What is IAM?

Definition

IAM — IAM (Identity and Access Management) is a framework of policies, processes, and technologies that enables organizations to control who has access to which IT resources.

Explore our services

• Penetration testing

TL;DR — What is IAM (Identity and Access Management)?

IAM (Identity and Access Management) is the set of policies, processes and technologies that manages digital identities (human and non-human, including services, workloads and AI agents) and their authorizations to organisational resources. IAM enforces least privilege and zero trust — it answers the questions “who, where, when and what can they do” inside the IT estate.

• Components (the 4A model): Authentication (who they are), Authorization (what they can do), Administration (lifecycle management), Audit (who did what).
• Access control models: RBAC (role-based), ABAC (attribute-based), PBAC (policy-based), ReBAC (relationship-based), DAC, MAC, JIT.
• Protocol stack: SAML 2.0, OAuth 2.1, OIDC, SCIM 2.0, FIDO2/WebAuthn, passkeys, LDAP, Kerberos.
• 2026 trend: identity-first security (ITDR), NHI (non-human identity) governance, passkeys as primary authentication, CIEM for cloud, AI agent identities.
• Top vendors 2026: Microsoft Entra ID (Azure AD), Okta, Ping Identity, JumpCloud (IAM); CyberArk, BeyondTrust, Delinea (PAM); SailPoint, Saviynt (IGA); Wiz, Palo Alto Prisma, CrowdStrike Falcon (CIEM); Astrix, Britive (NHI).

IAM vs PAM vs IGA vs CIAM vs NHIM — category comparison

	IAM	PAM	IGA	CIAM	NHIM
Definition	General identity and access management	Privileged Access Management — privileged accounts	Identity Governance — lifecycle + compliance	Customer IAM — B2C consumer accounts	Non-Human Identity Management — services, AI, containers
Primary users	Employees, contractors, partners	Admins, root, DBA, critical service accounts	GRC, audit, compliance officers	B2C customers, end users	Service accounts, AI agents, K8s pods, certs
Key functions	SSO, MFA, lifecycle, conditional access	Password vault, just-in-time access, session recording	Access reviews, certification, SoD, role mining	Self-registration, social login, consent management	Secret rotation, workload identity, RBAC for AI
2026 vendors	Microsoft Entra ID, Okta, Ping, JumpCloud	CyberArk, BeyondTrust, Delinea, Wallix, Senhasegura	SailPoint, Saviynt, One Identity, Omada	Auth0 (Okta CIC), ForgeRock (Ping), Frontegg, Stytch	HashiCorp Vault, Akeyless, Astrix, Britive, SPIFFE/SPIRE
Typical scale	All employees (100-100k)	1-5% of staff (admins)	All employees + governance overlay	Thousands to millions of customers	10-45× the human user count
Compliance driver	ISO 27001 A.5.15-18, NIST 800-53 AC	SOX, PCI DSS 8.2, NIS2 Art. 21, DORA Art. 9	SOX, NIS2 Art. 21, ISO 27001 A.5.16	GDPR, ePrivacy, CCPA	NIST IR 8429 (draft)
Typical cost	4-30 USD/user/month	15-50 USD/admin/month + vault infra	50-200 USD/user/year	0.01-0.50 USD/MAU/month	varies (per workload/secret)

Key principle: a mature organisation runs all five categories — IAM as the foundation, PAM for the privileged 5%, IGA as the governance overlay, CIAM for customer-facing services, and NHIM for the non-human identity sprawl.

History of IAM — from LDAP to passkeys

Three decades of identity management evolution:

