Lab · 04 / 16
Employees and customers.
Both sign people in with OIDC, MFA and passkeys. But a company knows its employees and can impose rules; customers arrive on their own, can leave in one click, and are protected by privacy law.
In plain words Workforce IAM is the staff entrance: everyone has a badge from HR. CIAM is the shop door: strangers walk in, and a slow door means lost sales.
| Workforce IAMemployees and partners | CIAMcustomers | |
|---|---|---|
| Users | Thousands, known in advance | Millions, unknown until they sign up |
| Where identities come from | HR system, through IGA | Self-registration and social login |
| Main goal | Security and productivity | Conversion, trust and privacy |
| MFA | Mandatory, set by policy | Risk-based, passkeys to reduce friction |
| Governance | Roles, approvals, access reviews | Consent, preferences, account deletion |
| Main threats | Phishing, stolen sessions, insiders | Credential stuffing, fake accounts, account takeover |
| Regulation | Audits, SOX, NIS2, ISO 27001 | GDPR, consumer protection, PSD2 for payments |
| Look and feel | Standard company login page | Fully branded, inside the product |
When to use Workforce IAM
Think workforce when you control who the users are and can require devices, MFA and training.
When to use CIAM
Think CIAM when anyone can sign up: design for scale, peaks, privacy and the drop-off at every extra step.
The most common mistake
Reusing the employee IdP and its policies for customers. Licences are priced per employee, the login page cannot be fully branded, and mandatory MFA on day one makes many new customers give up.