CHAPTER 1
9 min readJul 24, 2026
What is IAM and Why Does It Matter?
Imagine it’s your first day at a new company.
You walk in excited, laptop in hand, ready to start. But then reality hits:
- Your email doesn’t work yet
- You can’t access the project management tool
- The finance system says “Access Denied”
- IT is busy and won’t get to you until Thursday
You sit there for two days doing absolutely nothing.
Now flip the scenario.
You walk in on Day 1. Your laptop is ready. Your email works. All the tools your job needs are already accessible. You open your laptop, log in once, and everything is just… there.
The difference between these two experiences? Identity and Access Management — IAM.
1.1 — The Real Definition of IAM
If you search “What is IAM” online you’ll find definitions like:
“Identity and Access Management is a framework of policies and technologies that ensures the right users have appropriate access to technology resources.”
Technically correct. Practically useless for actually understanding it.
So let me explain it the way I wish someone had explained it to me.
IAM in One Sentence:
IAM makes sure the RIGHT person
has access to the RIGHT resource
at the RIGHT time
for the RIGHT reason
and NOTHING more
with FULL visibility
and ZERO unnecessary frictionRead that again. Every single word in that sentence is intentional.
Let’s break it down:
🔍 Breaking Down the Definition:
"The RIGHT person"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Not just anyone who claims to be someone.
A VERIFIED, AUTHENTICATED identity.This means:
→ Are you who you say you are?
→ Can you PROVE it?
(Password? MFA? Certificate?)
→ Is your account still active?
→ Is your identity at risk?Real example:
Someone logs in with correct
username and password at 3am
from Russia.
Are they the RIGHT person?
Maybe. But we need to verify further.
This is where MFA, risk scoring,
and Conditional Access come in.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"The RIGHT resource"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Not every resource. Not all resources.
Only what their job actually requires.A Finance Analyst needs:
✅ SAP Finance module
✅ Financial reporting tools
✅ Finance team SharePoint
❌ IT Admin panel
❌ HR salary database
❌ Customer contract systemTheir access should match
their job. Nothing more.
This is called Least Privilege.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"At the RIGHT time"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Access should exist when needed
and disappear when it's not.Examples:
→ New employee? Access ready Day 1
→ Employee leaving?
Access gone on last day
→ Temp project access?
Expires automatically
→ Admin access needed for 1 hour?
Active for 1 hour. Then gone.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"For the RIGHT reason"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Every access decision needs
a business justification."Just in case" is NOT a reason.
"Everyone else has it" is NOT a reason.
"My manager said so verbally"
is NOT enough.There must be:
→ A formal access request
→ A documented business need
→ Manager approval
→ Documented evidence
This is your audit trail.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"And NOTHING more"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
This is the Least Privilege principle.
The cornerstone of all IAM.People accumulate access over time.
Job changes. Projects end.
But access rarely gets removed
automatically — unless IAM is done right.The result is called Privilege Creep:
Users who started as interns but
now have access to half the company
simply because nobody cleaned it up.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"With FULL visibility"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
At any point, IAM should be able
to answer:
→ Who has access to what?
→ When was it granted?
→ Who approved it?
→ When was it last used?
→ Has it been reviewed?This visibility is what makes
compliance audits possible.
Without it, you're flying blind.━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
"And ZERO unnecessary friction"
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
This is the part most security
people forget.Security that's too painful
gets bypassed.If MFA takes 5 minutes every login,
users will find workarounds.
If access requests take 2 weeks,
managers will share passwords.
If onboarding takes 3 days,
productivity suffers.IAM must be secure AND usable.
Finding that balance is
the real art of IAM.
1.2 — Why IAM is Critical in 2026
“We’ve always had usernames and passwords. Why is IAM suddenly such a big deal?”
Get Aman Varma’s stories in your inbox
Join Medium for free to get updates from this writer.
Great question. Here’s what changed:
The World Has Changed — IAM Had to Evolve:
THE OLD WORLD (Pre-2015):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ Everyone worked in the office
→ Everything lived on company servers
→ You were inside the network = trusted
→ You were outside = blocked by firewall
→ Simple username + password was enough
→ IT managed everything locallySecurity model:
🏰 Castle with a moat
Inside = safe
Outside = enemyTHE NEW WORLD (2026):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ People work from home, cafes,
airports, other countries
→ Apps live in the cloud
(Microsoft 365, Salesforce,
SAP, ServiceNow, Workday...)
→ Companies have contractors,
partners, vendors all needing
access to different systems
→ A single company might have
50, 100, 500+ applications
→ Machines and bots need
identities too
→ Passwords alone are completely
inadequateSecurity model:
✈️ Airport security
Everyone gets checked
Even employees
Even if you've been before
Every gate validates your boarding pass
Your IDENTITY is checked at every pointThis new model is called ZERO TRUST
And IAM is its foundation.
