Identity and Access Management (IAM)

Identity and Access Management (IAM) is a conceptual framework for centralized management of digital identities, authentication and access controls. It defines processes, roles, policies and technical mechanisms for provisioning, single sign-on, authorization and auditing to ensure security and compliance across distributed IT landscapes.

Use this profile to understand the building block briefly, place it in the model, and switch to the 360° assessment when needed.

Content type

Concept

Theoretical construct: explains a term, principle, or mental model.

Classification level

Foundation

What you need to understand to reason about a domain.

Available perspectives

Open this building block directly in an already curated view.

360°

In brief

Identity and Access Management in brief

Identity and access management (IAM) controls which digital identities authenticate and what resources they may use.

Where does it come from?

IAM connects identity administration with security and organizational processes. It covers the identity lifecycle, policies, roles, and technical enforcement.

The mental model

Think in four steps: create identity, authenticate sign-in, authorize access by policy, then log use and revoke privileges when responsibility changes. Roles express need; policies decide; enforcement points apply the decision.

Key building blocks

Identity

A person or service receives a managed digital representation with verifiable attributes.

Authentication

A method checks whether a requester belongs to that identity.

Authorization

Policies and roles determine which action is allowed on which resource.

Lifecycle

Creation, change, review, and revocation keep privileges aligned with responsibility.

When is it useful?

IAM underpins zero-trust architectures, cloud operations, and compliance. Pay attention to privileged access, separation of duties, service identities, logging, and timely offboarding.

Identity Management – Wikipedia