Identity and security
IAM
Identity and Access Management
Identity and Access Management is the umbrella discipline covering how an organisation establishes who a person, device, or service is, what they are allowed to do, and how both of those things are kept accurate as roles, employment status, and business need change over time.
Why IAM matters in a Microsoft estate
IAM matters because identity, access, endpoint, and data controls shape how Microsoft environments are protected. Readers should understand the term and then be able to move into security assessment, conformity, or remediation guidance.
How IAM shows up in practice
In a Microsoft-centric estate this discipline is implemented primarily through Microsoft Entra ID, with Single Sign-On and Multifactor Authentication handling authentication, Role-Based Access Control and Conditional Access handling authorisation and contextual enforcement, and Privileged Identity Management plus Entra ID Governance handling the lifecycle and oversight layer that keeps access aligned with actual need rather than accumulating indefinitely. The lifecycle framing is central to IAM in practice and is usually described as joiner-mover-leaver: provisioning appropriate access when someone joins, adjusting it as they change role or team, and deprovisioning promptly and completely when someone leaves.
The 'mover' stage is the one most identity programmes handle worst, since access additions rarely get revisited when someone moves and are instead layered on top of what they already had. Deprovisioning matters just as much: a disabled account that still holds active group memberships, application permissions, or licence assignments represents both a lingering security exposure and, in a Microsoft 365 estate, ongoing licence spend for access nobody is using. Hybrid identity adds real complexity for organisations still running on-premises Active Directory alongside Entra ID.
It requires synchronisation through Entra Connect or cloud sync, careful handling of authentication method (password hash sync, pass-through authentication, or federation), and clear rules about which directory is authoritative for which attribute, since conflicting writes between the two are a recurring source of account lockouts and sync errors. IAM has become the practical replacement for the traditional network perimeter as a security boundary, summarised in the 'identity is the new perimeter' framing that underpins Zero Trust architecture. With remote work, cloud-hosted applications, and personal devices all bypassing the corporate network edge, the identity itself, not network location, is what most access decisions now have to be based on.
B2B and B2C extend the same underlying platform to external collaboration, guest access for partners and vendors, and customer-facing sign-in respectively, each with their own governance considerations around what external identities can see and for how long. Because IAM sits underneath licensing, every stale or duplicate identity, every guest account nobody remembers inviting, and every service account with a forgotten owner is simultaneously a security question and a cost question. This is why identity hygiene and access reviews tend to surface as much unnecessary licence spend as they do genuine security risk, when an estate is audited properly for the first time in years.