Identity and Access Management (IAM)

What is Identity and Access Management (IAM)?

Identity and Access Management (IAM) is the framework of policies, processes, and technologies that ensures the right people have the right access to the right resources at the right time. It spans authentication (verifying who a user is), authorization (deciding what they can do), and the full identity lifecycle (provisioning, governance, and deprovisioning) across a company's systems and applications.

How IAM works

• A central identity store holds user identities and attributes (the source of truth).
• Authentication verifies identity at login, often with SSO and MFA.
• Authorization applies access models such as RBAC or ABAC to decide permissions.
• Lifecycle management provisions, updates, and deprovisions accounts as people join, move, and leave.
• Governance and audit continuously review access for compliance.

IAM vs IGA

IAM is the broad discipline. IGA is the governance layer inside it.

Concretely, IAM spans authentication, authorization, and the identity lifecycle, and answers whether a user can log in and act, through features such as SSO, MFA, and provisioning. IGA sits inside it and covers governance, review, certification, and policy, answering whether a user should have a given access, through access reviews, separation of duties, and audit trails.

Examples and use cases

A 300-employee company unifies Google Workspace, Slack, and 80 other apps under one IAM approach: one identity per person, role-based permissions, MFA at login, automated provisioning on day one, and clean deprovisioning on the last day. In practice the weak point is the long tail of SaaS apps bought outside IT, which is exactly where converged SaaS Management and IAM closes the gap.

Related concepts

• Article: Fundamental concepts of identity and access management
• Story: Automated IAM at Apgar

FAQ

What are the main pillars of IAM?

‍Authentication, authorization, user lifecycle management (provisioning and deprovisioning), and governance. Together they control who gets access and whether it stays appropriate.

What is the difference between IAM and IGA?

‍IAM is the overall discipline of managing identities and access. IGA is the governance layer within IAM that focuses on reviewing, certifying, and proving that access is appropriate.

Is IAM only a security concern?

‍No. IAM also drives productivity (fast onboarding), cost control (reclaiming unused licenses), and compliance, which is why it spans IT, security, and finance.

Corma unifies IAM and SaaS Management so identity, access, and software spend stay aligned. Request a demo.