What is digital identity?

In most systems, an entity’s digital identity is made of their unique attributes. Together, these attributes form a record that verifies the entity’s identity and distinguishes them from other entities.

For example, a human user’s identity in a corporate network might include identity information such as their social media handles, Social Security number and network username.

Verifiable digital identities are the foundation of authentication and authorization, the processes that IT systems use to verify users and grant them appropriate access. Both human and nonhuman users need digital identities to interact with digital services and one another.

Trusted digital identities allow people, machines, apps and service providers to be sure that the entities they interact with are who they say they are. Digital identities also allow systems to monitor activity and determine which entities are taking which actions.

Because of their importance to the digital world, digital identities are a major concern for organizations today. A study for the Identity Defined Security Alliance found that more than half of organizations (51%) see managing and securing digital identifications as one of their top three priorities.¹

There are multiple types of digital identities—not only for people, but also for devices, services and other digital entities.

Human digital identities are the digital identities that correspond to human users in a system.

A human digital identity might include information such as age, driver’s license, Social Security number or biometric data such as fingerprints and facial recognition scans. Humans use their digital IDs to access digital resources, such as logging in to a bank account online or retrieving sensitive assets on a corporate network.

Machine identities correspond to nonhuman entities such as apps, bots, Internet of Things (IoT) nodes and other devices. They often use unique identifiers such as certificates or tokens to authenticate and distinguish themselves.

Just like a human user’s digital ID, a machine’s digital ID allows it to access certain digital resources, such as a business app fetching sensitive data from a cloud database.

Federated identities enable individuals to use their digital identities across multiple systems and services.

Federated identities are essentially a type of user or machine identity that is not limited to one system. They give the user the added convenience of not needing to create a different identity for each system. Interoperability—a standards-based approach to enabling different IT systems to exchange data—helps enable identity federation.

Digital identities play a key role in the identity and access management (IAM) systems that enterprise organizations use to enforce cybersecurity measures and control user access to digital resources.

When a new user needs access to a system—a new employee on a company network or a new server in a data center—the user must establish a distinct digital identity in that system. The IAM system then uses these distinct digital IDs to monitor user activity and apply tailored permissions.

When a user requests access to a digital asset, they must authenticate themselves with the IAM system. Authentication entails submitting some credentials—such as a username and password, date of birth or digital certificate—to prove the user is who they claim to be. For extra security, some IAM systems might use multifactor authentication (MFA), which requires users to provide more than one authentication factor to prove their identities.

When the user passes authentication, the IAM system checks the permissions associated with their unique digital identity and grants only those approved permissions. In this way, IAM systems keep out hackers while helping ensure that each individual user has the exact permissions they need for their tasks.

In a single sign-on (SSO) system, a user can use one digital identity to access multiple apps and online services. The SSO portal authenticates the user and generates a certificate or token that acts as a security key for various interconnected resources. 

There is a vast array of use cases for digital identities across industries, with many supporting how users and applications interact with cloud resources.  

Governments often use digital credentials to streamline and secure the delivery of government services. Secure digital identities enable citizens to verify themselves so they can collect benefits and file taxes, and governments can trust that these citizens are who they say they are.  

Digital identities enable patients to securely share health data with their providers, making it faster and easier to get multiple opinions before determining a medical treatment plan.

Providers can use digital identity solutions to verify insurance coverage, monitor health devices and help comply with rules such as the Health Insurance Portability and Accountability Act (HIPAA).

Digital identities enable sellers to deliver better customer experiences tailored to individual users based on their personal data.

For example, digital identity systems enable customers to store payment data for later purchases, while retailers can use the order history associated with unique identifiers to generate personalized recommendations.