Identity Management

digital identities, verify that the people and machines behind them are who they claim to be, and control what each identity can reach over its entire lifetime, from enrollment to the day the organization removes access.

People who hold valid credentials look like legitimate users, so this control layer often determines whether unauthorized access becomes a data breach or stops at the door.

Key Takeaways

• Identity management connects proofing, authentication, authorization, monitoring, and deprovisioning across one lifecycle.

• Roles, attributes, and policies determine what an authenticated identity can reach under least-privilege principles.

• Stolen credentials are only one part of identity risk because session tokens and account recovery can also extend unauthorized access.

• Human and non-human identities require clear ownership, scoped permissions, regular review, and timely removal.

How Identity Management Works

Identity management works by establishing who an entity is, verifying its claim, and determining what it may do. In broad usage, identity management is a synonym for identity and access management (IAM) and covers authorization. In narrow usage, it covers only who an entity is; access management covers what it may do. Identity governance and administration (IGA) and privileged access management (PAM) are related but distinct disciplines inside that broad IAM scope.

Identity Proofing and Enrollment

Identity proofing establishes that a claimed identity belongs to a real person before any account exists. The organization validates identity evidence, verifies the applicant, creates an account, records attributes such as department and role, and binds authenticators. Because forged media or injected video can fool remote proofing, the National Institute of Standards and Technology (NIST) added controls for these methods in NIST's August 2025 revision.

Enrollment connects the verified person to the account and its authenticators. As a result, later authentication does not repeat the original proofing process; it checks whether the person requesting access still controls an authenticator bound during enrollment. Reliable identity data at this stage also supports later provisioning, authorization, access reviews, and deprovisioning.

Types of Authentication Factors

Authentication proves that an identity claimant controls its bound authenticators, and multi-factor authentication (MFA) combines at least two of three factor types. The most common types of authentication include:

1. Knowledge Factors: Passwords, personal identification numbers, and security questions are information the user knows.

2. Possession Factors: Hardware security keys, smart cards, authenticator apps, and phones are objects the user holds.

3. Inherence Factors: Fingerprints, facial geometry, and voice patterns are physical characteristics of the user.

Together, distinct factors make access less dependent on one credential. A verifier checks the authenticator and issues a session secret, so a stolen session cookie works much like a stolen password and can let another party use the account. Reauthentication after inactivity and revocation when risk signals change limit how long a hijacked session remains useful.

Authorization Through Roles, Attributes, and Policies

Authorization determines what an authenticated identity may do through one of three models:

1. Role-Based Access Control: Role-based access control (RBAC) attaches permissions to predefined roles that usually mirror job positions, though the first role catalog can take time to build.

2. Attribute-Based Access Control: Attribute-based access control (ABAC) evaluates subject, resource, and environment attributes at request time. For example, an orthopedist can receive records access during an out-of-state mass-casualty response. A claims adjuster, in a different context, can generate a check that only a supervisor can sign.

3. Policy-Based Access Control: Policy-based access control (PBAC) combines attributes and rules through a central policy authority, extending ABAC with a unified decision point.

Whatever the model, least privilege governs the decision: an identity receives only the permissions its function needs. Roles provide a manageable baseline. Attributes and central policies let access change with context such as device, location, and time.

The Identity Management Lifecycle from Joiner to Leaver

Organizations manage the identity lifecycle through joiner, mover, and leaver events that connect employment records to access changes. Here's how it works:

1. Joiner: A human resources (HR) record for a new employee triggers "birthright provisioning," which automatically creates accounts and baseline entitlements from the person's position or department, often through System for Cross-domain Identity Management (SCIM).

2. Mover: A role change in the authoritative source adjusts entitlements so the identity gains what the new job needs and loses what the old one had.

3. Leaver: A termination transaction from HR drives deprovisioning, which removes access across every connected system and deactivates the identity.

This sequence aligns access with a person's current relationship to the organization. "Ghost access" lingers for weeks or months when teams deprovision application by application rather than centrally, and orphaned accounts leave another route for continued access. Good practice disables all accounts on the day of departure, resets shared-account passwords when personnel transition, and audits user, administrator, and service accounts to remove unused ones. Zero-touch automation that revokes access everywhere as soon as the HR source shows a departure removes the human delay.

Core Components of Identity Management

A complete identity management program connects authoritative data, access decisions, authentication, provisioning, monitoring, and review. Each component plays a distinct role:

• Directory Services and Authoritative Sources: These components share identity data, and a break between them creates a gap in access control. An HR system of record holds trusted attributes that a directory serves to applications.

• Identity Governance and Administration: IGA tooling provisions access from HR data, and business owners recertify each entitlement.

• Single Sign-On: Single sign-on (SSO) lets one account and its authenticators reach many applications through federation.

• Federation: Partners and customers sign in with their own identity provider across separately administered systems.

• Multi-Factor Authentication: MFA requires two or more distinct factors at login.

• Privileged Access Management: PAM vaults, rotates, records, and elevates administrator, emergency, and service accounts just in time.

• Customer Identity and Access Management: Customer identity and access management (CIAM) manages identities for customers and application users; unlike workforce users, organizations cannot always require customers to follow login rules, so friction or failure can cost revenue and loyalty.

• Non-Human Identity Management: Non-human identity (NHI) management governs service accounts, application programming interface (API) keys, and OAuth tokens that often hold long-lived, over-privileged secrets; an attacker who compromises a compute host can lift its default service account credentials.

