What Is IAM? Identity and Access Management, SSO, MFA and the User Lifecycle

One of the most fundamental questions of security in corporate information systems is this:

"Which user can access which system, with which authority and under which conditions?"

The answer to this question can in modern organizations no longer be given only with a username and password.

Because the resources an employee accesses are not limited to a single Active Directory server. Within the same day the user can use Microsoft 365, CRM, ERP, a cloud console, a file sharing platform, VPN, a SaaS application and various business services.

Another user, on the other hand, can be a contractor.

Another can be a privileged administrator.

An application can access another service over an API.

For this reason modern IAM – Identity and Access Management is not only a technology that creates and closes accounts but a security architecture that manages all of the organization's digital identities.

The aim of IAM is:

To verify the right identity, to give the right access, to manage the access throughout the lifecycle and to remove unnecessary authorities on time.

While doing this the following technologies can work together:

Identity Provider + Directory + SSO + MFA + Federation + SCIM + Conditional Access + Access Policies + Identity Lifecycle Management

This structure also forms the foundation of the modern Zero Trust security approach.

What Is IAM?

IAM, that is, Identity and Access Management, is the body of technology, processes and policies that manage the access of users and other digital identities to systems.

IAM carries out three fundamental security functions:

Identity Management

Authentication

Authorization

Identity Management enables the user's identity to be created and its lifecycle to be managed.

Authentication verifies whether the user really is the person they claim to be.

Authorization, on the other hand, determines which resources the verified user can access and with which authority.

When these three processes do not work together serious security gaps can arise inside the organization.

Why Is IAM Necessary?

As the organization grows identities and access rights quickly become complex.

In a small company a few users and a few applications can be managed manually.

However, in an enterprise environment there can be:

thousands of employees,

hundreds of SaaS applications,

cloud platforms,

external users,

contractors,

service accounts

these.

Manual management becomes unsustainable.

In this case IAM helps to reduce these risks:

Orphaned Accounts

Dormant Accounts

Excessive Permissions

Password Reuse

Weak Authentication

Delayed Offboarding

Uncontrolled SaaS Access

Permission Creep

Therefore IAM is not only an operational efficiency investment but at the same time a security and compliance investment.

What Is an Identity Provider?

An Identity Provider, that is, an IdP, is the central system that verifies users' identity and provides authentication information to other applications.

Inside a modern IAM architecture the IdP plays a central role.

For example the user can log in to different SaaS applications with a single corporate identity.

The Identity Provider carries out the authentication and sends trustworthy information about the user identity to the application.

In this way it may not be necessary for every application to keep a separate password database.

Identity Provider Examples

Among the platforms widely used in the modern IAM world:

Microsoft Entra ID

Okta

Ping Identity

Google Cloud Identity

Oracle Identity

solutions such as these can be found.

These platforms at different levels:

SSO

MFA

Federation

Application Integration

Conditional Access

Identity Lifecycle

can offer capabilities.

The product choice should be made according to the organization's existing infrastructure, cloud strategy and integration requirements.

The Difference Between a Directory and an Identity Provider

A directory can be thought of as the structure that stores user and group information.

An Identity Provider, on the other hand, manages authentication and federation operations.

For example Active Directory is a directory platform.

Microsoft Entra ID, on the other hand, as a cloud identity and access platform offers broader authentication and access capabilities.

These two structures can work together in hybrid environments.

What Is Hybrid Identity?

Hybrid Identity is the architecture in which an on-premises directory and a cloud identity platform are used together.

For example while the organization uses Active Directory the same identities can be synchronized with Microsoft Entra ID.

In this way the user can use both local resources and SaaS applications with the same corporate identity.

However, a hybrid identity architecture can also broaden the identity attack surface.

An on-premises compromise can affect cloud access or a cloud identity compromise can create risk for local systems.

For this reason hybrid identity security should be evaluated separately.

What Is SSO?

SSO, that is, Single Sign-On, enables users to access more than one application with a single authentication operation.

For example the user logs in with a corporate account in the morning.

Afterwards:

CRM

HR System

Cloud Storage

Collaboration Platform

they can access applications such as these without entering a password again.

This provides an important advantage in terms of user experience.

However, the real security advantage is that passwords can be managed centrally.

Does SSO Increase Security?

When configured correctly yes.

Because the user does not have to create a separate password for every application.

Password reuse can decrease.

Centralized MFA can be applied.

When the account is disabled access to many applications can be cut at the same time.

