Identity and access management is the discipline of granting, reviewing, and removing access so only the right accounts reach each resource.
It connects a known identity to permissions, reviews, and revocations, which is more than storing a profile or stopping impersonation.
How it works
Joiners need access on the first day they should have it, movers need old access removed when the role changes, and leavers need a prompt cutoff.
Reviews ask managers whether a permission is still justified, because access that accumulates quietly becomes an insider and takeover risk.
The program can include single sign on, role catalogs, and privileged accounts with stronger checks than an ordinary user login.
Buying a directory does not finish the discipline if nobody owns the catalog of roles or the clock for removing a contractor.
Concrete examples
- A new analyst receives the standard case tool role on Monday and does not receive the payroll role that belongs to a different team.
- A quarterly review removes a shared folder right from a manager who changed divisions three months earlier.
- A privileged database login requires a separate approval and expires at the end of the change window instead of remaining forever.
Protective measures
- Tie every permission grant to a role or a ticket so access can be explained months later.
- Remove access the same day a person leaves, including remote tokens, mailboxes, and vendor portals.
- Review high impact roles on a shorter cycle than ordinary roles, and record the reviewer's decision.
- Separate administration of the access system from day to day use of the business applications it protects.
Related articles
The attributes and authenticators that define who is asking are described in What is a digital identity inside an access system?.
Crime that misuses a person's identity rather than an access catalog is covered in What is identity theft against an individual private person?.
Harm from someone who already holds legitimate access is explained in What is an insider threat inside a trusted organization?.