• 1988 — Kerberos v4 (MIT Project Athena) — the first ticket-based network authentication protocol, foundation of Windows Active Directory.
• 1993 — LDAP v1 (RFC 1487, University of Michigan) — Lightweight Directory Access Protocol, a simplification of X.500; the standard directory query protocol.
• 1999 — Active Directory (Microsoft Windows 2000 Server) — commercial enterprise directory dominating corporate IT for 25 years.
• 2002 — SAML 1.0 (OASIS) — first federated SSO standard; SAML 2.0 (2005) becomes the dominant enterprise B2B protocol.
• 2006 — OAuth 1.0 (Blaine Cook, Twitter) — first delegated authorization protocol; OAuth 2.0 (RFC 6749, 2012) becomes today’s standard.
• 2014 — OpenID Connect 1.0 (OpenID Foundation) — modern authentication layer on top of OAuth 2.0; JWT ID tokens; preferred over SAML.
• 2015 — SCIM 2.0 (RFC 7642-7644) — provisioning protocol that eliminates custom CSV imports between HR and IAM systems.
• 2018 — FIDO2 / WebAuthn (W3C + FIDO Alliance) — passwordless authentication, hardware-bound credentials; replaces passwords in new applications.
• 2019 — BeyondCorp (Google whitepaper) — zero trust networking, identity-as-perimeter; de facto standard for cloud-native security.
• 2022 — Passkeys (Apple WWDC + Google I/O + Microsoft) — multi-device synced FIDO2 credentials; the first mainstream consumer passwordless rollout.
• 2024 — NHI Management emerges as a distinct category (Gartner Hype Cycle for IAM 2024); AI agent identities become a production problem.
• 2025-2026 — ITDR (Identity Threat Detection and Response) matures: Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis.

Gartner formalises this as the Entity Continuity Model (ECM): identity → entitlement → activity → context, where each layer requires its own controls and continuous verification.

IAM components — the 4A model

Authentication — who they are

Authentication verifies that a subject (human or machine) is who they claim to be. NIST SP 800-63B Rev 3 defines three Authentication Assurance Levels:

• AAL1 — single-factor (password) or low-assurance MFA; legacy applications only.
• AAL2 — phishing-resistant MFA (hardware token, push notification with number matching, biometrics with liveness); the standard for business applications.
• AAL3 — hardware-based multi-factor cryptographic authenticators (FIDO2 hardware key, smart card); high-assurance (government, finance, critical infrastructure).

MFA methods 2026 (in order of preference):

1. Passkeys / FIDO2 hardware tokens — phishing-resistant, hardware-bound; YubiKey 5, Google Titan, Apple/Google passkeys.
2. Microsoft Authenticator with number matching + GPS context — push notification with additional verification; resistant to MFA fatigue attacks.
3. TOTP (RFC 6238) — Google Authenticator, Authy, Microsoft Authenticator; acceptable but vulnerable to real-time phishing.
4. SMS OTP — not recommended since 2017 (NIST SP 800-63B deprecates); vulnerable to SIM swap and SS7 attacks; fallback only.
5. Standalone biometrics (Touch ID, Face ID, Windows Hello) — typically used as a local unlock for a passkey/FIDO2 credential, not as a standalone server-side factor.

Risk-based / adaptive authentication — context (IP, geolocation, device, time of day, behavioural baseline) determines the required assurance: trusted device + corporate network → password is enough; new device + foreign IP → require MFA + manager approval. Vendors: Okta Adaptive MFA, Microsoft Entra Conditional Access, Ping Risk, ForgeRock Authentication Trees.

Authorization — what they can do

Authorization decides what the authenticated subject can access. Access control models:

• DAC (Discretionary Access Control) — the resource owner decides permissions (Linux file permissions, Windows ACL); simple but does not scale.
• MAC (Mandatory Access Control) — rigid security rules (SELinux, AppArmor, Bell-LaPadula); high-security environments (DoD, intelligence agencies).
• RBAC (Role-Based Access Control) — NIST ANSI INCITS 359-2004; user → role → permissions; the dominant enterprise model.
• ABAC (Attribute-Based Access Control) — NIST SP 800-162; decision based on attributes (user.department + resource.classification + environment.time + action.type); flexible but complex.
• PBAC (Policy-Based Access Control) — policies expressed declaratively (Rego/OPA, AWS Cedar); auditable, version-controlled.
• ReBAC (Relationship-Based Access Control) — Google Zanzibar paper 2019; implementations: OpenFGA, SpiceDB, Ory Keto; user → relationship → object; standard for SaaS multi-tenancy.
• JIT (Just-In-Time) — permissions granted on demand with a TTL (4h/24h); standard for privileged access; eliminates “zombie permissions”.

