IAM BASICS
IAM basics: short lessons on building an identity stack
Short answer
Eleven lessons in three tracks: the five jobs an IAM stack does, how to build the stack in a sensible order, and the standards that connect the tools. Each lesson takes a few minutes and lists the sources it uses. Start with what an IAM stack is if you are new to identity work.
The five jobs
What each job in an IAM stack does, which vendors document it, and where it stops.
L01
What is an IAM stack? The five jobs identity tools do
Why identity and access management is a set of jobs, not one product, and how the jobs connect.
3 min read
L02
Directory, single sign-on and MFA: the identity provider job explained
What an identity provider does, which protocols it speaks, and what phishing-resistant MFA means.
3 min read
L03
Identity governance explained: what IGA adds to an identity provider
Requests, approvals, reviews and lifecycle: the work governance does that sign-in does not.
2 min read
L04
Privileged access basics: standing access, just-in-time grants and secrets
What counts as privileged, why standing admin rights are the problem, and where machine secrets fit.
2 min read
L05
Identity threat detection and response explained
What ITDR watches, how it responds, and how it differs from the protections in your identity provider.
2 min read
L06
The application coverage gap: why IAM tools miss some apps and accounts
Connectors, local accounts and custom apps: where the stack's reach ends and how to extend it.
2 min read
Building the stack
In what order to add jobs, how company size changes the answer, and how licensing works.
L07
In what order should you add IAM jobs? A sequencing guide
A practical order for building an identity stack, and the signals that move a job up the list.
2 min read
L08
IAM stack by company size: what changes at 300 and 5,000 people
How minimums, caps and audit pressure shape an identity stack for small, mid-size and large organizations.
2 min read
L09
Licensing an IAM stack: add-ons, prerequisites and minimums
Why the per-user price on a vendor page is rarely the price of the job, with published examples.
3 min read
Standards and protocols
The protocols that join the tools, and a standard list of machine identity risks mapped to the jobs.
L10
SAML, OIDC, SCIM and Shared Signals: the protocols that join an IAM stack
Which standard carries which job between tools, and what each one does not do.
2 min read
L11
The OWASP Non-Human Identities Top 10, mapped to IAM jobs
Ten risks for service accounts, tokens and agents, and which job in the stack addresses each.
2 min read
Read next