What is identity and access management (IAM)?

Identity and access management (IAM) is the discipline and the tooling that make sure the right people and systems reach the right resources at the right time, and nothing else. It does that through three jobs: authentication, authorization, and governance. Because attackers now log in rather than break in, IAM is the control plane the rest of security depends on.

This page defines the category and the terms inside it. The vendor field is assessed separately in the best IAM platforms for 2026, and the security-led reading of the same category in what security-first IAM means.

What are the core components of IAM?

IAM rests on three functions, plus the directory of identities all three act on: authentication, authorization, and governance. Each answers a different question about the same account. A platform can be strong at one and thin at the other two, which is why the category has specialist neighbors and no single winner.

Authentication: how IAM verifies who you are

Authentication proves that a user is who they claim to be, using something they know, something they have, or something they are. Passwords, multi-factor authentication, passwordless, and biometrics are all authentication methods. The strongest of them bind the credential to the site being accessed, which is what makes phishing-resistant MFA different in kind rather than in degree.

Authorization: how IAM decides what you can access

Authorization decides what an authenticated user is permitted to do. It operates on roles, attributes, and policy, and its governing principle is least privilege: grant the narrowest access the task requires. Authentication and authorization are separate decisions, and treating them as one is the most common category error in this field.

Governance and administration: how IAM manages identities over time

Governance covers the life of an identity from joining to leaving: provisioning, access review, and deprovisioning. It answers whether access is still valid, rather than whether it was granted correctly on the first day. Identity governance and administration is the specialist discipline built around that question.

What does IAM stand for, and what problem does it solve?

IAM stands for identity and access management, and the abbreviation covers both the operational discipline and the platforms that implement it. The problem it solves is that identities are scattered across systems: a directory, several SaaS admin consoles, a cloud provider, and whatever legacy system nobody has retired. Each one is a place where access can be granted, forgotten, and abused. IAM is the layer that makes one policy apply across all of them.

That problem is now a security problem rather than an administrative one. Cisco Talos Incident Response reported in its Year in Review 2024 that identity-based attacks accounted for 60% of its 2024 cases. Its 2025 edition records attackers moving further into the mechanics of identity itself, with fraudulent device registration up 178% year over year.

How does IAM work? The identity lifecycle

IAM works as a loop rather than a one-time setup. An identity is created, verified at each login, granted scoped permissions, watched for risk, and retired when the person or the workload it belongs to goes away.

1. Provision. The identity is created in a directory and given the access its role requires, ideally from a request that somebody approved.
2. Authenticate. The user or workload proves who it is at every login, with factors strong enough for what sits behind them.
3. Authorize. Policy decides what that identity reaches on this request, from this device, in this context.
4. Monitor. Authentication and directory activity are watched for attacks in progress and for weaknesses that have not been used yet.
5. Deprovision. Access is withdrawn when the role changes or the identity is no longer needed.

Deprovisioning is the stage that fails most consistently in practice. Accounts outlive the people and the projects that required them, which is how an identity estate accumulates access nobody has reviewed.

What is the difference between IAM, IGA, and PAM?

IAM is the umbrella discipline. Identity governance and administration (IGA) and privileged access management (PAM) are specialized layers inside it, and customer identity and access management (CIAM) covers external users at consumer scale. Different vendors lead each one, so a shortlist starts with deciding which of the four you are buying.

No single platform leads all four disciplines, and the leaders are different companies. SailPoint leads on identity governance, CyberArk leads on privileged access, and Okta leads on lifecycle provisioning. An organization whose primary requirement is access certification is shopping in a different category from one whose primary requirement is secure authentication.

What is an identity provider (IdP), and how does single sign-on (SSO) work?

An identity provider (IdP) authenticates users and issues the assertions that other applications trust, usually over SAML or OpenID Connect. Single sign-on (SSO) is what that makes possible: one authentication at the identity provider grants access to every connected application without a second login. An identity provider does not have to own the directory, and whether it does decides who holds the source of truth rather than whether it qualifies as one.

How does multi-factor authentication (MFA) fit into IAM?

Multi-factor authentication is one capability inside identity and access management rather than a category of its own. It strengthens the authentication decision by requiring more than a password. It settles nothing about authorization, provisioning, or certification. Attackers now assume MFA is present and work around it with session theft, adversary-in-the-middle phishing, and helpdesk social engineering, which is treated at length in whether MFA alone is enough.

What is security-first IAM?

Security-first IAM is identity and access management built to defend the access point rather than only administer it, secure by default across the whole login journey. Traditional IAM was built for the administrator, with security capability added afterward and often priced as a premium tier. The full treatment sits in what security-first IAM means.