Modern authorization stack 2026: OAuth 2.1 + OIDC for token issuance, OPA (Open Policy Agent) or AWS Cedar for fine-grained policy decisions, OpenFGA for ReBAC inside SaaS applications. The trend is policy-as-code instead of static ACLs.

Administration — lifecycle management (JML)

Joiner / Mover / Leaver — the three critical lifecycle moments:

• Joiner — new employee: HR → IAM trigger via SCIM, automatic provisioning across 30+ applications, MFA enrolment, hardware token shipped, role assignment based on job title.
• Mover — role or department change: revoke old permissions, grant new permissions, optional manager review; the hardest phase — “privilege creep” typically accumulates over time.
• Leaver — employee departure: HR → IAM trigger, same-day deactivation of every account (critical — leaver accounts are the #1 insider threat vector), revoke tokens, archive mailbox, transfer ownership of resources.

SCIM 2.0 (System for Cross-domain Identity Management) automates JML: HR system (Workday, BambooHR, SAP SuccessFactors) → IAM (Entra ID, Okta) → applications (Salesforce, Slack, GitHub, Jira). Without SCIM: CSV imports + manual provisioning = 15-30% error rate, 7-30 day leaver gaps.

Audit — who did what

Logging + monitoring + governance:

• Authentication logs — who, when, from where, with which factor; SIEM integration (Splunk, Microsoft Sentinel, Elastic).
• Authorization decisions — which policies allowed or denied access; OPA decision logs.
• Privileged session recording — full RDP/SSH recordings for privileged users (the PAM domain).
• Access reviews / attestation — quarterly reviews of permissions: managers certify that their team members should retain a given access. Compliance drivers: SOX, NIS2 Art. 21, ISO 27001 A.5.16.
• Segregation of Duties (SoD) — detection of conflicting permissions (e.g. the same person cannot both create and approve payments). IGA vendors SailPoint, Saviynt and Pathlock specialise in SoD checks for SAP/Oracle.
• ITDR (Identity Threat Detection and Response) — detection of attacks at the identity layer: pass-the-hash, golden ticket, OAuth abuse, MFA bombing, impossible travel, password spray. Vendors: Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis.

IAM standards and protocols — a deeper look

• SAML 2.0 (OASIS, 2005) — XML-based federated SSO; SP-initiated flow (user clicks login in Salesforce → redirect to IdP → assertion → access), IdP-initiated flow (login from the IdP portal). Dominant in legacy enterprise apps and most B2B SaaS.
• OAuth 2.1 (RFC 6749 + 9700) — delegated authorization, NOT authentication. Flows: Authorization Code + PKCE (the 2026 best practice for web/mobile/SPA), Client Credentials (machine-to-machine), Device Code (smart TVs, CLIs). Anti-patterns deprecated in 2026: Implicit Flow, Resource Owner Password Credentials Grant.
• OIDC (OpenID Connect 1.0) — authentication layer on top of OAuth 2.0; ID token as a JWT with claims (sub, iss, aud, exp, email, name, groups). Modern preferred protocol over SAML for new integrations.
• SCIM 2.0 (RFC 7642-7644) — REST/JSON API for user and group provisioning; endpoints: /Users, /Groups, /Schemas. Supported by Entra ID, Okta, Google Workspace, Workday → push to target applications.
• FIDO2 / WebAuthn (W3C 2018) — passwordless: the relying party sends a challenge, the authenticator signs it with the private key (after user verification via biometrics/PIN). Origin-bound = phishing-resistant.
• Passkeys — multi-device FIDO2 credentials synced via cloud (Apple iCloud Keychain, Google Password Manager, Microsoft Authenticator); consumer + enterprise mainstream since 2024.
• LDAP / Active Directory — legacy directory query protocol (RFC 4511); AD still dominates on-prem corporate IT; trend: hybrid (AD + Entra ID sync).
• Kerberos — ticket-based network authentication; Windows domain logon, MIT Kerberos on Unix. Vulnerable to golden ticket, silver ticket and pass-the-ticket attacks — mitigation: Microsoft Defender for Identity + Tier 0 segmentation.
• RADIUS / TACACS+ — network device authentication (Wi-Fi enterprise WPA2/3-Enterprise, VPN, Cisco/Juniper switches).

