How IAM works
Three-step view of how it operates in practice.
- Provision. New users are created with role-based access automatically when they join. No more permissions are granted than the role requires.
- Authenticate & authorize. Users prove who they are (authentication) and are granted only the permissions attached to their role (authorization).
- Deprovision. When users change roles or leave, access is updated or revoked everywhere, not just in email.
Why IAM matters
Stolen or misused credentials are involved in the majority of breaches year after year, and the account nobody remembered to close is a standing invitation. For a growing organization, disciplined IAM also has an everyday payoff: new hires are productive on day one, departures are clean, and the access questions on insurance and compliance questionnaires stop being uncomfortable.
IAM vs SSO vs PAM vs IGA
- IAM. The umbrella discipline: how accounts are created, what they can access, how identity is verified, and how access is removed. Everything below is a piece of it.
- SSO. One sign-in that opens many applications through a central identity provider. A component of IAM focused on the login experience and centralizing control.
- PAM. The specialized branch for elevated accounts — admins, service accounts, anything that can change the environment, with vaulting, rotation, and session controls.
- IGA. The governance layer: periodic access reviews, certification campaigns, and the audit trail proving the right people have the right access. This is what auditors ask to see.
Common IAM mistakes
- Treating email disable as offboarding. Shutting off the mailbox leaves the CRM, accounting platform, file shares, and a dozen SaaS logins alive. Offboard through the identity system so one action revokes everything, and audit the stragglers.
- Granting access by imitation. 'Set her up like Bob' copies every permission Bob accumulated over nine years, including things his current role never needed. Define access by role, not by resemblance to a long-tenured employee.
- No single source of truth. When accounts are created directly inside each application, nobody can answer who has access to what. Route all account creation through the central directory, even for apps that make local accounts easy.