Home / Knowledge hub / Identity and access management (IAM)
Knowledge hub
Identity and access management (IAM)
The tools and rules that manage who your people and services are and what they reach.
What it means
Identity and access management, or IAM, is the set of tools, policies and habits that decide who or what exists in your systems and what each one is allowed to reach. It covers staff, customers, and also machines such as services and automation.
It has two halves. Identity is knowing who someone is and keeping accounts up to date. Access is deciding what that identity may do. The work is joining them over time, as people join, move and leave. Done well, nobody notices it. Done badly, the damage appears only after an incident.
Why it matters
Most serious incidents involve an account that could do more than it should, or one that should have been closed. Weak IAM leaves former staff with access, shared passwords in use and service accounts nobody owns. It is a standing topic in SOC 2 and ISO 27001 reviews.
It is also where cost and speed pull against safety. Granting broad access is quick, and cleaning it up later is slow. Habits such as least privilege and regular checks keep access from growing unnoticed, which cuts the damage if any one account is stolen.
How it shows up
You meet it as a directory or identity provider, groups and roles, multi-factor sign-in, joiner-mover-leaver procedures, and cloud permissions such as IAM roles. Inside your own product it appears as the accounts, roles and permission checks your customers use. Each of these is a place where a request for access is granted or refused.
Common failures: shared admin accounts, permissions given by copying another person's access, service accounts with long-lived keys, and no review after a role change. Check that off-boarding removes access everywhere, and that your product enforces permissions on the server, not only in the interface.
Questions people ask
Identity and access management (IAM), answered
Is IAM the same as authentication?
No. Authentication proves who someone is. IAM is the wider job of managing identities and deciding what they may access, of which authentication is one part.
Does IAM only cover employees?
No. It covers customers, partners and machines too. Service accounts and API keys are often the least managed and the most powerful. The aim is to give the right access to the right account, with a record of who agreed to it.
What is the difference between IAM and PAM?
Privileged access management is the part focused on the most powerful accounts, such as administrators, with extra controls like approval and session recording. IAM covers all accounts.
Do small companies need IAM?
Yes, in a lighter form: one place to create and remove accounts, a second factor, sensible groups and a periodic look at who has what. The habits matter more than the product.
How is IAM tested?
By checking whether an account can reach things its role should not, whether former accounts still work and whether permissions are enforced on the server. Policy documents alone do not show that.
Sources
Where this comes from
Related
Terms that sit next to this one
Identity provider (IdP)
The service that signs people in and tells your app who they are.
Least privilege
Giving every person and service the minimum access the job requires.
Access review
A regular check that each person still needs the access they hold.
Privileged access management
Tight control and recording of accounts that hold powerful admin rights.
Access control
The rules deciding which person can see or do which thing in your app.
Who can reach what, today?
We test what each signed-in account can reach that it should not, on the running app, with the request and response as proof. It is evidence of the access you actually have. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.