• Session Management and Continuous Monitoring: Shared-signal frameworks send events such as "session revoked" from the identity provider to applications asynchronously.

• Access Reviews and Auditing: Entitlement reviews and access baselines confirm who can reach what.

Working together, these components carry trusted identity information from the system of record to each access decision. Open standards connect them across applications and organizational boundaries.

On a new hire's first day, SCIM creates the account in each application, SAML or OpenID Connect handles the login, and a SCIM deprovisioning call removes the account everywhere on departure. The standards therefore connect lifecycle events to authentication and application access without requiring each system to invent a separate method.

Phishing-Resistant MFA and Zero Trust

Phishing-resistant authentication removes codes that attackers can relay through fake pages. Zero trust security limits what a stolen credential can reach.

Phishable MFA and Phishing-Resistant Authenticators

Phishable MFA exposes codes and sessions to interception. Domain-bound authenticators prevent replay on lookalike sites. Attackers commonly exploit phishable MFA through three methods:

• Text and Voice Codes: Subscriber identity module (SIM) swapping and telephone-network weaknesses expose text-message and voice codes.

• Adversary-in-the-Middle Proxies: These proxies relay typed one-time codes to the real site in real time while capturing the resulting session cookie.

• Push Bombing: In push bombing, or MFA fatigue, an attacker who holds the password sends approval prompts until the user accepts one. Number matching limits this method but still leaves typed codes vulnerable to phishing.

These MFA bypass techniques often begin with a social engineering lure that points to a fake page.

FIDO2 and WebAuthn authenticators, including passkeys, replace a shared secret with a domain-bound key pair, so a lookalike site receives nothing it can replay. Hardware keys provide the strongest form. Passkeys can sync across devices or remain bound to one. NIST passkey guidance treats properly configured syncable passkeys as meeting authentication assurance level 2 (AAL2). Account recovery remains the step to harden because a weaker recovery method may allow someone to enroll a new authenticator.

Identity Maturity in a Zero Trust Model

Zero trust architecture removes implicit trust based on network location or asset ownership. Organizations therefore check identity before every access and reevaluate it during sessions, making identity the primary control.

The Cybersecurity and Infrastructure Security Agency (CISA) defines four stages for its identity pillar:

1. Traditional: Organizations use passwords or basic MFA, on-premises identity stores, limited risk assessment, and permanent access with periodic review.

2. Initial: Organizations use MFA with multiple attributes, some identity-store integration, and access that expires with automated review.

3. Advanced: Organizations adopt phishing-resistant MFA, initial passwordless login, automated risk analysis, and need-based, session-scoped access.

4. Optimal: Organizations continuously validate identity, integrate identity stores across partners and environments, analyze risk in real time, and automate just-in-time, just-enough access.

The stages move identity controls from periodic checks and standing privileges toward continuous decisions and short-lived access.

Top Compliance Frameworks That Depend on Identity Controls

Major compliance frameworks turn requirements for unique identities, controlled access, MFA, and activity records into audit obligations. Four frameworks shape most identity programs:

• Health Insurance Portability and Accountability Act (HIPAA) Security Rule: Covered entities must assign unique user IDs, verify that whoever seeks electronic health data is who they claim to be, and record system activity; a risk analysis may show that an organization must use MFA, and the HIPAA Security Rule requires minimum-necessary access.

• Gramm-Leach-Bliley Act (GLBA) Safeguards Rule: The Federal Trade Commission requires multi-factor authentication for anyone accessing customer information and mandates logging and monitoring of authorized-user activity.

• Payment Card Industry Data Security Standard (PCI DSS): Organizations must manage accounts and privileges for user, application, and system identities, apply MFA to access into the cardholder data environment, and log and monitor all access.

• Cybersecurity Maturity Model Certification Level 2: Defense contractors must limit system access to authorized users, processes acting for them, and authorized devices, and they need certification before contract award.

These controls reduce account takeover risk and let a well-run identity program supply consistent evidence for several audits instead of creating separate control processes for each requirement.

Identity Management Beyond the Login

Identity management works best when proofing, authentication, authorization, monitoring, and deprovisioning operate as one lifecycle. Phishing-resistant authenticators and context-aware authorization can strengthen access decisions. Short-lived grants reduce standing privilege. The next priority is to bring service accounts and AI agents under the same discipline as people, with a named owner, scoped permissions, regular review, and a defined removal date for every identity.

Frequently Asked Questions

Why Can Account Recovery Weaken MFA?

A weaker recovery method can let someone sidestep a strong authenticator and enroll a new one in its place, so the recovery flow deserves the same scrutiny as the primary authenticator itself. Organizations need recovery controls that preserve the protection phishing-resistant MFA provides instead of creating an easier route into the account.

How Should Shared Accounts Be Handled During Personnel Changes?

Organizations should reset shared-account passwords when personnel transition and audit the accounts for unused access. Clear ownership and timely credential changes reduce the chance that former personnel retain a route into connected systems.

Should Identity Management Run in the Cloud, On-Premises, or Both?

On-premises deployments keep identity infrastructure in-house and suit legacy applications that lack modern federation. Cloud identity providers add elastic scale and native support for protocols such as SAML and OpenID Connect. Hybrid deployments connect both environments but spread identities across two stores.

What Is a Digital Identity?

A digital identity is the collection of details that distinguishes a subject within a particular system. One person can therefore have different digital identities in an HR system, a bank, and a hospital. An identifier is the unique label each context assigns. The identity is the attribute set behind that label.