Concept / Term · Foundational
Identity and Access Management
The policies and systems used to manage identities and decide who or what can access particular resources.
Field note
Identity and Access Management is the set of people, policies and systems that establish who or what an identity is and which resources it may use.
IAM joined the previously separate disciplines of identity administration, authentication and authorisation as organisations needed consistent access across many systems and cloud services.
IAM covers user lifecycle, service identities, roles, sign-in controls, access reviews and the evidence required for audit.
Many breaches begin with valid credentials holding excessive access, so identity control is a core security boundary rather than an administrative afterthought.
In a sentence“When an employee changes role, IAM removes the old permissions and grants the approved new ones.”