Lab · 01 / 16
One word, five disciplines.
IAM is not one product. It is a set of disciplines that answer different questions: who are you, what should you have, who holds the keys to the kingdom, and how do millions of customers sign in. Go through them one by one.
Scenario 1 of 7
The whole picture
In plain words Think of a company building: a reception desk, an office that decides who gets which badge, a safe for the master keys, and a public shop with its own entrance.
Four domains share a few common services. Most companies buy them from different vendors, so the real work is in the connections between them.
Scenario 2 of 7
Directory: the phone book
In plain words The list of everyone who works here, with their team. Everybody else reads from it.
A directory stores identities, attributes and groups: Active Directory, LDAP, or the directory inside a cloud IdP. HR is usually the source of truth that feeds it, through IGA.
Scenario 3 of 7
AM: Access Management
In plain words The reception desk: it checks your badge at the door and lets you into every room you are allowed in, without asking again.
AM answers "who are you, right now?". Authentication, MFA, single sign-on, federation (SAML, OIDC) and access policies such as conditional access. Typical tools: Microsoft Entra ID, Okta, Ping Identity.
Scenario 4 of 7
IGA: Identity Governance and Administration
In plain words The office that decides who gets which badge, and every few months checks that nobody kept a badge they no longer need.
IGA answers "should you have this?". Joiner-mover-leaver lifecycle, access requests and approvals, roles, segregation of duties and access reviews for auditors. Typical tools: SailPoint, Saviynt, Omada, One Identity.
Scenario 5 of 7
PAM: Privileged Access Management
In plain words The safe with the master keys: you sign out a key for one job, someone watches, and the lock is changed when you give it back.
PAM protects admin and service accounts, the ones attackers want most. Credential vault, just-in-time elevation, session recording and password rotation. Typical tools: CyberArk, BeyondTrust, Delinea.
Scenario 6 of 7
CIAM: Customer IAM
In plain words The shop entrance: anyone can walk in and sign up, and it has to be quick, or people leave.
CIAM handles self-registration, social login, passkeys, consent and profiles for millions of users. Here friction costs revenue and privacy law is central. Typical tools: Auth0, Microsoft Entra External ID, Ping, SAP Customer Data Cloud.
Scenario 7 of 7
Why they must talk to each other
In plain words If the badge office and the reception never talk, people who left keep getting in.
IGA decides, AM enforces at sign-in, PAM narrows the most dangerous access, and every event lands in the SIEM. Identity has become the perimeter: most breaches start with a stolen or misused identity.