IAM, identity and access management, is the discipline and technology that makes sure the right people and systems have the right access to the right resources at the right time. It covers creating identities, authenticating them, deciding what they may do, reviewing that access and removing it when it is no longer needed.

What does IAM stand for?

IAM stands for Identity and Access Management. In cloud contexts the same letters also name a specific service, AWS Identity and Access Management, which controls permissions inside an AWS account; the discipline is broader.

What is the difference between IAM and IGA?

IAM is the broad practice of managing identities and access, including authentication, SSO, and provisioning. IGA, identity governance and administration, is the governance layer on top: access requests, certifications, segregation of duties and policy that keep access correct over time.

What are the core components of IAM?

Authentication, authorization, lifecycle and provisioning, governance, and federation or single sign-on, plus privileged access for administrators. Each has a standard underneath: OpenID Connect and SAML for sign-in, OAuth 2.0 for delegated authorization, SCIM for provisioning and WebAuthn for passkeys.

What are examples of IAM tools?

Workforce IAM platforms include Okta, Microsoft Entra ID, Ping Identity, JumpCloud, OneLogin and IBM Verify. Open-source IAM options include Keycloak, Zitadel, Authentik and Ory. Customer-facing apps use CIAM platforms such as Auth0 instead.

Is there a good open source IAM?

Yes. Keycloak, a CNCF project sponsored by Red Hat, is the most widely deployed open-source IAM server; Zitadel, Authentik, Ory and FreeIPA are common alternatives. The licence is free, but you run, patch, scale and secure the servers yourself.

What is an IAM maturity model?

A staged way to describe how far an identity program has progressed, typically from a directory with manual provisioning, through SSO and automated lifecycle, to governed access and continuous, phishing-resistant authentication. It is useful for locating gaps and sequencing work, not as a score to report.

Is IAM the same as cybersecurity?

No. IAM is a critical pillar of security focused on identity and access, but cybersecurity also spans network, endpoint, data, and application security.

What Is Identity and Access Management (IAM)?

Identity and access management (IAM) is the discipline of making sure the right people and systems have the right access to the right resources, at the right time, and for the right reasons. IAM covers how identities are created, authenticated, authorized, governed, and eventually removed, for employees, contractors, customers and machines. It is the control most breaches test first, because a valid login is the cheapest way in.

The core building blocks

Component	What it does	Standard underneath (status, November 2026)
Authentication	Proves who someone is: passwords, MFA, passkeys	WebAuthn Level 3, W3C Recommendation 25 August 2026
Federation and SSO	Lets one identity work across many applications	OpenID Connect Core 1.0 (also ISO/IEC 26131:2024); SAML 2.0, OASIS Standard since 2005
Authorization	Decides what an authenticated identity may do	OAuth 2.0 (RFC 6749, hardened by the RFC 9700 security BCP in 2025); OAuth 2.1 still an IETF draft; AuthZEN 1.0 Final January 2026
Lifecycle and provisioning	Creates, updates and removes accounts, ideally driven by the HR record	SCIM 2.0 (RFC 7643 and 7644, updated by RFC 9865 and RFC 9967)
Governance	Reviews and certifies access so it does not drift	Policy and audit, not a protocol; see IGA
Signals and response	Shares risk events and revokes sessions across tools	Shared Signals Framework, CAEP and RISC, Final since 29 August 2025

See authentication vs authorization and OAuth vs OIDC for the distinctions people most often mix up.

IAM and its neighbours

IAM is the umbrella. The adjacent disciplines are bought separately, so it helps to know where the lines fall.

Discipline	Who it covers	Main job	Read more
Workforce IAM	Employees, contractors, partners	SSO, MFA, lifecycle	What is workforce identity
CIAM	Customers and business users of your product	Sign-up, login, consent at large scale	What is CIAM, CIAM vs IAM
IGA	Everyone with access	Requests, certifications, segregation of duties	What is IGA
PAM	Administrators and privileged accounts	Vaulting, session control, just-in-time access	What is PAM
Non-human identity	Service accounts, API keys, workloads, AI agents	Inventory, ownership, rotation	What is NHI
ITDR	Identity infrastructure	Detecting and responding to identity attacks	What is ITDR

In cloud consoles, "IAM" also names a specific permissions service, such as AWS Identity and Access Management. That is one cloud's authorization layer; managing permissions across clouds is covered in what is CIEM.

