Identity & Access Management

Introduction

Almost every security decision ultimately comes back to identity: who is this person or system, should they have an account, which applications should they reach, what should they be allowed to do, who approved it, how long should the access remain, what happens when they change jobs, what happens when they leave, how quickly can their access be removed, and can the company prove the correct controls were followed?

Authentication (Module 9) establishes or verifies an identity — it asks "are you really Alice?" IAM goes much further: who is Alice, where does she work, which systems should she have access to, what permissions should she have, who approved them, and when should they be removed? In a modern global organisation, IAM may manage hundreds of thousands or millions of identities across Active Directory, Microsoft Entra ID, AWS, Azure, GCP, Microsoft 365, Salesforce, ServiceNow, Workday, SAP, Oracle, GitHub, databases, VPNs, mainframes, internal and SaaS applications, privileged accounts, service accounts, APIs, workloads, contractors, suppliers, and customers.

IAM is therefore not simply "IT account management." It's an enterprise security architecture.

Learning Objectives

By the end of this module (all 6 lessons), you should be able to explain the purpose of IAM and how it differs from authentication; explain least privilege, RBAC and ABAC; explain provisioning and deprovisioning and understand SCIM; explain SSO and federation; explain the Joiner-Mover-Leaver identity lifecycle and how HR systems feed it; recognise modern and legacy IAM technologies and the difference between IAM, IGA and PAM; recognise common IAM security failures; understand how large global organisations design identity systems; and troubleshoot common IAM provisioning and access problems methodically.

1❓ What Is Identity and Access Management?

IAM is the combination of technologies, policies, processes, standards, governance and automation used to manage digital identities and their access to systems. An IAM system normally answers four fundamental questions.

2🏢 IAM in a Large Enterprise

A simplified enterprise identity architecture:

The exact design varies enormously by size. A startup might just run Google Workspace + Okta + 20 SaaS applications. A multinational bank might run multiple AD forests, multiple Entra tenants, mainframe identities, LDAP directories, privileged access systems, customer identity platforms, SailPoint, CyberArk, legacy Oracle applications, SAP, AWS, Azure, GCP, and thousands of internal applications — all at once. This is why IAM engineers routinely work across many different technologies rather than specialising in just one.

📚 Lessons in This Module

Work through these in order — each builds on ideas from the last. Every lesson has its own "Mark lesson complete" button and labs; your progress across all six is tracked below.