However, if the SSO account is compromised the attacker can access a large number of applications.

For this reason SSO:

Strong MFA + Conditional Access + Identity Monitoring

should be used together with these.

How Do SSO and MFA Work Together?

SSO provides convenience.

MFA, on the other hand, increases authentication security.

For example when the user carries out authentication with a corporate account:

Password

Authenticator

a check can be carried out.

After successful authentication an SSO session is created.

The user may not have to carry out MFA again and again.

However, for a sensitive application or a high-risk action Step-Up Authentication can be applied.

What Is Step-Up Authentication?

Step-Up Authentication is additional authentication being requested for a higher-risk operation even if the user has already logged in.

For example the user can access e-mail with a normal login.

However, when they enter the payroll system phishing-resistant MFA can be requested.

This provides risk-based security.

What Is MFA?

Multi-Factor Authentication enables different authentication factors to be used together.

Authentication factors are generally separated into three categories:

Something You Know

A password or PIN

Something You Have

A phone, security key, smart card

Something You Are

A fingerprint or Face Recognition

Two different categories being used increases the security level.

The Difference Between MFA and 2FA

2FA, that is, Two-Factor Authentication, uses exactly two authentication factors.

MFA, on the other hand, can contain two or more factors.

In practice the two terms can most of the time be used in place of each other.

However, technically MFA is the broader concept.

Is SMS MFA Safe?

SMS MFA is stronger than password-only authentication.

However, because of risks such as SIM Swap and phishing it is not the strongest MFA method.

For high-value identities stronger authentication methods can be preferred.

What Is Push MFA?

Push MFA sends an approve/deny notification to the user over a mobile application.

The user verifies the login attempt.

However, the attacker can force the user to approve by mistake by sending repeated requests.

This attack is known as MFA Fatigue or MFA Bombing.

What Is MFA Fatigue?

After obtaining the password the attacker continuously creates MFA requests.

The user eventually:

"Maybe the system is asking for it."

can approve the request with this thought.

Number Matching and context information can reduce this risk.

However, phishing-resistant MFA can be a stronger solution.

What Is Phishing-Resistant MFA?

Phishing-resistant MFA makes it harder for the authentication credential to be given to an attacker-controlled site in the face of fake login pages or adversary-in-the-middle attacks.

FIDO2

WebAuthn

Security Keys

Passkeys

are important technologies for this category.

What Is FIDO2?

FIDO2 is the modern standard ecosystem used for passwordless and phishing-resistant authentication.

It uses public-key cryptography.

The private key is kept on the user device.

On the server side there is no reusable password secret.

This can significantly reduce the credential phishing risk.

What Is WebAuthn?

WebAuthn is the standard that enables web applications to use public-key based authentication.

It creates a secure authentication flow between the browser and the authenticator.

It is an important component of the FIDO2 ecosystem.

What Is a Passkey?

A Passkey is the modern identity verification method that uses public-key based authentication instead of a traditional password.

During login instead of typing a password the user can use:

device unlock,

a biometric,

a PIN

these.

But the real authentication is carried out with a cryptographic key.

Because a passkey is not a reusable password it can reduce the credential phishing and credential stuffing risk.

What Is Passwordless Authentication?

Passwordless Authentication enables the user to log in without entering a traditional password.

Among the methods:

Passkeys

FIDO2 Keys

Certificates

Smart Cards

Device-Based Authentication

can be found.

The passwordless transformation can reduce the attack surface while improving the user experience.

Does Passwordless Solve Everything?

No.

It reduces the password attack surface.

However:

Session Theft

Device Compromise

Account Recovery Abuse

OAuth Abuse

risks such as these can continue.

For this reason passwordless is also part of the broader Identity Security architecture.

Why Is Account Recovery Critical?

The weakest point of an account using strong authentication can be the account recovery process.

The attacker:

"I lost my phone."

"My MFA device changed."

can try to deceive the help desk with social engineering such as this.

For this reason the recovery process must be as strong as the primary authentication.

MFA Reset Security

When an MFA device is lost a reset can be necessary.

However, the help desk can be targeted by the attacker.

For this reason for an MFA reset:

Strong Identity Verification

Approval

Audit Logging

Risk Assessment

can be applied.

For high-privilege users a stronger process is necessary.

What Is Authentication Strength?

Authentication Strength defines which authentication methods are accepted for a particular application or access scenario.

For example a general application:

Any MFA

can accept this.