IAM for cloud — CIEM (Cloud Infrastructure Entitlement Management)

Cloud reframes the IAM problem: on-premises there is one directory (AD) and a finite number of applications; in the cloud there are AWS IAM (200+ services, thousands of policies), Azure RBAC + Entra ID, GCP IAM — each with its own permission model. CIEM is the dedicated category for managing cloud entitlements:

• Excessive permissions remediation — typically 90% of granted permissions are never used; CIEM detects this and proposes least-privilege policies.
• Just-in-time access — admins receive permissions only when they need them (instead of 24/7 admin roles).
• Attack path analysis — simulation: “if user X were compromised, what resources would the attacker reach?” — graph of identity → role → resource.
• Multi-cloud visibility — a single dashboard across AWS + Azure + GCP.

Top CIEM vendors 2026: Wiz (Ermetic acquisition 2023), Palo Alto Prisma Cloud, CrowdStrike Falcon Cloud Security, Sonrai Security, Tenable (legacy Ermetic), Microsoft Defender for Cloud (Entra Permissions Management — formerly CloudKnox).

Non-Human Identities (NHI) — the 2026 frontier

NHI are non-human identities: service accounts, API keys, OAuth client credentials, X.509 certificates, workload identities (Kubernetes ServiceAccount, AWS IRSA, Azure Managed Identities, GCP Workload Identity Federation). Plus a new segment: AI agent identities (Microsoft Copilot, ChatGPT Enterprise, Anthropic Claude Workforce, autonomous LangChain agents).

Scale: enterprises run 10-45× more NHI than human users (Astrix Security 2024 report). A typical organisation with 1000 employees has 10,000-45,000 NHI; 30-50% are stale, unowned and over-privileged.

Why it matters in 2026: NHI are the #1 attack vector in 2024-2025 — Cloudflare/Okta supply-chain (stolen OAuth token), Microsoft Midnight Blizzard (compromised test OAuth app), MOVEit (compromised service account). Classic IAM does not cope with NHI: no MFA (a machine cannot do MFA), credentials hardcoded in git/CI/CD, no lifecycle (NHI created ad-hoc, never removed).

Top NHI Management vendors 2026: Astrix Security, Britive, Token Security, Aembit, Akeyless, Entro Security, Oasis Security, plus classic secret managers (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, CyberArk Conjur).

Standards: SPIFFE/SPIRE (Secure Production Identity Framework for Everyone, CNCF graduated), OAuth Workload Identity Federation (RFC 8693 token exchange), NIST IR 8429 (draft 2024) Identity Management Capabilities, OWASP NHI Top 10 (2024).

CISO 2026 priority: (1) inventory NHI + ownership (who is accountable), (2) automated secret rotation (90-day max TTL for long-lived secrets, ideal: short-lived tokens 1-24h), (3) just-in-time access for NHI, (4) monitoring NHI behaviour for anomalies (NHI used from a new IP/region/at odd hours).

IAM — compliance with 2026 regulations

• ISO 27001:2022 — A.5.15 (Access control), A.5.16 (Identity management), A.5.17 (Authentication information), A.5.18 (Access rights); the fundamental control set for certification.
• NIST SP 800-53 Rev 5 — AC family (Access Control, 25 controls), IA family (Identification and Authentication, 12 controls); the US federal standard, used as a global baseline.
• NIST SP 800-63B Rev 3 — Digital Identity Guidelines; AAL 1-3 (Authentication Assurance Levels); deprecates SMS OTP.
• NIS2 (EU Directive 2022/2555, effective 17 October 2024) — Art. 21: MFA mandatory for critical/important entities, access control policies, identity governance, supply chain security; penalties up to 10 million EUR or 2% of global turnover.
• DORA (EU Regulation 2022/2554, effective 17 January 2025) — Art. 9 ICT security: strong authentication required, identity & access management formal policy, privileged access controls, periodic review.
• GDPR (EU 2016/679) — Art. 32: appropriate technical measures, pseudonymisation; IAM impacts compliance indirectly through data access controls.
• PCI DSS 4.0 (effective 31 March 2025) — Req 8: strong authentication, MFA for all admin + remote access + non-console access to the CDE.
• SOX (USA 2002) — segregation of duties, quarterly access reviews, audit trail.
• HIPAA (USA) — administrative safeguards § 164.308; access control § 164.312.

