Identity & Access Management: Who is allowed to access what and when?

Identity & Access Management—IAM for short—answers a question that quickly becomes complex in growing companies: Who is authorized to use which systems, data, and resources, and under what conditions? A clear answer to this question is not merely an academic exercise; it is crucial from both an operational and regulatory standpoint. Unstructured access rights are one of the most common causes of data breaches—and, at the same time, one of the easiest to address. Identity & Access Management provides the structural framework for systematically granting, monitoring, and revoking permissions.

What is Identity and Access Management?

Identity & Access Management refers to the totality of processes, technologies, and policies that an organization uses to manage digital identities and control access to its resources. It includes:

• Identity Management: Creation, maintenance, and deactivation of user accounts throughout the entire employment lifecycle
• Access Management: Controlling which identity is allowed to access which resource under what conditions
• Authentication: Verification of identity before access (password, MFA, certificate)
• Authorization: Verifying whether the verified identity has the required permissions
• Auditing: Logging and Reviewing Access Activities

A comprehensive IAM system integrates these elements into a cohesive lifecycle—from the creation of a new account upon joining the organization to its complete deactivation upon leaving.

IAM Roles: The Foundation of Orderly Access Management

The central design principle of modern IAM systems is the role-based access model—Role-Based Access Control (RBAC). Instead of assigning permissions to each user individually, rights are tied to roles, which are in turn assigned to individuals.

Advantages of the role-based model

• Scalability: New employees automatically receive the appropriate access rights when they are assigned the correct role
• Consistency: Similar activities are treated similarly—no individual special rules that complicate reviews
• Audit-proof: Permissions can be fully documented and audited for each role
• Efficiency in Making Changes: If a role's scope of responsibilities changes, all associated users are automatically updated

The Principle of Least Privilege

A well-designed IAM role-and-permissions model is based on the principle of least privilege: Each identity is granted exactly the permissions it needs to perform its tasks—and no more. In practice, this means:

• No default assignment of administrative rights
• Time-Limited Privileges for One-Time or Rare Tasks (Privileged Access Management, PAM)
• Regular Review of Existing Permissions (Access Reviews)

Identity Management Companies: Typical Challenges

Uncontrolled Expansion of Access Rights

In many companies, the number of access permissions grows organically: Employees move between departments, are granted new access rights, but retain their old ones. Over time, this creates a tangled web of access rights that is neither documented nor verifiable. This provides attackers with a wide range of potential targets.

Lack of Offboarding Processes

When an employee leaves the company, all access privileges must be revoked immediately. In the absence of automated processes, accounts often remain active. This is a security vulnerability that is frequently underestimated. For example, former employees often retain active access privileges for months after they leave the company.

Shadow IT and External Identities

In addition to internal employees, external service providers, partners, and systems (machine identities, service accounts) frequently access corporate resources. An IAM system that tracks only internal users therefore fails to cover a growing portion of actual accesses.

Heterogeneous System Environment

Established IT infrastructures consist of cloud services, on-premises systems, and line-of-business applications that use different authentication mechanisms. IAM must enable consistent control across this heterogeneous environment.

IT Access Management: Building Blocks of a Modern IAM Architecture

Identity Provider (IdP)

An identity provider is the central directory where identities are managed. Commonly used systems include Microsoft Entra ID (formerly Azure AD), Okta, and JumpCloud. The IdP is the single source of truth for all identities in the organization.

Single Sign-On (SSO)

SSO allows users to authenticate once and access all connected services without having to log in again. This improves the user experience, enhances security (fewer passwords in circulation), and simplifies centralized access control.

Privileged Access Management (PAM)

Administrative and privileged accounts are particularly critical. PAM systems enable:

• Management and Rotation of Privileged Access Credentials
• Session Recording for Administrative Tasks
• Just-in-Time Access: Privileged rights are granted only for the period during which they are actually needed

Directory Services and Provisioning

Automatic provisioning ensures that user accounts and permissions are automatically created, updated, and deactivated. This is triggered by HR processes (hiring, role changes, termination). This eliminates manual errors and significantly speeds up onboarding processes.

Zero Trust as an Overarching Principle

Modern IAM operates within the context of a zero-trust framework: No user or device is automatically considered trustworthy, even if it is on the internal network. Every access request is evaluated based on context, taking into account identity, device status, location, and behavioral norms.

IAM Implementation: A Step-by-Step Approach

Phase 1: Analysis and Assessment

• Inventory of all systems, services, and applications
• Inventory of existing user accounts, including inactive and privileged accounts
• Documentation of Existing Authorization Structures
• Identification of Gaps and Risk Areas

Phase 2: Develop a role model

• Defining Roles Based on Actual Job Descriptions
• Assigning Permissions to Roles Based on the Least-Privilege Principle
• Coordination with line departments and Compliance

Phase 3: Select and Implement Technology

• Selecting an Identity Provider That Fits the System Environment
• Integration of SSO and MFA
• Automation of Provisioning and Deprovisioning Processes

Phase 4: Establish Governance

• Implementation of regular access reviews (at least every six months)
• Defining Responsibilities for Roles and Permissions
• Establishment of an audit trail for all access changes

IAM and Regulatory Requirements

Identity and Access Management is a key element of numerous regulatory requirements:

• NIS2: Requires structured access controls and evidence of privileged account management
• ISO 27001: Requires formal processes for user access management (Chapters A.8 and A.9)
• GDPR: Requires the ability to document and restrict access to personal data in a traceable manner
• SOC 2: Requires controls over the granting and revocation of access, as well as regular reviews

For companies that need to inform customers or partners about their compliance measures, a documented IAM system also serves as concrete evidence of their commitment to IT security.

Frequently Asked Questions

What is the difference between IAM and PAM?

IAM refers to the comprehensive management of all digital identities and their access rights within an organization. PAM (Privileged Access Management) is a subset of IAM that focuses specifically on administrative and privileged accounts with a higher risk potential. PAM is thus a specialized component within the IAM framework.

How long does an IAM implementation take?

That depends on the complexity of the system landscape and the initial state. An initial, prioritized implementation—including an identity provider, SSO, and MFA—can typically be completed in three to six months in medium-sized companies. The full integration of all systems and the establishment of governance processes is a longer-term project lasting twelve to eighteen months.

How are external service providers taken into account in IAM?

External identities—partners, suppliers, consultants—should be included in a separate directory (External Identity Management) that defines clear validity periods, minimal permissions, and dedicated audit cycles. Many identity providers support B2B federations, which allow external identities to be integrated in a controlled manner without overburdening internal directories.

Developing an IAM Strategy – Axsos works with you to develop a robust roles and permissions framework for your IT.

This content was generated using AI, but was reviewed and edited by our editorial team before publication.