Identity and access management (IAM) is the set of policies and processes an organization uses to establish digital identities, verify them, decide what they can access, and change or remove that access as needs change. Effective IAM covers people, services, and other entities—not just employee sign-ins—and connects authentication, authorization, lifecycle management, and oversight.
What does IAM include?
An identity is a digital representation of a person, service, device, or other entity. An account connects that identity to a system or resource; a credential or authenticator is used to prove control of an account. IAM governs how those identities and accounts are established, used, granted permissions, reviewed, and retired.
As an Amazon Associate I earn from qualifying purchases.
In practice, IAM is an organizational capability, not a single product setting. Its coverage depends on reliable source records, clear ownership and approvals, application integrations, exception handling, and procedures for role changes and departures. CISA’s administrator best practices address identity governance, account creation, privileged access, and just-in-time provisioning.
Recommended Free Tools
- Identity proofing and enrollment: Establish an identity and its initial relationship with a service.
- Authentication: Verify that a claimant controls an authenticator associated with an account.
- Authorization: Decide which resources and actions that identity is permitted to use.
- Federation and single sign-on: Allow one system’s identity assertion to be trusted by another service under an agreed relationship.
- Lifecycle management and oversight: Change, review, and revoke accounts and permissions as circumstances change.
NIST’s SP 800-63 Revision 4 covers proofing, authentication, and federation for interactions with government information systems over networks. It is federal digital identity guidance—not a universal legal mandate for private organizations. Private-sector teams can use it as a technical reference where it fits their risk, obligations, and user context.
#1 Best Overall
- Standard OATH compliant TOTP token (time based)
- 6-digit OTP code with countdown time bar
- Zero footprint: no need for the end user to install any software
- Secure, sturdy, and long-life hardware design
- Easy to use - Portable key chain design. These tokens will only work with Symantec VIP Access. These tokens will not work for any other Multi-Factor Authentication services, besides Symantec VIP Access.
How do proofing, authentication, and authorization differ?
These terms describe different decisions in an access flow. Treating them as interchangeable can leave gaps: a successful sign-in does not establish that access is appropriate, and an assigned permission does not prove who is using the account.
| Stage | Question it answers | What it does |
|---|---|---|
| Identity proofing | What evidence supports this claimed identity? | Evaluates evidence so a credential service provider can establish an identity at an appropriate assurance level. |
| Authentication | Does this claimant control the account’s authenticator? | Checks control of an associated authenticator; it does not determine which actions the account may take. |
| Authorization | May this identity access this resource or perform this action? | Applies permissions or policy to an identity and a requested operation. |
Proofing and enrollment
Proofing evaluates evidence about an applicant; enrollment creates the account or credential relationship used by a service. NIST SP 800-63A-4 covers proofing and enrollment and defines identity assurance levels. Match the rigor to the risk and context. The federal guidance should not be read as a requirement to verify every employee’s identity documents in the same way.
Authentication and assurance
Authentication checks a claimant’s control of an authenticator linked to an account. Passwords are one kind of authenticator; multi-factor authentication (MFA) requires more than one factor, and phishing-resistant MFA is a stronger priority for high-impact access. CISA recommends phishing-resistant MFA for services including email, VPN, and critical systems in its #StopRansomware Guide. NIST’s current Revision 4 volume for authentication and authenticator management is SP 800-63B-4.
A physical FIDO2 security key can be one possible authenticator, but compatibility with the organization’s identity provider and policy must be checked. No authenticator removes the need to secure account recovery and administrator processes.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Authorization models
Authorization can be implemented in different ways. Role-based access control (RBAC) grants permissions through roles, such as a defined job or operational function. Attribute-based access control (ABAC) uses attributes or policy conditions—such as identity, resource, or context—to make a decision. Either model can fail if roles or attributes are inaccurate, policies are poorly enforced, or decisions are not reviewed and logged.
How do federation and single sign-on fit in?
Federation lets a service rely on an identity assertion from another system, such as an identity provider, under a trust relationship. Single sign-on (SSO) can let a user sign in once and access multiple connected services without repeating the full sign-in process for each one. NIST SP 800-63-4 treats federation as a distinct part of its digital identity framework.
SSO is not authorization: each application still needs to decide what an authenticated identity can do. Federation also concentrates risk in the identity provider and its administration and recovery paths. A failure or compromise there may affect multiple connected services, so trust configuration, administrative separation, recovery, and monitoring belong in the design.
How does IAM apply across cloud service models?
Cloud access controls differ by service model because the customer and provider manage different layers. NIST SP 800-210, General Access Control Guidance for Cloud Systems, explains that IaaS, PaaS, and SaaS each have a distinct focus; controls for lower-level components can also apply to corresponding components in higher-level models.