A critical application:

Phishing-Resistant MFA

can require this.

This provides granular security.

What Is Federation?

Federation enables trust to be established between different identity domains.

For example an employee can log in to an external SaaS application over the corporate Identity Provider.

The SaaS application does not have to store the password in its own system.

This provides centralized identity security.

What Is SAML?

SAML, that is, Security Assertion Markup Language, is the standard widely used in enterprise federation and SSO.

The architecture generally works as:

User

↓

Identity Provider

↓

SAML Assertion

↓

Service Provider

in this way.

The application leaves authentication to the Identity Provider.

What Is a Service Provider?

The Service Provider is the application the user wants to access.

For example an HR SaaS platform can be a Service Provider.

The Identity Provider carries out the authentication.

The Service Provider gives the user access according to the assertion that comes.

SAML Security Risks

An incorrect federation configuration can create a serious security risk.

For example:

weak certificate management,

improper trust configuration,

overly broad attribute mapping

can create problems.

For this reason the federation design must pass through a security review.

What Is OAuth 2.0?

OAuth 2.0 is the delegated authorization framework that enables an application to obtain limited access to another service on behalf of the user.

For example a calendar application:

Read Calendar

can request permission.

The user does not have to give their password to the application.

The application uses an access token.

Is OAuth Authentication or Authorization?

OAuth is essentially an authorization framework.

Using OAuth directly for authentication is not the correct conceptual model.

For authentication OpenID Connect can be used.

What Is OpenID Connect?

OpenID Connect adds an authentication layer on top of OAuth 2.0.

Thanks to the Identity Token the application can learn who the user is.

It is widely used inside modern cloud-native applications.

What Is an ID Token?

An ID Token is the token that carries information about user authentication.

The application can receive claims about the user identity.

For example:

User ID

Issuer

Authentication Time

information such as this can be found.

What Is an Access Token?

An Access Token is the token the application uses for access to an API or resource.

An Access Token is used not for identity verification purposes but for resource authorization.

The token's scope and lifetime values are important in terms of security.

What Is a Refresh Token?

A Refresh Token can be a long-lived credential used to obtain a new Access Token.

If the attacker obtains a refresh token they can provide access for a long time.

For this reason token protection and session security are important.

Why Is Token Theft Important?

Modern authentication creates a token-based session after the password and MFA.

If the attacker obtains a token they can try to provide access without carrying out authentication again.

For this reason security should not focus only on the login event.

What Is Session Security?

Session Security manages the security of the user session after authentication.

For example:

Session Lifetime

Token Protection

Continuous Evaluation

Risk-Based Revocation

can be applied.

This is one of the critical areas of cloud identity security.

What Is Continuous Access Evaluation?

While the user session is active a new risk can arise.

For example:

Account disabled.

Device compromised.

Password changed.

Risk level increased.

Continuous Access Evaluation enables the session to be re-evaluated and where necessary access to be revoked quickly.

What Is SCIM?

SCIM, that is, System for Cross-domain Identity Management, is the standard used for user provisioning and deprovisioning automation.

Thanks to SCIM the Identity Provider or HR system can automatically send to a SaaS application operations such as:

Create User

Update User

Disable User

these.

This speeds up the Joiner-Mover-Leaver processes.

What Is Provisioning?

Provisioning is the necessary accounts and permissions for a new identity being created.

For example when a new Finance employee starts:

Corporate Account

E-mail

Finance Application

File Share Access

can be created automatically.

Instead of manual provisioning policy-driven automation can be preferred.

What Is Deprovisioning?

Deprovisioning is the removal of accounts and access rights the user no longer needs.

In terms of security it can be more critical than provisioning.

Because forgotten access can be used by the attacker.

What Is Joiner-Mover-Leaver?

The JML model expresses the three main stages of the employee lifecycle.

Joiner

The user who joins the organization.

Mover

The user who changes role or department.

Leaver

The user who leaves the organization.

The success of an IAM programme is directly related to how automatically and correctly these three stages are managed.

IAM in the Joiner Process

When a new employee is recorded in the HR system identity automation can start.

HR System

↓

IAM

↓

Directory Account

↓

E-mail

↓

Required Applications

↓

Role-Based Permissions

This approach reduces manual errors.

What Is Birthright Access?

It is the fundamental access rights the user receives automatically because of their role or employment type.

For example every employee:

E-mail

Intranet

Collaboration Platform

can receive access to these.

