Identity and access management (IAM)
IAM · identity management · access management · identity governance · IGA · gestion des identités et des accès
The processes and tools that ensure every person or machine has the right access, to the right resources, at the right time, and loses it as soon as it is no longer justified.
In practice
IAM covers the whole life of an account: joiners, movers and leavers. It relies on an authoritative directory (Active Directory, Entra ID, LDAP), on authentication (MFA, SSO) and on regular access reviews. Non-human identities (service accounts, API keys, bots) often outnumber employees and deserve the same rigour. A leaver who is not properly offboarded leaves behind an active account that nobody watches: an ideal way in for an attacker.
Fictional case: at a 300-employee distributor, an access review uncovers 42 accounts belonging to former staff that are still active, two of them with access to payroll. Since the directory was connected to the HR system, every account is disabled on the employee’s last day.
How to protect yourself
- Connect the directory to the HR system so accounts are created, changed and disabled automatically.
- Grant rights by job role rather than case by case.
- Review access at least once a year, and every quarter for sensitive access.
- Inventory service accounts and API keys, each with a named owner.
