IAM
IAM stands for identity and access management: the policies, processes and technology an organization uses to make sure the right identities (people and machines) get the right access to the right resources, and nothing more. In practice it covers four jobs: identifying users, authenticating them, authorizing what they can do, and managing that access across its lifecycle with an audit trail.
| IAM full form and scope | What it is not |
|---|---|
| Identity and Access Management, usually for the workforce: employees, contractors, partners, service accounts | CIAM, which manages customers signing up to your product |
| The umbrella that includes SSO, MFA, IGA and PAM | A single product, although IDaaS suites cover much of it |
| Access decisions for applications, data and infrastructure | Cloud provider IAM only (AWS IAM, Azure RBAC), which is one slice of it |
Workforce IAM is a lifecycle problem more than an authentication problem: the login is solved, and the failures are in what happens when someone joins, moves, or leaves, and in the accounts that belong to no one. It also increasingly covers identities that are not people at all, since service accounts and workloads now outnumber employees in most environments by a wide margin.
See also: what is IAM, what is IGA, what is CIAM, IAM vendors, open source IAM
Related on Start with Identity
- GlossaryIdentity Fabric
An identity fabric is an architecture, not a product: a set of identity services from one or more vendors (identity provider, governance, privileged access, orc
- BlogOnly 27% of identity vendors publish a price, and identity governance scores 5 out of 100
SWI's Identity Pricing Transparency Index 2026 classified the pricing of 295 identity vendors on sale on October 30, 2026. 79 publish a price for any paid tier,
- GlossaryAccess Certification
Periodic review of who has access to what, with managers or resource owners attesting that access is still appropriate. A regulatory requirement in many industr
- GlossaryBreak-Glass Account
A tightly controlled emergency account used only when normal access fails, with strong vaulting, monitoring, and alerting. Tested regularly so it works in a rea
- BlogMoving into IAM? Start with workforce identity and learn to trace one person's access
Most people who move into identity and access management land in workforce identity first: employees, contractors and the systems they sign in to. The fastest w
- Blog1Password buys Apono, moving from credential vault to access control plane
Reported at 250 to 300 million dollars, the deal gives 1Password just-in-time privileged access across AWS, Azure, GCP, Kubernetes, Snowflake, and Databricks, a