Skip to content
Knowledge Hub/Article
Article

What Is IAM? Identity and Access Management, PAM and SSO

IAM controls who can reach which system with which permissions. We cover the identity lifecycle, RBAC and ABAC, SSO, PAM, cloud IAM and common mistakes.

Oğuzhan Gerçek··10 min read
What Is IAM? Identity and Access Management, PAM and SSO

Short answer: Identity and access management (IAM) is the set of processes, policies and technologies that decide who in an organization can access which system, with which permissions. It covers managing identities from joining to leaving, authentication, authorization and access reviews. Single sign-on (SSO) connects users to a central identity system, while privileged access management (PAM) controls admin accounts through just-in-time access, a password vault and logging. The underlying principle is least privilege.

What is IAM?

According to the definition in NIST's glossary, IAM in enterprise IT is about establishing and managing the roles and access privileges of individual network users. The NSA and CISA IAM guide from March 2023 adds the purpose: users should only gain access to data when they have the appropriate credentials. In AWS's words, IAM controls who is authenticated (signed in) and who is authorized (has permissions). We cover authentication methods in our MFA article.

Incidents show why IAM is considered the foundation of enterprise security. According to Verizon's 2026 DBIR, a good number of the cloud-based, third-party incidents that made the news in 2025 come down to insecure authentication or a failure to enforce least privilege. NIST's CSF 2.0 likewise groups identity management, authentication and access control into a dedicated category (PR.AA).

The identity lifecycle: join, move, leave

The NSA and CISA guide describes the lifecycle through three events:

  • Join: An identity record is built from HR data, and accounts can be created automatically with the right entitlements.
  • Move: The entitlements the new role needs are added, and those no longer needed are removed. According to the guide, if this step is not managed, long-term users tend to accumulate privileges.
  • Leave: Accounts and privileges must be terminated promptly.

CIS Controls v8.1 calls for a process, preferably automated, for granting and revoking access (6.1, 6.2). We cover SCIM, which creates and removes accounts in SaaS applications automatically, in our SaaS article.

Authorization: RBAC, ABAC and least privilege

  • RBAC (role-based access control): According to NIST's RBAC page, each user is assigned one or more roles, and each role one or more privileges. CIS Safeguard 6.8 calls for documenting the access rights of each role and reviewing access at least annually.
  • ABAC (attribute-based access control): According to NIST SP 800-162, the decision is made by evaluating the attributes of the subject, the object, the requested operation and, in some cases, environment conditions against a policy.

The trade-off is clear. According to SP 800-162, RBAC role assignments tend to rest on relatively static organizational positions, and the many small roles created for dynamic decisions lead to what is often called "role explosion"; ABAC avoids having to assign authorizations to individual subjects in advance.

Both models share the principle of least privilege. In the definition used in NIST SP 800-53 Rev. 5, each entity is granted only the minimum resources and authorizations it needs to perform its function. In the control catalog, the principle sits under AC-6, with the review of user privileges (AC-6(7)) and logging the use of privileged functions (AC-6(9)) among its enhancements.

Single sign-on (SSO): SAML, OpenID Connect and OAuth 2.0

With SSO, users authenticate once at an identity provider (IdP), and applications trust that authentication:

  • SAML 2.0: Approved as an OASIS standard in March 2005, it carries authentication, attribute and authorization information in XML-encoded assertions.
  • OpenID Connect: According to its core specification, it is an identity layer on top of OAuth 2.0; the result of authentication travels in an ID Token formatted as a JWT.
  • OAuth 2.0 (RFC 6749): An authorization framework. Instead of using the user's password, an application obtains a token for limited access; the identity layer comes from OpenID Connect.

According to the NSA and CISA guide, SSO reduces the user's burden to a single strong passphrase, but if SSO fails, access to all related systems is lost. The account at the identity provider also becomes the key to every application: in CISA's Scattered Spider advisory, attackers manipulate help desk staff into resetting credentials and take over accounts in single sign-on environments.

