Guides
IAM building blocks
Identity and access management breaks down into five jobs. Each has its own standards, failure modes and tools, and they only work well together.
Think of IAM as a pipeline. Provisioning creates the identity and its access. Authentication proves the person or service behind it. Federation carries that proof to applications run by others. Authorization decides each request. Audit records what happened so you can review it and prove it later.
| Building block | Main question | Key standards |
|---|---|---|
| Authentication | Who is this, really? | FIDO2/WebAuthn, NIST SP 800-63B, OpenID Connect |
| Authorization | May they do this? | OAuth 2.0 scopes, XACML, RBAC/ABAC models |
| Federation | Can another domain trust this sign-in? | SAML 2.0, OpenID Connect, WS-Federation |
| Provisioning | Does the account exist, with the right access? | SCIM 2.0 (RFC 7643/7644) |
| Audit | What happened, and was it allowed? | Log formats, Shared Signals, compliance frameworks |
- IAM building block
Authentication: proving who someone is
How authentication works in 2026: knowledge, possession and inherence factors, phishing-resistant MFA, passkeys, NIST assurance levels and service authentication.
- IAM building block
Authorization: deciding what is allowed
How authorization works: role-based and attribute-based access control, XACML's PDP and PEP, policy-as-code engines, OAuth scopes, and where checks belong.
- IAM building block
Audit: knowing who did what
What identity audit covers: sign-in and admin logs, access reviews and certification, separation of duties, retention, and the evidence auditors ask for.
- IAM building block
What is identity federation?
How identity federation works: identity providers and relying parties, SAML 2.0 and OpenID Connect trust, metadata, certificates and common pitfalls.
- IAM building block
Provisioning and SCIM
How user provisioning works: joiner, mover and leaver processes, SCIM 2.0 requests, connectors, just-in-time provisioning and reliable deprovisioning.
Questions
Which IAM building block should I fix first?
Usually authentication and provisioning. Strong, phishing-resistant sign-in and reliable removal of leavers' access address the most common causes of identity-related incidents.
Is IAM the same as identity governance?
Identity governance and administration (IGA) is part of IAM: it covers provisioning, access requests, reviews and certification. IAM also includes runtime access management such as SSO, MFA and authorization.