The complete operational reference for IAM professionals. From core concepts and daily workflows to skill-building and tooling.
Every IAM program is built on these disciplines. Master each to build a mature, auditable security posture.
Click any concept to expand definitions, implementation steps, and code examples.
SSO allows a user to authenticate once and gain access to multiple applications without re-entering credentials. It leverages a trusted Identity Provider (IdP) and protocols like SAML 2.0 or OIDC.
MFA requires two or more verification factors: something you know (password), something you have (TOTP app, hardware key), and something you are (biometric). Eliminates ~99.9% of account compromise attacks.
Permissions are assigned to roles, not individuals. Users are granted roles that bundle appropriate permissions for their job function. Simplifies management at scale and enforces least privilege.
"Never trust, always verify." No user, device, or network location is implicitly trusted — even inside the corporate perimeter. Every request is authenticated, authorized, and continuously validated.
PAM secures, controls, and audits access to critical systems by privileged users (admins, service accounts, DevOps). The majority of major data breaches involve compromised privileged credentials.
SCIM (System for Cross-domain Identity Management) is an open standard for automating user provisioning and deprovisioning between identity systems and cloud applications via a REST API.
Periodic campaigns where managers or data owners certify (approve or revoke) user entitlements. Required for SOX, HIPAA, ISO 27001, and SOC 2 compliance. Typically run through an IGA platform.
Step-by-step runbooks for the most common IAM tasks performed daily.
Technical and operational skills for IAM roles — from analyst to architect level.
| Skill | Category | Proficiency | Notes |
|---|---|---|---|
| SAML 2.0 / OIDC Configuration | Core | Critical for SSO integrations | |
| Okta Administration | Tool | Market-leading IdP | |
| Azure AD / Entra ID | Tool | Essential for Microsoft environments | |
| Role & Permission Design | Core | RBAC / ABAC modeling | |
| SCIM Provisioning | Core | Automates lifecycle events | |
| Active Directory / LDAP | Tool | On-prem directory backbone | |
| CyberArk / PAM Tools | Tool | Privileged access management | |
| Access Certification Campaigns | Gov | SailPoint, Saviynt | |
| SOX / SOC 2 Controls | Gov | Audit evidence prep | |
| Conditional Access Policies | Core | Zero Trust enforcement | |
| OAuth 2.0 / Token Management | Core | API & M2M auth flows | |
| PowerShell / Graph API Scripting | Ops | IAM automation | |
| SIEM Log Analysis | Ops | Splunk, Sentinel, QRadar | |
| Identity Incident Response | Ops | Account takeover playbooks |
Major platforms across the IAM ecosystem — organized by capability category.
Quick-reference definitions for common acronyms and concepts across the IAM discipline.
A system that creates, manages, and authenticates digital identities. Issues signed assertions or tokens to relying service providers.
An application that relies on an IdP for authentication. Trusts and validates tokens or assertions issued by the IdP.
XML-based open standard for exchanging authentication and authorization data between identity and service providers.
Identity layer built on top of OAuth 2.0. Provides ID tokens in JWT format for authenticating end users.
Compact, URL-safe token format for transmitting signed claims. Consists of three base64 parts: header.payload.signature.
Temporary privilege elevation granted on-demand for a limited TTL, then automatically revoked — eliminating standing privileges.
Controls for securing, monitoring, and auditing privileged accounts and credentials across critical infrastructure.
Processes and tools for managing user entitlements, running access certifications, and enforcing policy at enterprise scale.
Policy preventing any single user from holding conflicting access rights that could enable fraud, error, or unauthorized action.
Users and systems should hold the minimum access rights needed to perform their function — no more, no less.
IAM focused on managing external customer identities at scale, with emphasis on UX, privacy consent, and federation.
ML-driven analytics that detect anomalous behavior patterns indicative of compromise, insider threat, or lateral movement.
Access control where decisions are based on user, resource, and environment attributes evaluated dynamically at runtime.
Securely storing and managing privileged credentials with automated rotation and a check-out workflow for access.
Risk-based authentication that dynamically adjusts challenge requirements based on contextual risk signals.
A specific permission or access right granted to an identity — such as an app role, group membership, or file permission.
An arrangement that allows a user to use the same authenticated identity across multiple separate security domains.
The process of removing or disabling a user's access rights when they no longer require them — triggered by JML events.
Share ideas, ask questions, and discuss IAM concepts with the community.