The purpose of IAM is to stop hackers while allowing authorized users to easily do everything they need to do, but not more than they're allowed to do. IAM implementations use a variety of tools and strategies to achieve this goal, but they all tend to follow the same basic structure. 

A typical IAM system has a database or a directory of users. That database contains details about who each user is and what they can do in a computer system. As users move through a system, the IAM uses the information in the database to verify their identities, monitor their activities and ensure that they only do what the database says they can do.  

For a more in-depth understanding of how IAM works, it helps to look at the four core components of IAM initiatives: identity lifecycle management, access control, authentication and authorization and identity governance. 

Identity lifecycle management is the process of creating and maintaining digital user identities for every human and nonhuman user in a system.

To monitor user activity and apply tailored permissions, organizations need to differentiate between individual users. IAM does this by assigning each user a digital identity. Digital identities are collections of distinguishing attributes that tell the system who or what each user is. Identities often include traits like a user's name, login credentials, ID number, job title and access rights. 

Digital identities are typically stored in a central database or directory, which acts as a source of truth. The IAM system uses the information in this database to validate users and determine what it will and won't allow them to do.  

In some IAM initiatives, IT or cybersecurity teams manually handle user onboarding, updating identities over time and offboarding or deprovisioning users who leave the system. Some IAM tools allow a self-service approach. Users supply their information and the system automatically creates their identity and sets the appropriate levels of access.  

Distinct digital identities not only help organizations track users but also enable companies to set and enforce more granular access policies. IAM allows companies to grant different system permissions to different identities rather than give every authorized user the same privileges.  

Today, many IAM systems use role-based access control (RBAC). In RBAC, each user's privileges are based on their job function and level of responsibility. RBAC helps streamline the process of setting user permissions and mitigates the risks of giving users higher privileges than they need.  

Say that a company is setting permissions for a network firewall. A sales rep likely wouldn't have access at all, as their job doesn't require it. A junior-level security analyst might be able to view firewall configurations but not change them. The chief information security officer (CISO) would have full administrative access. An API that integrates the company's SIEM with the firewall might be able to read the firewall's activity logs but see nothing else.  

For added security, IAM systems may also apply the principle of least privilege to user access permissions. Often associated with zero trust cybersecurity strategies, the principle of least privilege states that users should only have the lowest permissions necessary to complete a task, and privileges should be revoked as soon as the task is done.

In keeping with the principle of least privilege, many IAM systems have distinct methods and technologies for privileged access management (PAM). PAM is the cybersecurity discipline that oversees account security and access control for highly privileged user accounts, like system admins.  

Privileged accounts are treated more carefully than other IAM roles because theft of these credentials would allow hackers to do whatever they want. PAM tools isolate privileged identities from the rest, using credential vaults and just-in-time access protocols for extra security.

Information about each user's access rights is usually stored in the IAM system's central database as part of each user's digital identity. The IAM system uses this information to enforce each user's distinct privilege levels. 

Once a user is authenticated, the IAM system checks the privileges that are connected to their digital identity in the database. The IAM system authorizes the user to only access the resources and perform the tasks that their permissions allow. 

Identity governance is the process of tracking what users do with access rights. IAM systems monitor users to ensure that they don't abuse their privileges and to catch hackers who may have snuck into the network. 

Identity governance is important for regulatory compliance. Companies typically craft their access policies to align with security mandates like the General Data Protection Regulation (GDPR) or the Payment Card Industry Data Security Standard (PCI-DSS). By tracking user activity, IAM systems help companies ensure that their policies work as intended. IAM systems can also produce audit trails to help companies prove compliance or pinpoint violations as needed.  

Many key IAM workflows, like authenticating users and tracking their activity, are hard or outright impossible to do manually. Instead, organizations rely on technology tools to automate IAM processes.  

In the past, organizations would use point solutions to manage different parts of IAM—for example, one solution to handle user authentication, another to enforce access policies and a third to audit user activity.  

Today, IAM solutions are often comprehensive platforms that either do everything or integrate multiple tools into a unified whole. While there is plenty of variation in IAM platforms, they all tend to share common core features like:  

• Centralized directories or integrations with external directory services like Microsoft Active Directory and Google Workspace.
    
• Automated workflows for creating, updating and removing digital identities.
   
• The ability to create a network-wide, product-agnostic identity fabric that allows the organization to manage identity and access for all apps and assets—including legacy apps—through a single, authoritative directory.
  
  
• Built-in authentication options like MFA, SSO and adaptive authentication.
  
  
• Access control functions that allow companies to define granular access policies and apply them to users at all levels, including privileged accounts.
  
  
• Tracking capabilities to monitor users, flag suspicious activity and ensure compliance.
  
  
• Customer identity and access management (CIAM) capabilities that extend identity lifecycle management, authentication and authorization measures to digital portals for customers, partners and other users who are outside the organization.

Some IAM solutions are built for specific ecosystems. For example, Amazon Web Services (AWS) IAM and Google Cloud IAM platforms control access to resources hosted in those respective clouds.

Other IAM solutions—like the ones produced by Microsoft, IBM®, Oracle and others—are meant to work for all resources in a corporate network, regardless of where they're hosted. These IAM solutions can act as identity providers for all kinds of services, using open standards like SAML and OpenID Connect (OIDC) to exchange user authentication information between applications.  

Increasingly, identity and access management solutions have been moving off-premises and adopting a software-as-a-service (SaaS) model. Called "identity-as-a-service" (IDaaS) or "authentication-as-a-service" (AaaS), these cloud-based IAM solutions offer a few capabilities that on-premises tools may lack. 

IDaaS tools can be useful in complex corporate networks where distributed users log in from various devices (Windows, Mac, Linux and mobile) to access resources located on site and in private and public clouds. While on-premises IAM tools may not readily accommodate so many different users and resources across locations, IDaaS often can. 

IDaaS can also help organizations extend IAM services to contractors, customers and other nonemployee roles. This can help simplify IAM implementations, as the company doesn't need to use different systems for different users. 

IDaaS tools also allow companies to outsource some of the more time- and resource-intensive aspects of IAM like creating new user accounts and authenticating access requests and identity governance. 

IAM initiatives can help fulfill several use cases spanning cybersecurity, business operations and more.