Identity and Access Management (IAM)
Definition
IAM bundles processes and technology for managing digital identities and their access rights.
An IAM system typically supports provisioning, authentication, roles, policies, access control, and deprovisioning. Identity and authorization should be considered separately.
Simply explained
Like reception, ID check, and key issuance for digital systems in a regulated process.
Why it matters in practice
Very relevant for enterprise systems, AI agents, and integrations to ensure only authorized persons and services access data and actions.
Example from business
An employee change centrally updates groups and roles; thus, accesses to CRM, files, and internal AI assistants change.
Limits and pitfalls
- Too broad roles; orphaned accounts; service accounts without owners; MFA only sporadically; agents granted personal full rights.
Origin & history
IAM connects identity management and access control. NIST addresses Digital Identity, Access Control, and related technologies in separate programs and standards.
Use in mid-sized companies
- Possible applications: Single Sign-on, role and rights management, agent permissions, and offboarding.
Frequently asked questions
Is IAM just SSO?
No. What is the difference between Authentication and Authorization? Authentication verifies identity, Authorization decides on permitted accesses.
Sources
- Identity and Access Management · NIST, Identity and Access Management
- NIST SP 800-63-4 · NIST SP 800-63-4
- IAM introduction · AWS, IAM introduction
- Lifecycle workflows · Microsoft Entra, Lifecycle workflows
Source check: 10./11.10.2026.
Editorially reviewed on: