Identity and access management: identities, authentication, authorisation and lifecycle

What IAM is for

Identity and access management (IAM) is the set of processes and tools that answer two questions for every request: who is this? and are they allowed to do this? In the cloud, where there is no office wall around your servers, IAM is effectively the main perimeter. A stolen password with broad permissions can do more damage than an open firewall port.

An identity is a digital representation of something that needs access. That can be a person (an employee, a contractor, a customer), a device (a laptop, a sensor) or a workload (an application, a script, a virtual machine). Identities usually live in a directory or identity provider (IdP), such as Microsoft Entra ID, Okta, Google Cloud Identity or an on-premises Active Directory.

Authentication, authorisation and accounting

People often mix up the first two. Logging in successfully is authentication; being refused when you open the finance share is authorisation. Keeping them separate matters because they fail differently: weak authentication lets the wrong person in, while weak authorisation lets the right person do too much.

Two other terms come up often. Identification is simply claiming an identity (typing a username). A principal is the cloud term for any identity that can be granted permissions, whether a user, group, role or service account.

The identity lifecycle: joiner, mover, leaver

• Joiner: a new starter gets an account and the access their role needs, ideally from a template driven by the HR system rather than copied from a colleague.
• Mover: when someone changes team, new access is added and old access is removed. Forgetting the removal causes privilege creep, where long-serving staff end up with far more access than any single job needs.
• Leaver: on the last day, accounts are disabled, sessions revoked, devices recovered and shared secrets rotated. Delays here are a classic audit finding.

Automating the lifecycle from an authoritative source (usually HR) through the IdP to each application is called provisioning. Standards such as SCIM (System for Cross-domain Identity Management) let an IdP create and remove accounts in software-as-a-service (SaaS) applications automatically.

Good IAM practice at work

1. Use one central identity provider and connect applications to it with single sign-on.
2. Require multi-factor authentication for everyone, and phishing-resistant methods for admins.
3. Grant access through groups or roles, never directly to individuals.
4. Apply least privilege and review access regularly.
5. Keep admin accounts separate from day-to-day accounts.
6. Send sign-in and audit logs to central storage and alert on unusual activity.

Tip: in exams and interviews, a quick way to show understanding is to classify a control: "MFA is an authentication control; a role assignment is an authorisation control; the audit log is accounting."

Common mistakes include shared accounts that nobody owns, service accounts created by staff who have since left, and test accounts with production rights. Each one breaks the link between an action and a responsible person.