Identity and Access Management

Identity and Access Management (IAM) is the management of digital identities and access rights in an organization. IAM defines which users, devices, applications or services may access which systems and data. The aim is to enable authorized access easily and securely and to consistently prevent unauthorized access. IAM is thus a central building block of modern IT security and compliance.

IAM includes processes and technologies for user administration, authentication, authorization, role models, entitlement review and access revocation. Examples are single sign-on, multi-factor authentication, role-based access concepts and regular access reviews. IAM becomes particularly important in hybrid IT landscapes in which employees, partners, cloud services and automated workloads access many systems. For protection against identity-related risks, Identity Security is an important field of application.

IAM is narrower than identity security, because it primarily describes the administration and enforcement of access rights. Identity security additionally considers threats, misuse patterns and security risks around identities. In a zero trust strategy, identities are a central control point: access is not trusted by default but continuously verified. IAM thus combines organizational rules with technical controls and strengthens the overall Security Posture.

See also: Identity Security and Zero Trust Security.