What is identity access management (IAM)?

Identity and access management (IAM) is the practice of making sure that people and entities with digital identities have the right level of access to enterprise resources like networks and databases. User roles and access privileges are defined and managed through an IAM system.

Explore Cisco Duo's IAM solution Explore Identity Services Engine (ISE)

Identity and access management (IAM) is the security discipline that gives the right people and entities the right level of access to the right resources at the right time. IAM systems help IT and security teams manage digital identities and the access privileges associated with them across applications, networks, databases, and cloud services.

A complete IAM program performs four core functions:

Authentication: Verifies that a user or entity is who they claim to be, often using multi-factor authentication (MFA), passwordless methods, or federated sign-in. Authorization: Determines which resources a verified identity can access, using models such as role-based access control (RBAC), attribute-based access control (ABAC), or least-privilege access. User lifecycle management: Creates, updates, disables, and removes accounts and entitlements as roles change, including provisioning and deprovisioning. Access governance: Reviews access, enforces policies, and documents permissions so organizations can demonstrate compliance.

For authoritative guidance, the National Institute of Standards and Technology (NIST) publishes SP 800-63 Digital Identity Guidelines for identity proofing, authentication, and federation, and SP 800-162 Guide to Attribute Based Access Control for policy-based access decisions that use details about the user, resource, action, and environment.

In practice, IAM brings together multi-factor authentication, single sign-on, SAML, and two-factor authentication into one consistent approach to secure access. IAM is also a foundational building block of Zero Trust, because every Zero Trust decision starts with verifying identity before granting access to protected resources.

Four Core IAM Functions

Function	What it does	Typical capabilities
Authentication	Verifies that a user or entity is who they claim to be.	MFA, passwordless authentication, federated sign-in
Authorization	Determines which resources a verified identity can access.	Role-based, attribute-based, and least-privilege access
User lifecycle management	Creates, updates, disables, and removes accounts as roles change.	Provisioning, deprovisioning, role and group changes
Access governance	Reviews access, enforces policies, and documents permissions.	Access reviews, approvals, compliance reporting

Benefits of IAM

Enhanced IT security

With an IAM system, businesses can apply the same security policies across the enterprise. Using tools such as a NAC solution allows them to restrict which users can access resources and when. That helps greatly reduce the chance that unauthorized parties will see—or accidentally or intentionally misuse—sensitive data.

IAM methods like single sign-on (SSO) and MFA also reduce the risk that user credentials will be compromised or abused, as users don't need to create and keep track of multiple passwords. And because users need evidence-based authorization—like security questions, one-time passwords, or inherent factors like thumbprints—to access protected resources, there is less chance a malicious actor will gain access to critical resources.

Stronger compliance

IAM systems can help organizations meet the requirements of many compliance mandates related to data security and privacy. For example, IAM can aid in Health Insurance Portability and Accountability Act (HIPAA) compliance, which requires organizations that handle protected health information to implement secure electronic access to health data.

Businesses can use IAM methods like SSO, MFA, role-based access control (RBAC), and "least privileges" (giving users and entities such as software applications the minimal amount of access required to perform a task) to meet the HIPAA mandate.

IAM is also useful to financial services institutions, which need to comply with the Sarbanes-Oxley Act (SOX). Section 404 mandates that businesses implement, test, and document adequate internal controls for preparing financial reports and protecting the integrity of the financial data in those reports. Enforcement of segregation of duties (SoD) policies is one of the many ways that IAM tools and systems can help businesses adhere to SOX requirements.

Higher employee productivity

With security measures like SSO, MFA, or RBAC, organizations can enhance security while also reducing barriers that prevent workers from being productive. Employees get fast access to the resources they need to do their jobs from wherever they need to work. With IAM, employees can feel more confident they are working in a secure environment.

An IAM system that enables automated user provisioning also makes it easy for employees to request and gain authorized access to different resources when needed—without burdening IT or making IT a bottleneck to employee productivity.

Reduced IT costs

IAM solutions can automate and standardize many tasks related to identity, authentication, and authorization management. That means IT administrators can devote their time to more value-adding tasks for the business. Additionally, many IAM services are now cloud-based, so the need to purchase, implement, and maintain on-premises infrastructure for IAM can be greatly reduced or eliminated.

IAM capabilities

Allow or block access to assets

IAM systems are designed to allow or block access to protected data and applications. More sophisticated IAM solutions allow businesses to get even more granular with permissions. For example, they can set conditions on the time of a day that a specific user can access a service, and from what location.

Restrict platform access

An organization may use an IAM solution to limit which users can access platforms used for the development, staging, and testing of products and services.

Prevent sensitive data transmission

Many businesses use IAM to enhance their data security, setting strict permissions for which users can create, change, or delete data, and who can transmit it. By applying RBAC, for example, a temporary employee may not be allowed to send or receive any data outside of the company's systems.

Provide reporting

IAM systems provide reports that help organizations prove their compliance with data security and privacy regulations. Insights from these reports can help businesses improve security processes and reduce risks. The insights also help them better understand what resources workers need to be the most productive in their jobs.