However, birthright access should be kept at the minimum level.

IAM in the Mover Process

When an employee changes role both new permissions must be given and old permissions must be removed.

Only adding new permissions creates Access Accumulation.

This can turn into a serious security risk over time.

What Is Permission Creep?

As the user takes different roles over the years permissions accumulate.

Old accesses are not removed.

The result:

the user can access far more resources than they need.

This is called Permission Creep or Privilege Creep.

IGA and Access Review processes reduce this risk.

IAM in the Leaver Process

When an employee leaves, only the Active Directory account being disabled may not be sufficient.

Because the user can have other access points such as:

SaaS Accounts

Cloud Sessions

OAuth Grants

VPN Access

API Tokens

Local Accounts

External Collaboration Access

these.

For this reason comprehensive deprovisioning is necessary.

What Is an Active Session?

Even if the user account is disabled, in some applications a previously authenticated session can stay active for a particular period.

For this reason during offboarding:

Session Revocation

Token Revocation

can be necessary.

The OAuth Consent Risk

The user may have given OAuth permissions to a third-party application.

After the employee leaves the application token can continue to provide access.

For this reason OAuth grants must also be managed within the scope of the identity lifecycle.

What Is a Shadow Account?

A user account created separately on an application outside central IAM can be thought of as a shadow account.

This account may not be affected by the corporate lifecycle process.

When the employee leaves the account can stay open.

For this reason SaaS discovery is important.

How Does Shadow IT Affect IAM?

Users can use SaaS applications that are not approved.

These applications may not be connected to the corporate SSO.

Personal credentials can be used.

In this case the security team:

which users have access,

which data is kept,

how offboarding will be carried out

may not know these.

CASB and SaaS discovery can increase this visibility.

What Is Just-in-Time Provisioning?

When the user accesses an application for the first time the account can be created automatically.

This is called JIT Provisioning.

It provides operational convenience.

However, the lifecycle and deprovisioning process needs to be managed separately.

What Is RBAC?

Role-Based Access Control is permissions being managed through the job role.

For example:

Sales Representative

Finance Analyst

HR Specialist

roles can be defined.

This role assignment standardizes access management.

What Is Role Explosion?

If the organization creates a separate role for every small access variation thousands of roles can arise.

This is known as Role Explosion.

RBAC management becomes harder.

For this reason role design must be done carefully.

What Is ABAC?

Attribute-Based Access Control uses attributes for access decisions.

For example:

Department

Employment Type

Device Compliance

Location

Data Sensitivity

context such as this can be used.

ABAC provides more dynamic access.

Can RBAC and ABAC Be Used Together?

Yes.

The role can determine the baseline access.

The attributes can apply additional conditions.

For example:

Role = Finance Manager

Device = Compliant

Location = Allowed

↓

Payment Application Access

This is the hybrid authorization model.

What Is Conditional Access?

Conditional Access evaluates the security context during login or application access.

A policy example:

User = Employee

Application = Financial System

Device = Managed

MFA = Phishing-Resistant

↓

Allow

In another case:

Device = Unmanaged

↓

Block

This is an important component of modern Zero Trust access control.

Location-Based Access

The access decision can be evaluated through the source location.

However, location should not be the only security signal.

A VPN or proxy can change the location.

For this reason it should be used together with identity, device and risk context.

Device-Based Access

Even if the user uses the correct password and MFA they can log in from an unmanaged device.

Conditional Access can limit access by checking device compliance.

This provides Identity + Endpoint integration.

Risk-Based Authentication

If the login event looks unusual stronger authentication can be requested.

For example:

New Device

Unusual Location

Suspicious IP

signals such as these can increase the risk score.

A high-risk login can be blocked.

Adaptive Authentication

Adaptive Authentication changes the authentication requirement dynamically according to user behavior and context.

Low Risk:

Normal MFA

Medium Risk:

Step-Up MFA

High Risk:

Block

This is stronger than the static authentication model.

What Is Identity Analytics?

Identity Analytics tries to detect anomalies by analyzing user login and access behavior.

For example:

unusual application access,

impossible travel,

sudden privilege use

can create signals.

This is related to ITDR and UEBA.

What Is an Identity-Based Attack?

The attacker can provide access with a legitimate credential without using malware.

Examples:

Credential Stuffing

Password Spraying

MFA Fatigue

OAuth Abuse

Token Theft

Session Hijacking

For this reason IAM security should not look only at authentication success logs.

