Identity and access management (IAM)

The policies and technologies used to manage digital identities and control which users can access which systems and data, from hiring through to departure.

Identity and access management brings together several pieces: creating accounts when people join, verifying who they are when they sign in, granting the right level of access for their role, adjusting it when they change jobs and removing it when they leave. Tools in this area include directory services such as Microsoft Entra ID, single sign-on, multi-factor authentication and access reviews.

As businesses adopt more cloud applications, managing identities becomes harder. An employee might have separate logins for email, accounting, file sharing, a CRM and industry-specific software. When someone leaves and one of those accounts is forgotten, it can stay active for months. Identity is now often described as the new security perimeter, because attackers increasingly target logins rather than networks.

Practical tip: use single sign-on where possible so most applications are tied to one central account. When an employee leaves, disabling that one account then cuts off access to many systems at once. Keep a simple onboarding and offboarding checklist for anything that cannot be connected.