# What Is Identity and Access Management (IAM)?

Source: https://startwithidentity.com/guides/fundamentals/what-is-iam/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

Identity and Access Management (IAM) is the discipline of making sure the right people and systems have the right access to the right resources, at the right time, and for the right reasons. It covers how identities are created, authenticated, authorized, governed, and eventually removed.

## The core building blocks

- **Authentication** proves who someone is (passwords, [MFA](https://startwithidentity.com/guides/fundamentals/authentication-vs-authorization/), passkeys).
- **Authorization** decides what they can do once authenticated.
- **Lifecycle and provisioning** create, update, and deprovision accounts, often automated from an HR system through SCIM.
- **Governance** reviews and certifies access so it does not drift out of control over time.
- **Federation and SSO** let one identity work across many applications.

## Workforce vs customer identity

IAM usually refers to **[workforce identity](https://startwithidentity.com/guides/fundamentals/what-is-workforce-identity/)**: employees, contractors, and the internal apps they use. The customer-facing equivalent is [CIAM](https://startwithidentity.com/guides/fundamentals/what-is-ciam/), which optimizes for sign-up conversion and scale rather than internal governance. Adjacent disciplines include [Privileged Access Management](https://startwithidentity.com/guides/fundamentals/what-is-pam/) for admin accounts and [Identity Governance](https://startwithidentity.com/guides/fundamentals/what-is-iga/) for access reviews.

## Why it matters

Most breaches involve stolen or misused credentials, which is why identity has become the primary security perimeter. See our [research data points](https://startwithidentity.com/research/) for the numbers, and our [Zero Trust explainer](https://startwithidentity.com/guides/fundamentals/what-is-zero-trust/) for the architecture that puts identity at the center.

## What actually goes wrong

IAM programs rarely fail at authentication. Login is a solved problem. They fail in four places:

- **Movers.** Joiners get access because someone is waiting to work and leavers get removed because HR triggers it, but internal transfers accumulate entitlements from every role a person has ever held. This is the single most common audit finding.
- **Accounts outside SSO.** Local administrator accounts on appliances, vendor support logins, and SaaS bought on a corporate card never enter the identity provider, so removing someone from SSO does not remove their access.
- **Non-human identities.** Service accounts, [API keys](https://startwithidentity.com/glossary/api-key/), and workloads now outnumber employees by a wide margin in most environments, and they typically have no owner, no expiry, and no place in any review.
- **Session and token lifetime.** Once [SSO](https://startwithidentity.com/glossary/sso/) concentrates authentication, a stolen session is worth as much as a stolen password and survives a password reset. See [token theft](https://startwithidentity.com/glossary/token-theft/).

## Maturity, roughly

A useful way to locate yourself:

1. **Directory only.** Accounts exist, provisioning is manual, no consistent MFA.
2. **SSO deployed.** One identity provider fronts most applications, MFA enforced with exemptions.
3. **Lifecycle automated.** HR events drive [provisioning](https://startwithidentity.com/glossary/provisioning/) and deprovisioning through [SCIM](https://startwithidentity.com/standards/scim-2-0/); exemption list is short and reviewed.
4. **Governed.** Access certification runs with real revocation rates, [segregation of duties](https://startwithidentity.com/glossary/sod/) rules are enforced at request time, non-human identities have owners.
5. **Continuous.** [Phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/) everywhere, standing privilege near zero, identity threat detection in place.

Most organizations are at stage two and describe themselves as stage four. The honest test is whether you can answer, right now, who has access to your most sensitive system and why.

## What to do first

If you are early, the order that produces the most risk reduction per unit of effort is: enforce phishing-resistant MFA and shrink the exemption list, automate joiner-mover-leaver from the HR record, inventory accounts that live outside SSO, then start certification on the systems that matter rather than on everything.

## Where to start

Browse [workforce IAM platforms](https://startwithidentity.com/vendors/iam/), or use the [vendor selector](https://startwithidentity.com/tools/vendor-selector/) to narrow a shortlist by your requirements.