# What Is Customer Identity and Access Management (CIAM)?

Source: https://startwithidentity.com/guides/fundamentals/what-is-ciam/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

CIAM (customer identity and access management) is the identity layer that handles sign-up, login, profiles, consent, and access for an application's external users, its customers and consumers, rather than its employees. It is built for consumer scale, with social and passwordless authentication and self-service profile management.

## How CIAM differs from workforce IAM

Workforce [IAM](https://startwithidentity.com/guides/fundamentals/what-is-iam/) optimizes for control and governance. CIAM optimizes for **conversion, scale, and experience**: every extra field or friction point in a signup flow costs real revenue. CIAM systems also carry privacy and consent obligations that internal systems usually do not.

## B2C vs B2B CIAM

- **B2C** serves individual consumers: high volume, social login, progressive profiling, fraud and bot defense.
- **B2B / SaaS** serves organizations: tenants, enterprise SSO and SCIM for your customers, and delegated administration. This is the fastest-growing slice, and many developer-first platforms specialize here.

## Common capabilities

Passwordless and [passkeys](https://startwithidentity.com/guides/authentication/passkeys-101/), social login, multi-factor authentication, bot and account-takeover defense, consent capture, and APIs and SDKs for developers.

## What makes CIAM hard

The technical problems are not login. They are the ones that only appear at consumer scale:

- **Fraud and account takeover.** Consumer accounts are attacked continuously with [credential stuffing](https://startwithidentity.com/glossary/credential-stuffing/) from unrelated breaches and real-time relay kits that capture a valid session. Your rate limiting will not stop distributed attempts from residential proxies.
- **Recovery at scale.** Every recovery path is an attack path. Email-based reset makes the account exactly as strong as the mailbox, and knowledge-based questions are answerable from public data.
- **Consent as a data problem.** Regulators ask what a specific user was shown and agreed to at a specific moment. That needs versioned consent records tied to policy text, not a boolean column. See [consent management](https://startwithidentity.com/glossary/consent-management/).
- **Migration.** Moving an existing user base means transferring password hashes, invalidating sessions, and re-enrolling MFA, usually with a dual-run period rather than a switch.
- **Cost curves.** Per monthly active user pricing that is reasonable at 50,000 users can dominate the product's unit economics at 5 million.

## Where CIAM is heading

Two shifts are visible in 2026. First, [passkeys](https://startwithidentity.com/glossary/passkey/) have crossed into mainstream consumer deployment, with WhatsApp shipping multiple passkeys per account and platform support now broad enough to make passkey-first flows viable. Second, regulation is pushing toward holder-presented credentials: the [EUDI Wallet](https://startwithidentity.com/glossary/eudi-wallet/) deadline of 24 December 2026 means regulated services in the EU will need to accept wallet presentations, which changes identity verification at the front of the funnel rather than replacing CIAM.

Neither removes the need for a customer identity system. Both change what it has to accept.

## Where to start

Compare [CIAM platforms](https://startwithidentity.com/vendors/ciam/), read our [how to evaluate CIAM](https://startwithidentity.com/guides/buyer-guides/how-to-evaluate-ciam/) guide, or see head-to-head [comparisons](https://startwithidentity.com/compare/) like Auth0 vs Clerk.