📊 The Numbers That Make IAM Non-Negotiable:
🔴 80%+ of data breaches involve
compromised credentials
(Source: Verizon DBIR)🔴 Average cost of a data breach
in 2025: $4.88 Million USD🔴 It takes average 194 days to
detect a breach
(That's 6 months of undetected access!)🔴 Insider threats account for
19% of breaches
(Often due to poor IAM —
too much access, not enough monitoring)🔴 Companies with 500+ SaaS apps
often have NO central visibility
into who has access to whatTHE CONCLUSION:
If you don't know who has access
to what — you can't protect it.
IAM is how you know.
IAM Protects Against Real Threats:
THREAT 1: STOLEN CREDENTIALS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Attacker gets username + password
(phishing, dark web purchase, brute force)Without IAM:
→ Attacker logs in freely
→ Has access to everything the
user had access to
→ Potentially the whole companyWith IAM:
→ MFA blocks the attacker
(they have password but not
the second factor)
→ Even if they pass MFA:
Conditional Access checks device
→ Even if device passes:
Location or risk score might block
→ Identity Protection flags the
anomaly in real-time
→ Multiple layers = attacker failsTHREAT 2: INSIDER THREAT
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Disgruntled employee decides to
steal data before leaving.Without IAM:
→ Has accumulated access to
everything over years
→ Nobody notices what they download
→ Account still active for months
after they leaveWith IAM:
→ Least privilege limits what
they can access
→ Unusual download activity
triggers alert
→ Account disabled on last day
→ Access Reviews regularly
validate what they should have
→ Audit logs show exactly
what was doneTHREAT 3: FORMER EMPLOYEE ACCESS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Employee leaves. Account forgotten.
6 months later still active.Without IAM:
→ Former employee (or attacker
with their credentials) can
still log in
→ Nobody notices
→ Company has no ideaWith IAM:
→ Automated Leaver process
disables account on last day
→ All sessions revoked immediately
→ Regular orphaned account audits
→ Access Reviews catch any misses
1.3 — The IAM Ecosystem
IAM is not one thing. It’s a collection of disciplines that work together. Let me map the full picture:
THE IAM ECOSYSTEM:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┌─────────────────────────────────────────────────┐
│ IAM │
│ │
│ ┌─────────────┐ ┌─────────────────────┐ │
│ │ IDENTITY │ │ ACCESS │ │
│ │ MANAGEMENT │ │ MANAGEMENT │ │
│ │ │ │ │ │
│ │ Who are you?│ │ What can you do? │ │
│ │ Creating & │ │ Permissions, Roles, │ │
│ │ managing │ │ Policies, SSO │ │
│ │ identities │ │ │ │
│ └─────────────┘ └─────────────────────┘ │
│ │
│ ┌─────────────┐ ┌─────────────────────┐ │
│ │ IGA │ │ PAM │ │
│ │ Identity │ │ Privileged │ │
│ │ Governance │ │ Access Mgmt │ │
│ │ │ │ │ │
│ │ Are the │ │ Special controls │ │
│ │ right people│ │ for admin & │ │
│ │ having right│ │ privileged accounts │ │
│ │ access? │ │ │ │
│ └─────────────┘ └─────────────────────┘ │
└─────────────────────────────────────────────────┘IDENTITY MANAGEMENT:
→ Creating, managing, and deleting
user identities
→ The JML process
→ Attributes and profile management
→ Tools: Active Directory, Entra ID,
KeycloakACCESS MANAGEMENT:
→ Authentication (proving who you are)
→ Authorization (what you can access)
→ Single Sign-On (SSO)
→ MFA, Conditional Access
→ Protocols: SAML, OIDC, OAuth 2.0IGA (Identity Governance & Administration):
→ Ensuring access is appropriate
→ Access Reviews & Certifications
→ Role management
→ Segregation of Duties
→ Compliance & audit trail
→ Tools: SailPoint, SaviyntPAM (Privileged Access Management):
→ Securing admin and service accounts
→ Password vaulting
→ Session recording
→ Just-in-time privileged access
→ Tools: CyberArk, BeyondTrust,
Microsoft PIM
1.4 — IAM Career Paths
IAM is one of the fastest growing areas in cybersecurity. Here’s what the career landscape looks like:
ENTRY LEVEL (0-2 years):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ IAM Analyst / Administrator
→ IAM Support EngineerWhat you do:
→ Process JML requests
→ Manage access requests
→ Run access reviews
→ Basic application onboarding
→ Troubleshoot access issues
→ Document processesSalary range (Germany):
€38,000 - €50,000What you need:
→ Understanding of JML concepts
→ Basic Entra ID / AD knowledge
→ Protocol awareness (SAML/OIDC)
→ ITSM tool experience
→ Structured thinking
→ SC-300 is a strong advantage─────────────────────────────────MID LEVEL (2-5 years):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ IAM Engineer
→ IGA Specialist
