Identity and access management
noun · also IAM · NIST CSRC Glossary
The processes and tools that manage digital identities and decide what each one can access, from account creation to removal.
Identity and access management (IAM) answers two questions for every request: who are you (authentication) and what are you allowed to do (authorization). It covers people, but also service accounts, applications, devices and, increasingly, automated workloads.
A complete IAM program manages the whole lifecycle: an account is created when someone joins, its access changes when they move to another team, and it is disabled when they leave (often called joiner, mover, leaver). Single sign-on, MFA, role-based access, access reviews and privileged access management are all parts of IAM. Microsoft Entra ID, Okta and Google Cloud Identity are common identity providers at the center of it.
Example
An employee moves from finance to sales. Without a proper mover process, they keep their old access to the payroll folder and the accounting system and gain the sales tools on top. Two years later, their account is compromised, and the attacker inherits access to everything they ever touched.
Why it matters for a SOC analyst
Most modern attacks target identities rather than machines: stolen passwords, abused sessions, forgotten accounts. IAM logs, such as sign-ins, audit logs and role assignments, are where many investigations start and end. Accounts that should have been disabled, and permissions nobody remembers granting, are frequent findings worth reporting.
Related terms
- Role-based access control
Granting permissions to roles, such as Help Desk or Billing Reader, and then assigning people to roles, instead of granting rights person by person.
- Least privilege
Giving every user, service and application only the access it needs to do its job, and only for as long as it needs it.
- Multi-factor authentication
Signing in with two or more different kinds of proof, such as a password plus a phone or security key, so a stolen password alone is not enough.
- Conditional Access
Microsoft Entra ID's policy engine that decides, at each sign-in, whether to allow access, require MFA or another control, or block.