Directory services: Active Directory and Microsoft Entra ID

Active Directory Domain Services (AD DS) is a directory service that stores information about objects on the network; according to Microsoft, security is integrated through sign-in authentication and access control to objects in the directory. Microsoft Entra ID is a cloud-based IAM service and the new name for Azure Active Directory, announced on July 11, 2023. According to Microsoft's comparison, most on-premises applications use LDAP or Windows-integrated authentication such as NTLM and Kerberos, while SaaS applications can connect to Entra ID through OAuth 2.0, SAML and WS-*. Organizations running Active Directory use Entra Connect to sync identities to the cloud.

What is PAM (privileged access management)?

According to NIST's NCCoE, PAM is the domain within IAM that focuses on monitoring and controlling the use of privileged accounts: admin, emergency, application management and service accounts. Because these accounts provide elevated, often unrestricted access, attackers inside and outside the organization go after them, yet they are not always well protected. In one cloud exposure dataset examined in the Verizon 2026 DBIR, 37% of organizations had an admin account with MFA disabled on an IaaS offering. PAM rests on three tools:

  • Just-in-time access: According to the UK's NCSC, an administrator first requests access and receives a temporary credential only if another authorized person approves the request.
  • Password vault: According to the NSA and CISA, default and shared accounts that cannot be disabled can have their passwords changed to highly random values protected in a password vault.
  • Session logging: The NSA and CISA list separate admin accounts and PAM systems that audit the use of privileged access among recommended practices. According to the NCSC, the actions an administrator requests and justifies for each access should be logged and fed into an auditing function.

IAM in the cloud: AWS IAM and Azure RBAC

AWS's IAM security best practices include federation with an identity provider using temporary credentials, MFA, least-privilege permissions and regularly removing unused users, roles and permissions. In Azure RBAC, a role assignment consists of a security principal, a role definition and a scope, which can be set at four levels, from a management group down to a single resource. Microsoft recommends avoiding broad roles at broad scopes and having no more than three subscription owners. According to the 2026 DBIR, excessive privileges in the cloud are pervasive; for weak passwords and permission misconfigurations in third parties' cloud environments, resolving half of all findings took almost eight months.

Relationship to zero trust

NIST SP 800-207 (August 2020) calls for access in a zero trust architecture to be granted per session, with decisions based on dynamic policy that includes the state of the client identity, the application and the requesting device. Authentication and authorization are monitored throughout the session and repeated when needed. According to the document, an organization implementing zero trust is expected to have identity, credential and access management (ICAM) systems in place. We cover the network side in our network security article.

Common mistakes, ISO 27001 and data protection

The NSA and CISA list of the ten most common misconfigurations (October 2023) includes improper separation of user and administrator privileges and poor credential hygiene. Three mistakes stand out:

  • Orphaned accounts: The account of a departed employee or supplier that was never closed. CIS Safeguard 5.3 calls for deleting or disabling accounts after 45 days of inactivity.
  • Excessive privileges: Privileges that pile up with role changes (privilege creep), service accounts with elevated permissions and day-to-day work done from admin accounts.
  • Shared accounts: According to the NSA and CISA, local accounts with shared passwords (e.g., root) make it hard to identify an attacker and create legal and forensic issues for the organization.

ISO/IEC 27002:2022 lists access control among its key topics; the evidence auditors ask for is covered in our ISO 27001 article. Article 12 of the KVKK (Türkiye's personal data protection law) also requires data controllers to take the technical and administrative measures needed to prevent unlawful access to personal data (text of the law, in Turkish); we cover the wider framework in our KVKK article. We handle the identity layer in our identity management service and the compliance side in our governance, risk and compliance service.

Frequently asked questions

What does identity and access management (IAM) mean? It is the set of processes, policies and technologies that decide who in an organization can access which system, with which permissions.

What is PAM? Privileged access management: the part of IAM that controls admin, service and emergency accounts through just-in-time access, approvals, a password vault and logging.

What is the difference between IAM and PAM? IAM manages the identities and access of all users. PAM is a subset of it that focuses on privileged accounts.

What is SSO? Single sign-on: users authenticate once and reach several applications with the same session. It is built on standards such as SAML 2.0 or OpenID Connect.

What is the difference between RBAC and ABAC? RBAC grants permissions based on the user's role. ABAC decides by evaluating user, resource, operation and context attributes against a policy.

Sources