Rank #3
- OTP token that provides secure remote access with strong authentication
- Easy to use and easy to carry
- Expected battery life is approximately 7 years
| Service model | IAM planning focus |
|---|---|
| IaaS | Account for access to infrastructure resources as well as the operating systems, applications, and data the organization manages on them. |
| PaaS | Consider access to the provider’s platform capabilities alongside permissions for the applications and data the organization deploys. |
| SaaS | Govern user and administrator access within the application, including its available roles, data permissions, and identity integrations. |
These are planning lenses, not a substitute for checking the control surface of each service. Include human and service identities in cloud governance; do not assume a sign-in integration alone covers application permissions or non-human accounts.
What IAM practices reduce unnecessary access?
Apply least privilege
Give people, services, and processes only the permissions needed for assigned work, and remove access when it is no longer justified. CISA recommends least privilege and IAM systems to manage roles and privileges across on-premises and cloud applications. The principle is useful only when permissions are scoped, enforced, and revisited as work changes.
Protect privileged work separately
Administrator access can alter systems, accounts, or security controls, so it warrants tighter handling than routine use. CISA’s administrator guidance discusses privileged access management (PAM) and just-in-time provisioning. Practical controls include limiting who holds privileged accounts, using a standard non-privileged account for routine work where feasible, monitoring elevated actions, and considering temporary elevation for specific tasks. Emergency access, approval, monitoring, and recovery still need deliberate design.
Keep permissions aligned with the lifecycle
Define which source records trigger account creation, role changes, and offboarding; who approves access; and how application owners confirm that permissions remain necessary. Timely revocation depends on those triggers reaching the systems in scope. Exceptions should have an owner, a reason, and a review path rather than becoming permanent access by default.
Rank #4
- Works with authentication systems that support TOTP tokens: Google, Facebook, Coinbase, GDAX, Dropbox, GitHub, Kickstarter, Microsoft, TeamViewer, etc.
- Programmable an unlimited number of times. Features syncable clock to prevent issues with drift
- About half the size of a credit card and just as thick-easily keep multiple cards in wallet
- Works with "Token2 Token Burner" or "Protectimus TOTP Burner", both available in the Google Play Store. Now also iOS compatible (iPhone 7 and later)
- More secure than software token as your codes cannot be intercepted by malware on your phone.
How should an organization put IAM into practice?
- Inventory the access landscape. List users, non-human identities, applications, cloud resources, privileged accounts, and current authentication paths. Identify duplicated or orphaned accounts and critical services with weak coverage.
- Assign owners and lifecycle triggers. Decide who approves access, which source records initiate account changes, how reviews work, and how departures or role changes lead to revocation.
- Design permissions around work. Map access to job tasks and resource sensitivity. Use roles where they fit; add attributes or contextual policy where needed. Define how exceptions and separation-of-duties conflicts will be reviewed.
- Strengthen critical sign-ins. Prioritize email, remote access, administrator accounts, and critical systems for robust MFA, with phishing-resistant MFA as a CISA-recommended goal. Select methods that work with the identity provider and user environment.
- Separate privileged activity. Limit administrative accounts, distinguish routine from elevated work where feasible, monitor elevated actions, and evaluate just-in-time elevation for specific tasks.
- Bring cloud and SaaS into governance. Account for differences among IaaS, PaaS, and SaaS, and confirm that access processes cover both people and service identities.
- Measure operational evidence. Track locally meaningful measures such as access-review completion, time to remove access after separation, MFA coverage for critical systems, stale or orphan accounts found, standing privileged access, exceptions, and integration gaps.
These measures help reveal process gaps; they are not published benchmarks or proof that a particular control has prevented compromise. CISA frames IAM as part of resilience against compromised credentials and ransomware, alongside phishing-resistant MFA, least privilege, zero-trust access policies, and monitoring of roles and privileges. No single control guarantees security.
How should you evaluate IAM tools?
Start with the organization’s requirements, existing systems, and operating capacity rather than a generic feature checklist. A tool can support a process, but it cannot by itself guarantee accurate source data, good approvals, complete integrations, or effective offboarding. Evaluate evidence for the capabilities that matter to your environment:
- Identity lifecycle coverage, including provisioning and deprovisioning across the applications in scope.
- Authentication methods and support for the assurance needs of different users and services.
- Federation and SSO integrations, plus resilience and recovery for the identity provider.
- Authorization flexibility, including RBAC and policy or attribute-based controls.
- Access reviews or certifications, audit trails, and reporting.
- Privileged account protections and just-in-time elevation.
- Coverage across on-premises systems, IaaS, PaaS, and SaaS.
- Administrator separation, usability, and the ongoing operational burden.
Validate how each required workflow behaves, including exceptions, recovery, and account removal, against current product documentation and contracts. The NIST and CISA guidance establishes relevant control areas, not vendor rankings or current product feature claims. NIST’s implementation resources note that nearly 6,000 individual public comments were part of the almost four-year process culminating in SP 800-63 Revision 4; that figure describes public input, not IAM adoption or security effectiveness. See NIST’s SP 800-63-4 implementation resources.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