What Is Credential Stuffing?

The attacker tries username-password combinations obtained from other data breaches on different services.

If there is password reuse the account can be compromised.

Passwordless and MFA can reduce this risk.

What Is Password Spraying?

The attacker tries a few common passwords on many accounts.

Different from a traditional brute force it tries not to exceed the account lockout thresholds.

Identity monitoring can detect this pattern.

What Is Impossible Travel?

The same user appears to have logged in from geographic locations very far from each other within a short time.

This can be a potential account compromise signal.

However, a VPN and cloud infrastructure can create a false positive.

Context is necessary.

Why Is Legacy Authentication Risky?

Old authentication protocols may not support modern MFA or Conditional Access controls.

The attacker can try to carry out password-only authentication over a legacy protocol.

For this reason legacy authentication should be reduced as far as possible.

Basic Authentication and Modern Authentication

Basic Authentication is mostly based on sending a reusable username and password.

Modern Authentication can provide OAuth-based token mechanisms and MFA integration.

That is why modern protocols are preferred.

Why Is Application Integration the Hard Part of an IAM Project?

Buying an SSO platform can be easy.

However, the integration of hundreds of applications into IAM can take time.

Applications:

SAML

OIDC

SCIM

may not support these.

For legacy applications additional gateways or custom integrations can be necessary.

For this reason an IAM project is not only a product deployment.

Legacy Application IAM Integration

Old applications may not support modern federation.

In this case:

Reverse Proxy

Identity-Aware Gateway

Password Vaulting

approaches such as these can be used.

But in the long term modernization should be evaluated.

How Do IAM and PAM Work Together?

IAM manages normal workforce access.

PAM controls privileged access more strictly.

For example the user is authenticated over IAM.

Afterwards they make a privileged access request on the PAM platform.

MFA is applied.

Approval is obtained.

A temporary session is started.

The session is recorded.

This is an integrated identity architecture.

How Do IAM and IGA Work Together?

IAM applies access technically.

IGA governs whether the access is necessary as a business matter.

For example IGA asks the manager:

"Does this employee still need financial database access?"

this question.

If the manager gives a revoke decision IAM removes the permission.

How Do IAM and ITDR Work Together?

IAM applies the access policy.

ITDR detects identity threats.

For example:

the user carried out normal authentication.

But a short time later:

New MFA Registration

Privilege Escalation

Unusual Session

were seen.

ITDR can create an incident.

IAM or SOAR can revoke the session.

IAM and SIEM Integration

Identity Provider logs must be sent to the SIEM.

The important events:

Login Success

Login Failure

MFA Failure

MFA Registration

Password Reset

New Application Consent

Privilege Assignment

Account Disable

are events such as these.

The SIEM can correlate these with endpoint and network events.

IAM and XDR Integration

XDR can combine identity signals with endpoint, e-mail and cloud telemetry.

For example:

Phishing Email

↓

User Click

↓

Risky Login

↓

Suspicious Endpoint Activity

can be seen inside the same incident.

This provides Attack Chain visibility.

Where Is Entra ID Positioned Inside Modern IAM?

Microsoft Entra ID as a cloud-based identity and access platform:

Workforce Identity

SSO

MFA

Conditional Access

Application Integration

Identity Governance

can offer capabilities such as these.

For Microsoft-heavy environments there can be a natural integration advantage.

However, architecture requirements should be evaluated separately for every organization.

Where Is Okta Positioned Inside IAM?

Okta is evaluated in the cloud-based Identity Provider and access platform class.

It can be used for SSO, MFA and lifecycle management use cases inside multi-application and heterogeneous environments.

A vendor-neutral application ecosystem can provide an advantage for some organizations.

Where Is Ping Identity Positioned?

Ping Identity is one of the platforms used especially in federation, enterprise IAM and customer identity use cases.

It can be evaluated inside complex enterprise and hybrid identity architectures.

The technical strengths and deployment model of every product are different.

How Is an IAM Product Chosen?

Looking only at the feature list is not correct.

These questions should be evaluated:

How many users are there?

How many applications are there?

Is there an on-premises environment?

What is the cloud strategy?

What is the SAML/OIDC support rate?

What are the MFA requirements?

Is customer identity necessary?

Is IGA necessary?

Is PAM integration necessary?

What are the compliance requirements?

The product choice must be made according to the architecture.

Where Should an IAM Project Be Started?

The first step should be identity discovery, not product deployment.