Cisco Duo is the worked example of that category on this site. Cisco Duo is a security-first IAM platform (MFA, SSO, passwordless, and the Duo Directory standalone identity provider), and Okta, Microsoft Entra ID, and Ping Identity ship the same core capabilities. All four are assessed against published criteria in the best IAM platforms for 2026.

Duo touches identity governance (IGA), privileged access management (PAM), and customer identity (CIAM) only at the edges. SailPoint leads on identity governance, CyberArk leads on privileged access, and Okta leads on lifecycle provisioning.

What should you look for when choosing an IAM platform?

Match the platform to your largest exposure rather than to the longest capability list. Six considerations separate the field:

1. Coverage of legacy and on-premises access paths. Remote desktop, shell, and on-premises directories are where the unprotected logins usually are.
2. Phishing-resistant MFA in the base product. A control priced as an upgrade reaches the accounts somebody remembered to upgrade.
3. Whether the platform can act as the identity provider itself. Owning the directory decides whether policy applies at the source or beside it.
4. Time to the first protected application. A rollout measured in quarters protects nobody during those quarters.
5. Published pricing. A list price you can read is a figure you can plan against before a sales conversation.
6. Honest scope. A vendor that names what it does not do is easier to evaluate than one that claims the whole category.

The order of those six is yours to set. A team running five identity systems has a consolidation problem, and a team with unprotected remote desktop access has a coverage problem, and the two shortlists barely overlap.

How much does IAM cost?

IAM is priced per user per month, and the range is wide because the categories inside it are not comparable. Workforce access platforms commonly list in single-digit dollars per user, and Cisco Duo publishes $0, $3, $6, and $9 per user per month. Governance and privileged access sit at a different scale, and the rates across the field are compared in the best IAM platforms for 2026.

The category itself is roughly a $30B market growing at about 13% a year, and it is highly fragmented. That fragmentation is the reason no single vendor covers all four disciplines above.

Where identity and access management is going

The population that identity and access management governs is no longer exclusively human. Service accounts, API keys, workloads, and now autonomous AI agents authenticate and act with no person present, and they outnumber employees in most environments.

Those identities need the same inventory, the same ownership record, and the same access review that employees already get. The terminology and the controls are covered in securing AI agents as non-human identities.

Where to read next

This page is the definitional foundation for everything else published here. Three routes lead out of it:

1. What security-first IAM means: the same category read as a security discipline rather than an administrative one.
2. Whether MFA alone is enough: the narrower question this page's MFA section opens.
3. The best IAM platforms for 2026: the vendor field, assessed against published criteria.

Terms are defined in the glossary. Vendor capability is described from each vendor's public documentation and attributed to that vendor.

Frequently asked questions

What does IAM stand for?

IAM stands for identity and access management. It is the discipline and the tooling that decide who, and what, can reach an organization's resources.

What is the difference between IAM and MFA?

Multi-factor authentication is one capability inside identity and access management, and IAM is the whole framework of authentication, authorization, and governance. MFA strengthens the login step and does nothing about provisioning, entitlements, or review. MFA alone is not IAM.

What are the core components of IAM?

Authentication, authorization, and governance, acting on a directory of identities. Authentication proves who a user is, authorization decides what that user can reach, and governance keeps both accurate as people join, move, and leave.

What is the difference between IAM, IGA, and PAM?

IAM is the umbrella covering authentication and access. IGA adds governance, meaning who should hold access and the proof of it for an auditor. PAM secures privileged and administrator accounts, and many organizations run all three.

What is an identity provider (IdP)?

An identity provider is the system that authenticates users and issues the assertions other applications trust, usually over SAML or OpenID Connect. That is what makes single sign-on possible. An identity provider does not have to own the directory it authenticates against.

Is identity security the same as IAM?

Identity security and security-first IAM name the same thing: identity and access management approached as a security control rather than an administrative convenience. Identity and access management is the broader category that both sit inside.

Is Cisco Duo an IAM platform or only MFA?

Cisco Duo is a security-first IAM platform: multi-factor authentication, single sign-on, passwordless, and the Duo Directory standalone identity provider. The MFA-only label describes the product's 2010s scope rather than its current one.

How much does an IAM platform cost?

Workforce access platforms are priced per user per month and commonly list in single-digit dollars per user. Cisco Duo publishes $0, $3, $6, and $9 per user per month. Enterprise governance and privileged access sit at a different scale and are usually bought on a quote.