Simple explanation
IAM is the full lifecycle of controlling who (or what) can access what, from the moment an account is created to the moment it's removed — plus the mechanisms (passwords, MFA, SSO) used to actually verify identity along the way.
Technical explanation
Lifecycle: provisioning (creating an account/access) and de-provisioning (removing it — a commonly missed step that leaves former employees or contractors with lingering access).
Permission assignments and implications — every grant of access is also a grant of potential misuse; permissions should map tightly to actual job function.
Identity proofing — verifying someone actually is who they claim to be before an account is created for them.
Federation — allowing identity from one system to be trusted by another, without creating a separate account in each (a user logs into their organization's identity provider once, and that trust extends to partner systems).
Single Sign-On (SSO) and its underlying protocols: LDAP (Lightweight Directory Access Protocol — a protocol for querying/managing directory information, like an internal user directory), OAuth (an authorization framework — grants a third-party app limited access without sharing the actual password), SAML (Security Assertion Markup Language — an XML-based standard for exchanging authentication/authorization data between an identity provider and a service, common in enterprise SSO).
Interoperability — different systems being able to work together using these shared standards.
Attestation — periodically confirming that granted access is still appropriate (a manager re-certifying their team's permissions).
Access control models: mandatory (MAC) (access determined by fixed system-enforced labels, not owner discretion — common in military/government), discretionary (DAC) (the resource owner decides who gets access), role-based (RBAC) (access tied to job role), rule-based (access determined by defined if/then rules), attribute-based (ABAC) (access determined by a combination of attributes — user, resource, environment), time-of-day restrictions, and least privilege (the overarching principle behind all of them).
MFA implementations and factors: something you know (password), something you have (token, phone), something you are (biometric), somewhere you are (location-based), something you do (behavioral). True MFA requires factors from different categories, not just two passwords.
Password concepts: best practices around length, complexity, reuse prevention, expiration, and age; password managers; and passwordless authentication (e.g., biometrics or hardware keys replacing passwords entirely).
Privileged Access Management (PAM): just-in-time permissions (elevated access granted only for the duration needed, then automatically revoked), password vaulting (privileged credentials stored and rotated centrally, not memorized/shared), ephemeral credentials (short-lived, auto-expiring access rather than standing permanent privilege).
Synonyms / related terms
| Term | Means | |---|---| | RBAC | Role-Based Access Control | | ABAC | Attribute-Based Access Control | | PAM | Privileged Access Management |
Concept Check
"A user authenticates with a password and a security question about their mother's maiden name. Is this true multi-factor authentication?" No — both are "something you know." True MFA requires factors from different categories (e.g., password + a physical token), not simply two pieces of knowledge.
Interview-style Q&A
Q: Why is de-provisioning as important as provisioning, even though it gets less attention? A: "Provisioning failures are usually noticed quickly — someone can't do their job. De-provisioning failures are silent — a former employee's account just... still works, and nobody notices until it's misused or an audit catches it. It's a classic gap between two different teams' handoff (HR offboarding vs. IT access removal), which is exactly why it needs to be a formal, checked step, not an assumption."
Memory trick
"MAC is Mandatory, DAC is Discretion, RBAC is Role" — say each model's name alongside the word it's built from, and the definitions stop needing separate memorization.