What is identity and access management (IAM)?

Identity and access management (IAM) is the framework of policies, processes, and technologies that makes sure the right identities have the right access to the right resources at the right time. It covers two linked jobs: confirming that a user, device, or service is who it claims to be, and granting only the level of access that identity is entitled to. An identity here is not only a person. It can be an employee, a contractor, a customer, an application, or a machine, and increasingly an AI agent, each needing its own controlled access. IAM matters for two reasons that pull in the same direction: security and productivity. It narrows the ways an attacker can misuse credentials, and it lets people reach the tools they need without friction. Because compromised identities are behind so many breaches, IAM has become a foundation of modern security rather than a back-office IT function. This page explains what IAM is, how it works, its core components, the standards behind it, and how it connects to related disciplines like privileged access management and zero trust.

Key takeaways

IAM governs who gets access to what. It manages digital identities and controls their access to systems, applications, and data across an organization.
It rests on two functions: authentication and authorization. Authentication confirms identity; authorization decides what that identity is allowed to do.
Identities are no longer just people. IAM now covers applications, machines, and AI agents, each of which needs managed, least-privilege access.
It is central to zero trust. Continuous identity verification and least-privilege access are core to a zero-trust architecture.
Compromised identities drive breaches. Strong authentication such as MFA, tight provisioning, and monitoring reduce the most common route attackers take.

How IAM works

At its simplest, IAM does two things every time an identity tries to use a resource. First it authenticates, confirming the identity is genuine by checking credentials against a trusted source. Then it authorizes, granting the specific level of access that identity is entitled to and nothing more. A useful way to hold the distinction: authentication answers "are you who you say you are?", and authorization answers "what are you allowed to do?"

Underneath, an IAM system relies on a source of identity truth, often a directory such as Microsoft Active Directory or a cloud identity provider, that stores each identity and its attributes. Access is granted by policy rather than one account at a time. Most organizations use role-based access control (RBAC), where permissions attach to a job role, so a new hire in finance automatically receives the finance role's access. Some use attribute-based access control (ABAC), which decides access from attributes such as department, device, or location. The guiding principle in both is least privilege: give each identity the minimum access it needs, and no more.

The core components of IAM

IAM is often summarized as four functions, sometimes called the four A's: administration, authentication, authorization, and auditing. In practice, a modern IAM program brings together several building blocks.

Identity lifecycle management

Provisioning creates accounts and grants access when someone joins or changes role, and deprovisioning removes it when they leave. Prompt deprovisioning matters for security, because orphaned accounts from former employees are a common weak point. Managing this by role rather than by hand keeps the workload down and the access consistent.

Authentication

Authentication has moved well beyond passwords. Multi-factor authentication (MFA) requires more than one proof of identity, such as a password plus a one-time code or a biometric. Adaptive authentication adjusts the requirement based on context like location, device, or time, asking for more proof when a sign-in looks risky. Passwordless methods such as passkeys remove the password as a point of failure altogether.

Access management and single sign-on

Single sign-on (SSO) lets a user authenticate once and reach many applications without signing in to each, with the IAM platform acting as the source of identity truth. This improves both security and day-to-day experience, since people juggle fewer passwords and administrators get one place to enforce policy.

Auditing and reporting

IAM systems log activity such as sign-in times, systems accessed, and authentication methods used. These records support compliance with regulations, and they give security teams the evidence to spot risky patterns and review who has access to what.

Why IAM matters

The value of IAM shows up across security and operations at once:

It shrinks the attack surface. Traditional security often has a single point of failure, the password. IAM narrows that exposure with stronger authentication and tighter control over who can reach what.
It keeps people productive. With SSO and role-based access, employees reach the right tools without wrestling with passwords or waiting on manual access requests, and IT provisions by role instead of one person at a time.
It supports compliance. Regulations such as the EU's General Data Protection Regulation and sector rules demand tight control and auditable records of who accessed what, which IAM produces as a matter of course.
It scales with cloud and remote work. As teams spread across cloud services and locations, identity becomes the consistent control point, which is why most IAM is now delivered from the cloud as a service.

IAM, PAM, IGA, and CIAM

IAM is a broad field with several specialized areas underneath it. The terms overlap, so it helps to separate them.

Term	What it covers
IAM (identity and access management)	The overall framework for managing all identities and their access across the organization.
PAM (privileged access management)	A subset focused on high-privilege accounts (administrators, root, service accounts) with stricter controls such as credential vaulting, just-in-time access, and session monitoring.
IGA (identity governance and administration)	Governance over identities and entitlements: access reviews, certification, and policy enforcement to prevent excessive or orphaned permissions.
CIAM (customer identity and access management)	IAM applied to external customers, balancing security with a smooth sign-up and login experience.

A related distinction worth clearing up is IAM versus Active Directory. Active Directory is a Microsoft directory service that stores accounts and handles authentication and authorization for on-premises Windows environments. IAM is the wider framework, usually spanning cloud and on-premises, that Active Directory can feed into rather than replace.

The standards behind IAM

IAM systems have to work with many applications, so they lean on a handful of open standards. Security Assertion Markup Language (SAML) exchanges authentication and authorization data between an identity provider and an application, and it is a common basis for SSO. OpenID Connect (OIDC) does a similar job on top of the OAuth 2.0 framework, using JSON rather than XML, and OAuth itself handles delegated access. The System for Cross-domain Identity Management (SCIM) keeps identity data in sync between systems as users are added, changed, or removed. Together these standards let an IAM platform authenticate people into applications and keep account information current across a whole environment.

IAM and zero trust

Zero trust starts from the assumption that no identity or device should be trusted by default, and that every access request must be verified. IAM is what makes that possible. Least-privilege access, centralized identity management, policy-based control, and continuous verification are all IAM capabilities, and they are also the building blocks of a zero-trust architecture. Privileged accounts get extra attention, since they are the highest-value target if an attacker gets in. Put plainly, you cannot do zero trust without strong IAM underneath it.

Expert insight: managing identity is not the same as defending it

IAM is preventive. It decides who should have access and enforces that decision, and a well-run IAM program closes off a large share of the ways an attacker could get in. What it does not do is tell you when a legitimate identity has been taken over. When a threat actor signs in with valid stolen credentials, passes MFA through a phishing proxy or fatigue attack, and behaves within their granted permissions, the IAM system sees an authorized user. Nothing looks wrong at the point of access.

That gap is where detection comes in, and where Sekoia fits. Sekoia is a European cybersecurity vendor, and its unified AI SOC platform ingests identity signals, sign-in logs, MFA events, directory changes, privilege grants, alongside endpoint, network, and cloud telemetry, and correlates them to catch the misuse of an identity after authentication. An impossible-travel login, a sudden privilege escalation, a burst of access to systems a user never touches: these are the fingerprints of a compromised identity, and they surface only when identity data is analyzed in context. Detections map to the MITRE ATT&CK framework, so an identity anomaly connects to the broader intrusion rather than sitting alone.

To be clear about scope, Sekoia is not an IAM product and does not replace an identity provider, an SSO portal, or a PAM tool. Those remain the front line for controlling access. What a threat detection and response platform adds is the layer above: watching how identities actually behave once they are inside, so a stolen login becomes a detected intrusion instead of an open door. As a European vendor with a data-sovereignty posture, Sekoia also suits organizations that need identity and security data handled under European governance.