Identity and access management (IAM) is a framework of policies, processes, and technologies that makes sure the right identities, whether people, devices, or software, get the right access to the right resources at the right time. It covers how an identity gets established, how it proves itself, and what it's allowed to do once it's in.
What IAM covers
IAM isn't a single product. It's the umbrella term for everything an organization does to identify who or what is requesting access, confirm that identity is genuine, and decide what it's permitted to touch. That includes the directory that stores identity records, the authentication step that checks a credential, the authorization logic that maps identities to permissions, and the audit trail that records what happened afterward. NIST and other standards bodies describe IAM in almost exactly these terms: a framework of policy and technology, not a single tool. Most organizations build IAM for employees and contractors first, because that's where security and compliance pressure shows up earliest. But the same underlying problem, matching an identity to the right access, shows up anywhere an application has users, whether they're on payroll or not.
Why IAM matters
Access decisions that go wrong show up as security incidents, failed audits, or people who can't do their jobs. An employee who keeps system access after leaving is a breach waiting to happen. A contractor with more permissions than the role requires is exposure the organization didn't need to carry. A finance system that can't show who approved a transaction fails an audit before anyone asks a second question. IAM exists to close these gaps at scale, across thousands of identities and applications, without someone manually reviewing every request. Get it right, and access grows and shrinks automatically as roles change. Get it wrong, and every new application is one more place where the wrong person ends up with the wrong access, and nobody notices until it's a problem.
How IAM works
IAM breaks down into a small set of functions that repeat across every identity in the system.
- Identification. Establishing a unique digital identity for a person, device, or piece of software, usually a record in a directory.
- Authentication. Confirming the identity is who or what it claims to be, through a password, a token, biometrics, or a combination.
- Authorization. Deciding what an authenticated identity is allowed to do, based on role, group membership, or policy.
- Roles and permissions. The structure that maps identities to access levels, so permissions can be assigned by role instead of one at a time.
- **Provisioning and deprovisioning.
Frequently asked questions
What's the difference between IAM and CIAM?
IAM manages internal identities (employees, contractors) where IT controls the devices and stakes are primarily security; CIAM manages external customer identities where the priority is frictionless, self-service access that supports revenue and conversion.
Can one vendor handle both IAM and CIAM?
Some try, but the workflows, scale, and UX requirements are different enough that most organizations run separate systems, or a vendor purpose-built for the customer side.
Where do AI agents fit, IAM or CIAM?
Agents can appear on either side: an agent acting on an employee's behalf is IAM's problem, while an agent acting on a customer's behalf falls under agentic CIAM.
See also
Entries that come up in the same conversation as Identity and Access Management (IAM).
.avif)