Identity and Access Management (IAM) is the set of processes, policies and tools that create, manage and govern digital identities and their access rights. It answers two questions: who is this identity, and what is it allowed to reach?

What does IAM include?

• Identity lifecycle: creating, changing and removing accounts as people join, move and leave.
• Authentication: verifying identity, including MFA and single sign-on.
• Authorisation: roles, permissions and policies.
• Directory services: the place where identities and attributes are stored.
• Identity governance: access requests, approvals and periodic reviews.
• Privileged access management for accounts with elevated rights.

How does IAM work?

When a person joins, IAM creates an account in the directory and assigns roles that match the job. At sign-in, authentication checks who they are and authorisation decides what they can reach. When they change role or leave, access should be adjusted or removed, and periodic reviews confirm that what remains is still needed.

How is IAM different from PAM and IGA?

IAM covers all identities. PAM focuses on accounts with elevated rights and adds controls such as vaulting, session recording and approval. Identity governance and administration, or IGA, focuses on the lifecycle, access requests and reviews, and is often considered part of IAM.

What are the benefits of IAM?

Consistent access rules, fewer manual steps, a single sign-in for users and records of who was granted what. It is also the base for compliance, because frameworks such as NIS2 and DORA expect organisations to control and justify access to critical systems.

What is the joiner, mover, leaver process?

A joiner receives the accounts and roles the job needs. A mover changes role, and their access should be swapped, not added to. A leaver loses access promptly. Movers are the weak point, because they usually keep their old permissions, which is how privilege creep starts.

What does an IAM gap look like in practice?

A contractor finishes a project. Offboarding closes their email, but their account in a legacy application was never connected to central IAM. Months later it is still active, with access to customer data, and nobody owns it.

What is cloud IAM?

Cloud platforms have their own IAM, with roles and policies for cloud resources. Using several platforms multiplies the number of models to manage, so organisations need one consistent view of who can reach what across all of them.

What are common IAM gaps?

• Joiner, mover and leaver processes that miss movers and leavers.
• Orphaned and dormant accounts that still work.
• Privilege creep as people change roles.
• Non-human identities that sit outside IAM processes.
• Exceptions that become permanent.
• Applications with local accounts that are not connected to central IAM.

Why is IAM not enough on its own?

IAM manages access at the door and keeps a record of what was granted. It does not watch how that access is used. An attacker with valid credentials passes authentication, holds legitimate permissions and acts within the rules IAM set up.

IAM also depends on the quality of its data. Stale roles, orphaned accounts and unreviewed exceptions leave excess access that nobody planned.

How does IAM relate to identity security?

IAM is the foundation. Identity security adds two things on top: posture, which finds weaknesses in the access IAM has granted, and threat detection and response, which watches for misuse. IAM sets the rules. Identity security checks that they are right and that nobody is abusing them.

How do you strengthen IAM?

Connect as many applications as possible, automate the lifecycle, review access using real usage rather than job titles, bring service accounts and other non-human identities into scope and require strong authentication on privileged accounts. Then add visibility into what identities do after they sign in.

Sharelock works alongside IAM. It reviews the access that IAM has granted to show where it is excessive or unused, and it monitors behaviour after login, down to individual transactions and queries on critical applications.

‍