Identity and Access Management (IAM)
The framework of policies, processes, and technologies that manage digital identities and control access to systems and resources.
What Is IAM?
Identity and Access Management (IAM) is the discipline of ensuring that the right people — and only the right people — can access the right resources, at the right time, for the right reasons. It encompasses the processes, technologies, and policies used to manage digital identities and control access across your organisation.
IAM answers two fundamental security questions:
- Who are you? (Identity and Authentication)
- What are you allowed to do? (Authorisation and Access Control)
Core IAM Components
Identity providers (IdP): Centralised systems that store and manage user identities — Microsoft Entra ID (Azure AD), Google Workspace, Okta, Ping Identity.
Single Sign-On (SSO): Allows users to authenticate once and access multiple applications without logging in separately to each.
Multi-Factor Authentication (MFA): Adds a second verification step beyond passwords.
Role-Based Access Control (RBAC): Assigns access permissions based on organisational roles rather than individual users.
Provisioning and deprovisioning: Automated workflows to create accounts when someone joins, update them when roles change, and disable them immediately when someone leaves.
Privileged Access Management (PAM): Specialised controls for high-privilege accounts — admin accounts, service accounts, emergency access.
Why IAM Is the Foundation of Security
Identity has become the primary security perimeter. Traditional network perimeters have dissolved with cloud and remote work — but every access request still requires an identity. An attacker who compromises an identity with broad permissions can move laterally, exfiltrate data, and persist undetected.
According to Verizon's DBIR, over 80% of breaches involve compromised credentials.
IAM for SMBs: Where to Start
- Centralise identity in a single directory (Microsoft Entra ID or Google Workspace)
- Enforce MFA organisation-wide
- Implement SSO for SaaS applications
- Automate offboarding — terminated accounts are a critical risk
- Review privileged access quarterly
- Use conditional access policies (block logins from unusual locations or unmanaged devices)