IAM — best practices 2026

• Least privilege + zero standing privileges — default to zero; permissions only when needed, with a TTL.
• Just-In-Time (JIT) access for admin tasks — Privileged Identity Management (PIM) in Microsoft Entra, CyberArk PSM, Okta Privileged Access.
• MFA everywhere, passkeys preferred — the password + SMS era is over; passkeys / FIDO2 hardware tokens are the new baseline.
• Conditional access — Microsoft Entra Conditional Access, Okta Adaptive Auth, Ping Risk; MFA decision based on context (device compliance + geo + behaviour).
• Identity governance — quarterly access reviews, SoD checks, role mining, certification campaigns; IGA stack: SailPoint, Saviynt.
• PAM separate from IAM — privileged accounts (root, admin, DBA, critical service accounts) in a dedicated PAM vault (CyberArk, BeyondTrust, Delinea); session recording, password rotation 24-72h.
• Session recording for privileged sessions — RDP, SSH, database admin; full video and keystroke logging for audit.
• No shared accounts — every user gets their own account; “admin@company.com” with a shared password is an anti-pattern.
• Lifecycle automation from HR → IAM — SCIM provisioning from Workday/SAP HCM → Entra ID / Okta; eliminates 7-30 day leaver gaps.
• Continuous monitoring + ITDR — Identity Threat Detection and Response: Microsoft Defender for Identity, CrowdStrike Falcon Identity Protection, Silverfort, Semperis; detects pass-the-hash, golden ticket, OAuth abuse, MFA bombing.
• Tier 0 segmentation — domain controllers and identity providers in an isolated tier; Tier 0 admin access only from Privileged Access Workstations (PAW).
• Break-glass accounts — 2-3 emergency accounts with hardware MFA and sealed credentials in a physical safe; cloud-only (not synced to on-prem AD), exempt from conditional access, audited on every use.
• NHI governance — inventory + ownership + rotation for service accounts, API keys and certificates; vendors: Astrix, Britive, Token Security.

How nFlo helps deliver IAM

At nFlo we run end-to-end IAM programmes — from auditing the current identity architecture, through target-state design (RBAC matrix, conditional access policies, PAM scope), to deploying Microsoft Entra ID / Okta with application integration (SCIM/SAML/OIDC), passkey MFA roll-out, and governance (quarterly access reviews, SoD policies). For organisations in scope of NIS2 or DORA we prepare the IAM control set for external audit and support day-to-day operations.

• Security audit — assessment of current IAM/IGA maturity + roadmap.
• SOC 24/7 — monitoring identity-based attacks (pass-the-hash, OAuth abuse, MFA bombing) as part of Identity Threat Detection.
• ISO 27001 implementation — controls A.5.15-18 inside a full ISMS.
• Penetration testing — Active Directory pentest, IAM bypass scenarios, OAuth attack chains.

Related terms

• PAM (Privileged Access Management) — complementary category for privileged accounts; every mature IAM runs PAM alongside it.
• SSO (Single Sign-On) — a core IAM function, one login across many applications.
• Multi-Factor Authentication (MFA) — the fundamental Authentication control in the 4A model.
• Active Directory — the most common enterprise directory; the layer IAM often operates on.
• LDAP — the query protocol for directory services (AD, OpenLDAP, FreeIPA).
• Security Controls — the broader catalogue of safeguards in which IAM is a key technical control set.

IAM is the foundation of cybersecurity in 2026 — in zero trust architecture, identity has replaced the network perimeter as the primary control. Investment in mature IAM (passkeys, conditional access, IGA governance, PAM for privileged accounts, NHI for non-human identities) pays back in 12-24 months through reduced breach impact (compromised credentials = #1 attack vector), lower help-desk volumes, and NIS2 / DORA / ISO 27001 compliance.