→ PAM EngineerWhat you do:
→ Design and implement IAM solutions
→ Lead application onboarding
→ Build automation (PowerShell/API)
→ Design role models
→ Implement SoD policies
→ Tool administration (SailPoint etc.)Salary range (Germany):
€55,000 - €75,000What you need:
→ Deep protocol knowledge
→ Hands-on tool experience
→ Automation/scripting skills
→ Architecture thinking
→ Stakeholder management─────────────────────────────────SENIOR LEVEL (5+ years):
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ Senior IAM Engineer
→ IAM Architect
→ IAM Manager
→ CIAM SpecialistWhat you do:
→ Design enterprise IAM architecture
→ Lead IAM transformation projects
→ Define IAM strategy
→ Manage IAM teams
→ Executive-level communication
→ Drive compliance programsSalary range (Germany):
€75,000 - €120,000+─────────────────────────────────SPECIALIZATIONS:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
→ IGA Specialist
Focus: SailPoint, Saviynt
Governance, certifications, roles→ PAM Specialist
Focus: CyberArk, BeyondTrust
Privileged accounts, vaulting→ CIAM Specialist
Focus: Customer identities
Auth0, Okta — for consumer apps→ Cloud IAM Specialist
Focus: Azure, AWS, GCP
Cloud-native identity→ IAM Automation Engineer
Focus: PowerShell, Python, APIs
Automation, integration, reporting
1.5 — The 3 Dimensions of IAM Thinking
This is the most important concept in this entire guide.
Before you make any IAM decision — any access grant, any policy, any configuration — you must balance these three dimensions:
SECURITY
▲
│
│
│
│
COMPLIANCE ◄─┼──────► USABILITY
│SECURITY:
"Is this safe?"
→ What's the risk?
→ Can it be abused?
→ What's the blast radius?USABILITY:
"Can people actually work?"
→ Is this too complex?
→ Will users find workarounds?
→ Does it slow the business down?COMPLIANCE:
"Can we prove it?"
→ Is this auditable?
→ Does it meet regulations?
→ Is there a policy for this?
The Tension — and How to Handle It:
SCENARIO: Company wants to secure
access to their financial system.MAXIMUM SECURITY approach:
→ Hardware security key required
→ Access only from office network
→ Re-authenticate every 30 minutes
→ Manager approval for every login
→ Result: Completely unusable ❌
Finance team can't work.
They'll find workarounds.
Shadow IT emerges.
Security actually decreases!MAXIMUM USABILITY approach:
→ Username + password only
→ No MFA
→ Access from anywhere
→ No monitoring
→ Result: Data breach waiting to happen ❌
First phishing email =
complete access to financial data.THE RIGHT BALANCE:
→ MFA via Microsoft Authenticator
(secure AND takes 5 seconds)
→ Conditional Access:
compliant device required
(strong security, minimal friction
if device management is set up well)
→ Access from anywhere BUT
high-risk locations blocked
→ Sign-in logs monitored automatically
→ Quarterly access review
→ Result: Finance team works normally ✅
Attacker faces multiple barriers ✅
Audit can show all controls ✅THIS IS IAM DONE RIGHT.
1.6 — Key Terminology You Must Know
Before going deeper in this guide, make sure these terms feel natural to you:
TERM SIMPLE MEANING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Identity → A digital representation
of a person or system
(your account)Authentication → PROVING who you are
(AuthN) "Here is my password + MFA"Authorization → DECIDING what you can do
(AuthZ) "You can read but not delete"Provisioning → Creating and setting up
access for a userDeprovisioning → Removing access when
no longer neededLeast Privilege → Give ONLY the minimum
access neededZero Trust → Never trust anyone
automatically — always verifySSO → Single Sign-On:
One login → all appsMFA → Multi-Factor Authentication:
Password + something elseJML → Joiner-Mover-Leaver:
Identity lifecycle processIGA → Identity Governance & Admin:
Ensuring access stays correctPAM → Privileged Access Management:
Securing admin accountsConditional Access → Dynamic policies that decide
access based on context
(who, where, device, risk)RBAC → Role-Based Access Control:
Access based on job rolePrivilege Creep → Users accumulating
excess access over timeOrphaned Account → Account with no active
owner (e.g. left employee)Access Review → Regular check: does this
person still need access?SoD → Segregation of Duties:
No single person can
complete sensitive
transaction aloneIdP → Identity Provider:
The system that
authenticates users
(e.g. Entra ID, Keycloak)SP → Service Provider:
The application users
are trying to accessSCIM → Protocol for automatic
user provisioning between
systems
Chapter 2: https://medium.com/@amanvarma.clover/chapter-2-identity-lifecycle-management-jml-0aeec2f92b8b
