# identity-fabric

Source: https://startwithidentity.com/glossary/identity-fabric/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

An identity fabric is an architecture, not a product: a set of identity services from one or more vendors (identity provider, governance, privileged access, orchestration, analytics) connected so that policy, lifecycle and visibility stay consistent across cloud, on-premises and legacy systems. The term comes from Gartner, which [describes](https://www.gartner.com/en/conferences/na/identity-access-management-us/sessions/detail/4046039-The-10-Identity-Fabric-Principles-That-Prepare-IAM-for-the-Future) the identity fabric approach as evolving IAM infrastructure into a connected, risk-aware "system of systems."

A typical fabric has five layers: a primary [identity provider](https://startwithidentity.com/glossary/identity-provider/) for authentication and SSO, an [identity orchestration](https://startwithidentity.com/glossary/identity-orchestration/) layer that routes flows between systems, a governance layer ([IGA](https://startwithidentity.com/glossary/iga/)) for lifecycle and access reviews, a privileged access layer ([PAM](https://startwithidentity.com/glossary/pam/)), and an analytics or detection layer ([ITDR](https://startwithidentity.com/glossary/itdr/), [ISPM](https://startwithidentity.com/glossary/ispm/)) that correlates events across all of them. Shared signals, for example through the [Shared Signals Framework](https://startwithidentity.com/glossary/shared-signals-framework/), let one layer react to what another sees.

| Identity fabric | What it is not |
|---|---|
| An architecture that composes several identity services | A single suite, even if one vendor markets an "identity fabric" product |
| Consistent policy across many systems | A requirement to replace existing systems |
| Includes orchestration as one layer | The same as [identity orchestration](https://startwithidentity.com/glossary/identity-orchestration/), which is only the routing layer |

It matters because almost no enterprise runs one identity system: Active Directory sits next to Entra or Okta, a CIAM platform serves customers, and governance and PAM come from other vendors. The fabric view asks the right question, which is where policy is decided and how it reaches every system, instead of which single product to buy. The trade-off is integration cost and more tier-zero dependencies; Rubrik, for example, bought Strata in June 2026 to [fail authentication over to a secondary IdP](https://s203.q4cdn.com/667520861/files/doc_news/Rubrik-Advances-Identity-Resilience-Through-Strata-Acquisition-and-Identity-Roll-Forward-Innovation-2026.pdf) when the primary is down, a resilience layer most fabrics lack.

See also: [what is an identity fabric](https://startwithidentity.com/guides/fundamentals/what-is-identity-fabric/), [top identity fabric solutions](https://startwithidentity.com/articles/top-7-identity-fabric-solutions/), [identity orchestration platforms](https://startwithidentity.com/articles/top-7-identity-orchestration-platforms/), [identity resilience](https://startwithidentity.com/glossary/identity-resilience/), [workforce identity](https://startwithidentity.com/glossary/workforce-identity/)