IAM (Identity and Access Management)
Last updated
Definition
Identity and Access Management is the discipline and tooling for managing digital identities and what they may reach – the directory of users and groups, authentication (MFA, SSO, passwordless), authorization through roles and group membership, and the joiner-mover-leaver lifecycle that provisions access on day one and revokes it on the last. In most SMBs the identity platform is Entra ID or Google Workspace, with SaaS applications federated to it.
Why it matters to an MSP
Identity is where most breaches start – stolen credentials remain the leading initial access vector – so the identity platform is the control plane you are really defending, not the firewall. It is also where shadow IT gets governed: a sanctioned app behind SSO with automated provisioning is covered by MFA, appears in sign-in logs, and loses access the moment the user is disabled; the same app on a personal login is invisible and survives offboarding. The operational upside is measurable. Password resets and access requests are a large share of an SMB help desk's ticket volume; SSO, self-service reset, and group-based access assignment cut most of it, which is labor you keep as margin under a flat-fee contract. A documented offboarding runbook that disables one identity and cascades to every application is also what insurers and auditors mean when they ask about "timely access revocation." Package it: identity governance – MFA enforcement, conditional access, SSO onboarding for the client's key SaaS apps, quarterly access reviews – sells as a security tier or a $5–$15 per user per month line. The one part that needs discipline rather than tooling is privileged accounts, which is where PAM picks up. Sequencing is covered in identity and access for SMB.