unreviewed entitlement on a sensitive system is months old rather than years. Quarterly is the common cadence for sensitive applications; the exact interval matters less than having a named owner who actually removes what they do not recognise.

Sources

The primary text this definition rests on. Read it before you trust ours.

NIST SP 800-63-3, Digital Identity Guidelines (2017)
NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations (2020)

Last reviewed 13 September 2026 · Getting Digital

Identity and Access Management (IAM)

In practice

Often confused with

Key takeaways

Certifications that test this

More courses from these shelves

ISO/IEC 42001: Artificial Intelligence Management System

C_THR82: SuccessFactors Performance & Goals Implementation

Networking Full Course & Network + certification

Python And Django Framework For Beginners Complete Course

The Ultimate AWS Networking Training Course: All In One

Salesforce Certified Data Cloud Consultant Practice Exams

FAQ

Sources