Identity and Access Management Architecture

Identity and Access Management (IAM) is the framework of policies and technologies that ensures the right individuals have access to the right resources at the right time for the right reasons. Think of it as the digital front door, the hallway doors, and the filing cabinet locks of an organisation. IAM covers everything from how a user proves who they are (authentication) to what they are then allowed to do (authorisation).

Three core concepts are fundamental to IAM: identification, authentication, and authorisation. Identification is when a user claims an identity, like typing a username. Authentication is proving that claim is true, usually with a password. Authorisation is determining what that verified user can actually access, such as read-only or full edit rights.

Single Sign-On (SSO) allows a user to log in once and gain access to multiple applications without re-entering credentials. For example, an employee logs into their company laptop with their network password, and from that point they can open the email system, the project management tool, and the HR portal without signing in again. The technical mechanism behind SSO is typically Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). SAML exchanges authentication and authorisation data between an identity provider (IdP) and a service provider (SP). OIDC is a modern authentication protocol built on top of OAuth 2.0, often used for web and mobile applications.

Multi-Factor Authentication (MFA) requires two or more different types of evidence to authenticate. These factors fall into three categories: something you know (password, PIN), something you have (smartphone, hardware token), and something you are (fingerprint, facial recognition). By requiring at least two of these, MFA dramatically reduces the risk of account takeover because an attacker would need to compromise multiple independent credentials. For example, a user enters a password (something they know) and then receives a push notification to their phone (something they have) to approve the login.

Privileged Access Management (PAM) focuses on controlling and monitoring access for users with elevated permissions, such as system administrators or database managers. These users have the keys to the kingdom, so PAM tools enforce strict controls like just-in-time (JIT) access, where admin rights are granted only for a specific task and time window, and session recording, where every action is logged for audit. A common PAM feature is a password vault that stores and rotates privileged passwords, so no human actually knows the root password.

Identity federation extends SSO across organisational boundaries. For example, a contractor from another company can log into your system using their own company's identity provider. This uses trust relationships established through standards like SAML or OIDC. Microsoft Entra ID (formerly Azure AD) is a popular identity provider that supports federation.

Role-Based Access Control (RBAC) assigns permissions to roles rather than individuals. A role like 'Accounts Payable Clerk' has specific access rights, and any user placed in that role inherits those rights. When a user moves to a different job, the administrator removes the old role and adds the new one instead of changing individual permissions one by one.

Attribute-Based Access Control (ABAC) is more granular, using policies that consider user attributes (department, clearance level), resource attributes (sensitivity of a file), and environmental conditions (time of day, location). For example, a policy might allow access to a financial report only if the user is in the 'Finance' department, the report is tagged as 'Confidential', and the request comes during business hours from the corporate network.

Identity lifecycle management covers the entire journey of a user's digital identity: creation (provisioning) when hired, maintenance (updates) when roles change, and deletion (deprovisioning) when the person leaves. Automated provisioning tools sync with HR systems to create accounts the moment an employee is hired and disable them the moment they are terminated, reducing the window for malicious access.

Access reviews are periodic audits where managers confirm that each user still needs their current access rights. These are critical for compliance with regulations like GDPR or HIPAA, and they help detect 'ghost accounts' — accounts belonging to former employees that were not properly disabled.

Sarah is the IT security analyst at a mid-sized accounting firm with 200 employees. She needs to deploy IAM controls that meet compliance requirements and prevent data breaches. Here is her real-world process.

First, Sarah audits the current state. She discovers that employees use a different username and password for each of the firm's fifteen applications: email, accounting software, client portal, HR system, and eleven more. Users complain about password fatigue, and the helpdesk spends 30% of its time resetting forgotten passwords. Worse, an intern's password was found on a sticky note attached to a monitor.

Sarah decides to implement SSO using Microsoft Entra ID as the identity provider. She configures each application to trust Entra ID through SAML or OIDC. Now employees log into their Windows laptop once, and every application they open authenticates through the browser without prompting for credentials again. The password fatigue problem vanishes.

Next, she enables MFA for all users. She sets a policy that requires a password plus the Microsoft Authenticator app on the employee's smartphone. For the five partners who handle the firm's most sensitive client tax data, she adds a hardware security key as a third factor. When a partner logs in from home, they enter their password, approve a notification on their phone, and then tap the security key.

For the IT team, Sarah implements PAM. She sets up a password vault that stores the administrator passwords for the firm's servers, databases, and network equipment. No one knows these passwords directly. When an admin needs to run a critical update, they submit a request through the PAM system. The request is approved by the IT manager, and then the admin is granted a temporary, time-limited session. Every command they type is recorded on video for later review.

Sarah also automates identity lifecycle management. She connects the HR system to Entra ID. When the firm hires a new accountant, the HR system triggers an automated script that creates a user account, assigns the role 'Accountant' with appropriate permissions, and sends the new hire a welcome email with onboarding instructions. When an employee resigns, HR marks them as terminated, and the system automatically disables their account within minutes, removing access to all applications.

Finally, Sarah schedules quarterly access reviews. Each manager receives a report listing their direct reports and their current access rights. The manager confirms who still needs which permissions. Any 'orphaned' accounts or stale permissions are cleaned up. This process satisfies the auditors and reduces the attack surface.