IAM tools and methods

Multi-factor authentication

With MFA, users are asked to provide a combination of authentication factors to verify their identities. In addition to usernames and passwords, enterprises commonly use the time-based one-time password (TOTP) method, which requires users to provide a temporary passcode that has been sent via SMS, phone call, or email. Other MFA systems require users to provide biometric authentication of their identity–also referred to as inherent factors–such as a fingerprint or facial ID scan. Cisco Duo includes best-in-class MFA capabilities.

Single sign-on

SSO is an identification system commonly used in enterprises to verify users' identities. It allows an authorized user to securely log in to multiple SaaS applications and websites using only one set of credentials (username and password). SSO can be viewed as an automated version of MFA. SSO systems authenticate users with MFA and then, using software tokens, share that authentication with multiple applications. SSO can also be used to prevent access to designated assets or locations, such as outside websites and platforms. Cisco Duo includes SSO that enables secure access to a wide range of applications.

The upside of using the SSO approach for IAM–aside from a more seamless login process for end users–is that it gives IT administrators the ability to set permissions, regulate user access, and provision and deprovision users with ease.

Federation

Federation allows for SSO without passwords. Using a standard identity protocol, like Security Assertion Markup Language (SAML) or WS-Federation, a federation server presents a token (identity data) to a system or application with which it has an established trust relationship. Because of that trust, users can then move freely between connected domains without having to reauthenticate.

RBAC and zero trust

Many large enterprises use RBAC, which is a method for restricting access to networks, sensitive data, and critical applications based on a person's role and responsibilities within an organization. RBAC is also known as access governance. Defined roles in RBAC may include end users, administrators, or third-party contractors. A role can be based on a user's authority, location, responsibility, or job competency. Sometimes roles are grouped together–for example, Marketing or Sales–so users with similar responsibilities in an organization who frequently collaborate can access the same assets.

By applying a zero trust security framework as part of RBAC, where very strict access controls are maintained with all users who request access to work assets, businesses can further prevent unauthorized access–and even contain breaches and reduce the risk of an attacker's lateral movement through the network.

Implementing IAM

Consider current and future IAM needs

IAM solutions with basic capabilities for managing user access to company resources can be easily set up "out of the box." But if your organization is large and complex, you might need a more advanced solution or a combination of systems and tools.

Before investing in an IAM system, thoroughly consider what your business needs today--as well as what it might need in the future. Think about IT infrastructure needs in addition to the capabilities of the solution itself. Two important questions include: Will the solution be easy to maintain? And will it scale to meet our business needs as we add more applications and users?

Check compatibility and compliance

Before you invest in an IAM solution, confirm that it is compatible with your current operating system, third-party applications, and web servers. You may want to create a list of all the applications you'll need to integrate with the IAM, so that nothing is overlooked.

Also confirm that the IAM system you want to implement complies with any applicable local and federal regulatory requirements. An IAM solution should enhance compliance--not create more potential risks for your business.

Manage the change

Shifting to a new way of authenticating and authorizing users may require change management. Consider rolling out the new IAM solution to select areas of the business first--such as finance--before implementing it throughout the entire organization.

Keep in mind that IAM will impact everyone and everything that needs to access the company's IT resources. To help encourage adoption of the new IAM tools and processes, take time to first get buy-in from all key stakeholders.

Set and track key metrics

You will want to track the effectiveness of your IAM solution and determine whether the system is delivering a return on investment. Once your system is up and running, consider tracking and regularly reporting on the time it takes to provision new users, the number of password resets, and the number of potential SoD violations.

Consider endpoints or devices

In a complex network that has private IT infrastructure, or in an Internet of Things (IoT) and operational technology (OT) environment, using an IAM system alone to manage user access to IT assets could actually create a security risk. More specifically, it could leave the organization open to botnet attacks.

A NAC solution can enhance security in these environments. For example, it can apply defined profiling and access policies for various IoT device categories. And it can mitigate network threats by enforcing security policies that block, isolate, and repair noncompliant machines, without administrator attention.

Identity and access management (IAM) is the security discipline that gives the right people and entities the right level of access to the right resources at the right time. IAM systems manage digital identities and access privileges across applications, networks, databases, and cloud services.

The four core components of IAM are authentication, authorization, user lifecycle management, and access governance. Authentication verifies identity, authorization grants access to specific resources, lifecycle management adjusts access as roles change, and governance reviews and documents permissions.

IAM is the broader discipline that manages digital identities and the access tied to them, including authentication and authorization. IGA is a subset of IAM focused on governance, such as access reviews, certifications, entitlement management, and compliance reporting. Most organizations use IAM and IGA together to both grant access and prove that access is appropriate.

IAM supports Zero Trust by verifying identity and applying access controls before users or devices reach protected applications, data, and systems. In a Zero Trust model, every access request is evaluated based on identity, device posture, and context, so IAM provides the identity signal at the core of every policy decision.

The main benefits of IAM are reduced risk of unauthorized access, stronger compliance with regulations such as HIPAA and SOX, faster onboarding and offboarding, a simpler login experience for users, and consistent access policies across the organization. Together, these benefits help organizations improve security and productivity at the same time.