The organization should answer these questions:

How many active identities are there?

How many privileged identities are there?

How many external identities are there?

How many SaaS applications are there?

Which applications use SSO?

Which accounts do not use MFA?

Which users have excessive permissions?

Without this visibility the IAM roadmap remains incomplete.

How Is an IAM Roadmap Created?

An example road map:

1. Identity Inventory

Determine the Human and Non-Human identities.

2. Application Inventory

Determine the applications and authentication methods.

3. Central Identity Provider

Make authentication central.

4. SSO

Take applications into federation.

5. MFA

Make strong authentication widespread.

6. Lifecycle Automation

Apply SCIM and JML automation.

7. Conditional Access

Add device and risk context.

8. Governance

Add IGA and Access Review.

9. Privileged Security

Carry out PAM integration.

10. Detection

Create ITDR and SOC visibility.

IAM KPIs

An IAM programme must be measured with metrics.

The important KPIs:

SSO Coverage

MFA Coverage

Phishing-Resistant MFA Coverage

Automated Provisioning Coverage

Deprovisioning Time

Dormant Account Count

Orphaned Account Count

Application Federation Coverage

Legacy Authentication Usage

Access Review Completion

These metrics show the maturity.

What Is SSO Coverage?

It is the proportion of corporate applications accessed over SSO to the total applications.

As SSO coverage rises centralized identity control can increase.

What Is MFA Coverage?

It is the proportion within the total of the users or applications protected with MFA.

Especially for:

Admin Accounts

Remote Access

Critical Applications

coverage close to 100% can be targeted.

Why Is Deprovisioning Time Important?

When an employee leaves how quickly is the access closed?

Minutes?

Hours?

Days?

If a leaver account stays open for days the identity risk increases.

For this reason Mean Time to Deprovision can be an important KPI.

The Most Frequently Made Mistakes in IAM

The mistakes frequently seen in organizations:

• Seeing IAM only as Active Directory
• Not using SSO
• Leaving password-only authentication
• Applying MFA only to the VPN
• Not using stronger MFA for privileged users
• Not creating a Passkey/FIDO2 roadmap
• Leaving legacy authentication open
• Leaving SaaS applications outside SSO
• Not taking shadow accounts into the inventory
• Using manual provisioning
• Delaying the leaver process
• Not revoking active sessions
• Leaving OAuth grants outside offboarding
• Not using SCIM
• Not controlling permission creep
• Not carrying out Access Reviews
• Not applying Conditional Access
• Giving unrestricted access to unmanaged devices
• Not sending identity logs to the SIEM
• Accepting authentication success as a secure session
• Ignoring the token theft risk
• Leaving Account Recovery processes weak

IAM Security Checklist

Organizations can evaluate the following controls:

• Is there a central Identity Provider?
• Is the SSO application scope sufficient?
• Is MFA mandatory for critical applications?
• Do privileged users use phishing-resistant MFA?
• Has FIDO2/Passkey support been evaluated?
• Is a passwordless roadmap present?
• Is legacy authentication being closed?
• Is Conditional Access being applied?
• Is Risk-Based Authentication being used?
• Is Device Compliance included in the access decision?
• Are SAML/OIDC integrations in the inventory?
• Are federation trusts reviewed regularly?
• Are OAuth application permissions being controlled?
• Is SCIM provisioning being applied?
• Is the joiner process automated?
• Does the mover process remove the old permissions?
• Does the leaver process cover all systems?
• Are Active Sessions being revoked?
• Are OAuth Tokens being revoked?
• Are SaaS shadow accounts being detected?
• Are dormant accounts being closed?
• Are orphaned accounts being cleaned up?
• Do external users use an expiry policy?
• Are Access Reviews being carried out?
• Are IAM logs being sent to the SIEM?
• Are MFA registration events being monitored?
• Are password reset events being monitored?
• Is ITDR integration present?
• Is there an IAM incident response playbook?

IAM Maturity Model

Level 1 – Directory and Password

Users use local or directory accounts.

Applications work with separate passwords.

The lifecycle is mostly manual.

Level 2 – Central SSO and MFA

A central Identity Provider is used.

SSO and MFA are made widespread for critical applications.

The account lifecycle becomes more central.

Level 3 – Automated Identity Lifecycle

SCIM, Joiner-Mover-Leaver automation and Conditional Access are applied.

Access Reviews have started.

Legacy authentication is reduced.

