Moving into IAM: Why Workforce Identity Comes First

Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest way to become useful there is to learn the lifecycle end to end, from HR record to the last application, and then the protocols that carry it. A plan for help desk, sysadmin and developer crossovers.

If you are moving into identity and access management from the help desk, systems administration or software, start with workforce identity: the accounts, sign-ins and access of the people who work for an organization. It is where most entry roles sit, and it teaches the one skill every later specialty depends on, which is tracing a single person's access from the HR record through the directory and identity provider to every application they can reach, and back out again when they leave. Learn that trace before you learn a second vendor console.

Our new guide, what is workforce identity, defines the field and its components. This post is the career version: what the work looks like from the inside, how the skills you already have transfer, and what to build to prove it.

Key takeaways

Workforce identity is the usual front door into IAM, because analyst and administrator roles run its daily lifecycle.
The leaver step is where organizations fail and where a newcomer can add value quickly.
Your previous job already covers part of the map. Spend your study time on the part it does not.
One working project that provisions, authenticates and deprovisions a test user says more than a list of acronyms.

What the work looks like on a normal week

The IAM career paths guide names the IAM analyst or administrator as the best on-ramp, and the reason is the queue. A typical week mixes four kinds of tickets:

Joiners. A new hire needs an account, the right groups, MFA enrollment and access to the applications their role expects. You learn what "birthright access" means in your organization, and how much of it is still granted by hand.
Movers. Someone changes team. The new access is requested within a day; the old access is rarely removed unless a process forces it. This is how entitlements accumulate, and spotting it is a real contribution.
Leavers. Access must end everywhere, including applications outside single sign-on. The joiner-mover-leaver model is simple on paper and messy in practice.
Authentication support. Locked accounts, lost phones, new devices, and from this autumn a lot of passkey questions.

None of this is glamorous, and all of it is the job. People who treat the queue as a map of how the organization's identity actually behaves tend to move up faster than people who treat it as a chore.

Why the leaver path is your best first project

Offboarding is the step most programs believe they have solved. In a FIDO Alliance and HID survey of 500 IT and security decision-makers, released on June 15, 2026, 94 percent said they could revoke all physical and digital access within 24 hours of an employee leaving, while 35 percent reported delays or failures doing so in the past two years.

The gap usually has ordinary causes. An application was never connected to provisioning. A disable in the directory did not end sessions or API tokens downstream. A shared admin account had no owner. Our SCIM in practice analysis from last week walks through why active: false means whatever each application decides it means, and why group removals drift.

For a newcomer this is useful ground. Pick one recent leaver (with permission), list every system they had access to, and check each one. You will learn the estate faster than any training course could teach it, and you will probably find something.

Map what you already know

Each crossover route starts with a different half of the picture. Use this to decide where to spend study time.

Coming from	What already transfers	What to learn first
Help desk	Account resets, MFA enrollment, how users actually fail at sign-in, the verification questions callers can and cannot answer	Federation: how SSO works over SAML and OpenID Connect, and why the identity provider, not each app, decides who signs in
Systems administration	Active Directory groups, Group Policy, service accounts, often administration of a cloud identity provider	Provisioning with SCIM 2.0, and governance: access certification and least privilege as ongoing work
Software development	OAuth 2.0 and OIDC from the client side, tokens, APIs	The lifecycle side: where accounts come from, who approves access, and what happens to an app's users when HR marks someone terminated

Help desk experience is underrated. The people who reset passwords for a living already know the weakest point in most identity programs, which is a person on the phone deciding whether a caller is who they claim to be. That knowledge matters more every month; we come back to it in a post later this week.

What changed in 2026, and why it helps newcomers

Two changes this year make workforce identity a better entry point than it was.

Phishing-resistant sign-in became the default expectation. NIST SP 800-63B-4 requires verifiers to offer at least one phishing-resistant option at AAL2. Microsoft made passkeys the default in Microsoft Entra ID on September 1, 2026, and its retirement guide says Microsoft-provided SMS and voice MFA ends on February 1, 2027 for most users, with a blocking passkey registration prompt for anyone left on SMS or voice alone. Every organization on Entra ID now has a migration to run, and migrations need people who understand both the user and the protocol. The FIDO Passkey Index 2026 is a good primer on how those rollouts go in practice.

Software started acting for employees. AI agents that read mail or file tickets on a user's behalf need access tied to that user and scoped to the task. That is a workforce identity problem with a new kind of subject. Our agent identities analysis covers the delegation model. You do not need to specialize in it on day one, but knowing that OAuth token exchange exists will set you apart in an interview.

Build one project that covers the whole lifecycle

The how to get an IAM job guide makes the case for a portfolio. Here is a single project that covers the lifecycle end to end, using free developer tiers:

Create a small web app and add sign-in through an identity provider over OIDC. The authorization code with PKCE recipe is a good starting point.
Require MFA, then add passkeys with the WebAuthn recipe.
Connect provisioning with SCIM so that creating a user in the identity provider creates them in your app.
Then do the part most demos skip: deactivate the user in the identity provider and show what happens in your app. Does their session end? Can an existing token still call your API? Write down what you found and what you changed.

That last step is the difference between a tutorial and evidence of judgment. Interviewers for analyst and engineer roles ask about joiner-mover-leaver and compromised accounts (see our interview questions guide), and a candidate who can say "I tested deactivation and found my app kept the session alive for an hour" is answering from experience.

Where to go after the first year

Once the lifecycle is familiar, the tracks branch: engineering and architecture, governance, privileged access and detection, or leadership. The career paths guide describes each, and identity security certifications helps pick one credential to match. Whichever you choose, the habit carries over. Every specialty in identity comes back to the same question you learned on the queue: who has access to what, why, and how would we know if it were wrong?

What is workforce identity and what is IAM
How to become an identity engineer
Orphaned account abuse, the technique that follows a missed leaver
IAM jobs board