# IAM Interview Questions: What Identity Roles Actually Test

Source: https://startwithidentity.com/guides/career/iam-interview-questions/
Last updated: 2026-07-08
License: content by Start with Identity. Cite the source URL.

---

Identity interviews probe whether you understand protocols, can reason about trade-offs, and know how identity fails in the real world. Memorizing definitions is not enough; you should be able to explain the why. Here are the themes that come up, with what a strong answer demonstrates.

> **Practice with the full question bank.** This page covers the themes. For hundreds of questions with model-answer notes, organized by topic and difficulty tier, use our free, open-source [IAM Interview Questions repository](https://github.com/Start-With-Identity/iam-interview-questions) on GitHub. Contributions welcome, and every contributor is credited.

## Protocol fundamentals

- **Explain the difference between authentication and authorization.** A strong answer is crisp and warns against the classic mistake of using an OAuth access token as proof of login. See [authentication vs authorization](https://startwithidentity.com/guides/fundamentals/authentication-vs-authorization/).
- **OAuth vs OIDC, and when you would use each.** Know that [OAuth is authorization, OIDC adds identity](https://startwithidentity.com/guides/fundamentals/oauth-vs-oidc/), and that the [authorization code flow with PKCE](https://startwithidentity.com/standards/oauth-2-1/) is the default.
- **SAML vs OIDC.** Know why enterprises still demand [SAML](https://startwithidentity.com/standards/saml-2-0/) and when OIDC is the better choice.
- **What is in a JWT, and how do you validate one?** Signature, issuer, audience, expiry, and key rotation via JWKS.

## Design and trade-offs

- **Design SSO and lifecycle for a 5,000-person company.** They want to hear SSO via OIDC/SAML, [SCIM](https://startwithidentity.com/standards/scim-2-0/) provisioning, MFA policy, and clean joiner-mover-leaver.
- **RBAC, ABAC, or ReBAC for a given app?** Reason from the access model, not the buzzword. See [RBAC vs ABAC vs ReBAC](https://startwithidentity.com/guides/fundamentals/rbac-vs-abac-vs-rebac/).
- **How would you roll out MFA without breaking the org?** Sequence, legacy apps, recovery. See the [MFA rollout playbook](https://startwithidentity.com/guides/authentication/mfa-rollout/).

## Security and incident reasoning

- **How do attackers defeat MFA?** Strong candidates cite [MFA fatigue](https://startwithidentity.com/breaches/mfa-fatigue-push-bombing/), [help-desk social engineering](https://startwithidentity.com/breaches/scattered-spider-helpdesk-social-engineering/), and [session/token theft](https://startwithidentity.com/breaches/infostealer-session-hijacking/), then explain phishing-resistant defenses.
- **Walk through a real identity breach.** Pick one from the [breach teardowns](https://startwithidentity.com/breaches/) and explain root cause and the control that would have stopped it.

## How to prepare

Build something, read the [standards](https://startwithidentity.com/standards/), study the [breaches](https://startwithidentity.com/breaches/), and practice explaining trade-offs out loud. Depth and clear reasoning win these interviews. Then drill systematically with the topic-organized [IAM Interview Questions repository](https://github.com/Start-With-Identity/iam-interview-questions), which tags every question Junior, Mid, or Senior so you can focus on your level.

## Your next step

Once you are interview-ready, move to [how to get an IAM job](https://startwithidentity.com/guides/career/how-to-get-an-iam-job/) for the resume and portfolio, and [IAM salary guide](https://startwithidentity.com/guides/career/iam-salary-guide/) to benchmark offers. For the bigger picture, see [IAM career paths](https://startwithidentity.com/guides/career/iam-career-paths/) and [how to become an identity engineer](https://startwithidentity.com/guides/career/how-to-become-an-identity-engineer/).