Level 4 – Adaptive Identity Security

Risk-Based Authentication, phishing-resistant MFA and device-aware access are applied.

Identity analytics and ITDR are integrated.

Level 5 – Passwordless and Continuous Identity

Passkeys and passwordless authentication become widespread.

Sessions are evaluated with continuous risk signals.

Human and Non-Human Identity lifecycles are managed together.

The identity architecture:

Automated + Adaptive + Context-Aware + Continuously Verified

becomes this.

Frequently Asked Questions

What is IAM?

Identity and Access Management is the body of technology, processes and policies that manage the access of users and other digital identities to applications and systems.

What is SSO?

Single Sign-On enables users to access more than one application with a single authentication.

Is SSO safe?

When used with strong MFA, Conditional Access and monitoring it can provide security and user experience advantages. However, a centralized identity compromise can create a broad impact.

What is MFA?

Multi-Factor Authentication is more than one factor of different types being used during authentication.

What is a Passkey?

It is the modern authentication method that uses public-key cryptography and reduces the need for traditional reusable passwords.

What is Passwordless Authentication?

It is authentication being carried out with methods such as a passkey, FIDO2, a certificate or similar without entering a traditional password.

What is SAML?

It is the identity assertion standard used in enterprise SSO and federation scenarios.

What is OAuth 2.0?

It is the delegated authorization framework that enables applications to access resources with limited permissions on behalf of the user.

What is OpenID Connect?

It is the modern identity protocol that adds an authentication layer on top of OAuth 2.0.

What is SCIM?

It is the protocol that standardizes the automated provisioning and deprovisioning operations of users between applications.

What is Joiner-Mover-Leaver?

It is the identity lifecycle being managed in the stages of the employee joining the organization, changing role and leaving.

What is Conditional Access?

It is the access decision being given dynamically according to the identity, device, location, application and risk context.

What is Risk-Based Authentication?

It is additional authentication, access restriction or blocking being applied according to the login risk level.

When an employee leaves is closing the AD account sufficient?

Not always. SaaS accounts, active sessions, OAuth grants, cloud roles, VPN access, local accounts and external collaboration access must also be checked.

What is an Active Session?

It is the authenticated session that continues for a particular period on an application after user authentication.

Why is an OAuth Token important during offboarding?

A third-party application may be using an access token or refresh token on behalf of the user. This access must also be revoked.

Why is Legacy Authentication risky?

Some old protocols may not support modern controls such as MFA and Conditional Access and can create a password-only attack surface.

What kind of products are Entra ID, Okta and Ping Identity?

They are identity platforms that provide IAM capabilities such as workforce identity, SSO, MFA, federation and access management. They are preferred according to the architecture and use case.

Conclusion: IAM Does Not Consist of Opening and Closing Accounts

The success of a modern IAM programme cannot be measured only with the question:

"Was the user able to log in to the system?"

this question.

The essential questions are these:

Was the user verified correctly?

Are they accessing the right application?

Do they have more access than necessary?

Is the device trustworthy?

Is the login risk normal?

When the role changed were the old permissions removed?

When they left were all the sessions closed?

Is third-party OAuth access continuing?

For this reason the modern IAM lifecycle:

Identity Created

↓

Authenticated

↓

Authorized

↓

Provisioned

↓

Monitored

↓

Reviewed

↓

Deprovisioned

should be thought of in this way.

SSO provides the central authentication layer of this architecture.

MFA strengthens the authentication security.

Passkeys and Passwordless reduce the reusable password risk.

SCIM provides lifecycle automation.

Conditional Access applies context-aware security.

ITDR, on the other hand, provides detection when identity abuse takes place.

The fundamental formula of modern IAM is therefore:

Central Identity + SSO + Strong MFA + Automated Lifecycle + Conditional Access + Governance + Continuous Monitoring

in this way.

But the most important point is the lifecycle.

When a user joins the organization access must be given quickly.

When they change role permissions must be re-evaluated.

When they leave, on the other hand, access must be removed not only on one directory but across the whole digital ecosystem.

Because in today's organizations an identity does not live in a single place.

The identity:

is in the directory.

Is in SaaS.

Is in the cloud.

Is in the VPN.

Is in an OAuth token.

Is in an active session.

For this reason the most important sentence of this chapter is this:

The real success of modern IAM is measured not by giving the user access; but by being able to give the right access at the right moment and to remove it safely from the whole digital ecosystem when the need disappears.