Identity and Access Management (IAM)

IAM covers the full life of a digital identity. It starts when someone joins, with an account created and access granted according to their role. Authentication proves identity, often with multi-factor methods, and single sign-on lets users reach many applications with one login. Authorisation decides what each person may do, commonly through roles, following the principle of least privilege. When people move jobs, their access is changed, and when they leave, it is removed promptly. Privileged accounts, such as administrators, get tighter handling. Access recertification, also called access review, is a periodic check in which managers or system owners confirm each person's access is still needed, and remove what is not. Auditors test these reviews closely, since accumulated rights are a classic source of fraud and breach. A leaver whose account stays live for months is the usual finding when this process is neglected.

Each quarter, department heads at a university receive a list of everyone with access to the student records system and are asked to confirm or revoke each entry. One head finds a clerk who moved to another department still has grading rights. The access is removed the same day, and the review is logged as audit evidence.