Delivered as a cloud subscription, IAM is called IDaaS. The Zero Trust explainer covers the architecture that puts identity at the center.

The IAM market in 2026

Ownership moved fast this year, and it affects roadmaps and renewals. Palo Alto Networks closed its acquisition of CyberArk on 11 February 2026 and rebranded it Idira (formerly CyberArk) on 12 May 2026. ServiceNow closed Veza on 2 March 2026. Okta bought Axiom Security in 2025 and Permiso Security (closed 26 August 2026). Rubrik acquired Strata Identity on 9 June 2026 for identity failover, and Workday's agreement to acquire C1 (announced 13 October 2026) was still pending. The full list is in identity acquisitions and the Identity Consolidation Report 2026.

On price, workforce IAM is partly public. On 30 October 2026 SWI read Okta Workforce Starter at $6 and Essentials at $17 per user per month with a $1,500 annual minimum, Microsoft Entra ID P1 at $7 and P2 at $10 per user per month paid yearly, and JumpCloud SSO at $11 per user per month annually. Across all 20 IAM platform vendors in the Identity Pricing Transparency Index 2026, 65% are quote-only.

Shortlist by situation

Situation	Start with	Ranking
Large enterprise, many SaaS apps	Okta, Microsoft Entra ID, Ping Identity	Best IAM for enterprises
Microsoft 365 shop	Microsoft Entra ID	Okta vs Microsoft Entra
Complex hybrid or self-hosted federation	Ping Identity, ForgeRock (part of Ping)	Okta vs Ping Identity
Small or mid-sized business	JumpCloud (directory plus device management), OneLogin	Best IAM for SMB
Want to self-host, no licence fee	Keycloak, Zitadel, Authentik	Top open-source IAM solutions

For the scored field see the best IAM platforms, and for a decision framework, how to choose an IAM platform.

What actually goes wrong

IAM programs rarely fail at the login screen. They fail in five places, and each has a breach on record:

Movers and leavers. Internal transfers accumulate entitlements from every role a person has held, and leavers keep access when deprovisioning misses a system. A former Cash App Investing employee downloaded reports on about 8.2 million customers after their employment ended (orphaned account abuse).
Accounts outside SSO. Local admin accounts, vendor logins, legacy VPN profiles and test tenants never enter the identity provider. Colonial Pipeline was entered through a legacy VPN profile with only a password, and Midnight Blizzard sprayed a legacy test tenant account without MFA.
The help desk. At MGM Resorts a call to the IT help desk led to control of Okta super administrator accounts; MGM estimated a $100 million hit (help desk social engineering).
Non-human identities. Service accounts, API keys and workloads typically have no owner, no expiry and no place in any review. In SWI's Identity Breach Report 2026, the share of breaches abusing a non-human identity rose in each two-year period from 2021 to 2026.
Session and token lifetime. Once SSO concentrates authentication, a stolen session is worth as much as a password and survives a reset. In 2026 one actor replayed stolen Microsoft 365 tokens into 79 organizations (session cookie theft).

IAM maturity model, roughly

Directory only. Accounts exist, provisioning is manual, no consistent MFA.
SSO deployed. One identity provider fronts most applications, MFA enforced with exemptions.
Lifecycle automated. HR events drive provisioning and deprovisioning through SCIM; the exemption list is short and reviewed.
Governed. Access certification runs with real revocation rates, segregation of duties rules are enforced at request time, non-human identities have owners.
Continuous. Phishing-resistant MFA everywhere, standing privilege near zero, identity threat detection in place.

Most organizations are at stage two and describe themselves as stage four. The honest test is whether you can answer, right now, who has access to your most sensitive system and why. For a fuller self-assessment, use the IAM maturity model framework or the maturity assessment tool.

What to do first

The order that produces the most risk reduction per unit of effort, as a practitioner estimate rather than a measured result: enforce phishing-resistant MFA and shrink the exemption list, automate joiner-mover-leaver from the HR record, inventory accounts that live outside SSO, lock down help desk resets, then start certification on the systems that matter rather than on everything. Narrow a shortlist with the vendor selector and browse workforce IAM platforms.