Identity and Access Management Explained

Identity and Access Management (IAM) is a system that controls who can access what on a computer network or service, and what they can do once they're in. Think of it like a building with locked doors: IAM decides who gets a key, which doors their key opens, and whether they can change anything inside. For you as a person using online services, IAM is what stops someone else from logging into your email, prevents an employee from seeing customer data they shouldn't, and lets your bank confirm you're really you before showing your account balance.

IAM has three main jobs. First, it identifies who you are — usually through a username or email address. Second, it authenticates you — it verifies you're actually that person, typically by checking your password or a code sent to your phone. Third, it authorizes what you can do — it decides whether you can view files, edit documents, delete records, or perform other actions. A company's IT department uses IAM to make sure employees see only the data their job requires. A bank uses IAM to make sure you can see your own account but not your neighbor's. A cloud service like Google Drive uses IAM to let you share a folder with specific people and control whether they can edit or only view.

Key Takeaways

  • IAM systems identify who you are, verify you're that person, and decide what you're allowed to do once you're logged in.
  • Strong passwords and two-factor authentication (a code sent to your phone or generated by an app) are the most common ways IAM systems verify your identity.
  • At work, IAM prevents employees from accessing files or systems outside their job role, protecting both company data and customer information.
  • When you use cloud services, IAM controls which people can access your files and what changes they're allowed to make.
  • IAM is not the same as a password manager — it's the system behind the scenes that decides whether your password is correct and what happens next.

How IAM Verifies You're Really You

The first step in any IAM system is authentication — proving you are who you claim to be. The simplest form is a password: you type a username and password, the system checks them against its records, and if they match, it assumes you're legitimate. But passwords alone are weak because they can be guessed, stolen, or reused across multiple services.

Most modern IAM systems add a second verification step called two-factor authentication (2FA) or multi-factor authentication (MFA). After you enter your password correctly, the system sends a code to your phone via text message or email, or generates one in an authenticator app like Google Authenticator or Microsoft Authenticator. You type that code into the login screen. Now someone would need both your password and access to your phone to break in — much harder than stealing a password alone.

Some systems use even stronger methods. Biometric authentication uses your fingerprint or face scan — your phone's Face ID or Touch ID are examples. Hardware security keys are small physical devices you plug in or tap to your phone to prove you're you. Large organizations often use single sign-on (SSO), where you log in once with your company credentials and then access multiple systems without logging in again to each one.

What IAM Does at Your Workplace

At a company, IAM is the system that decides which employees can access which files, systems, and data. A marketing employee might have access to campaign files and customer email lists but not to the company's financial records or source code. An accountant can view and edit financial spreadsheets but cannot access customer databases or employee medical records. A new hire gets access only to the systems they need on day one; when they leave, their access is shut off when ready.

This matters because it protects both the company and its customers. If a disgruntled employee could access any file they wanted, they could steal customer data, delete important records, or sabotage projects. If a hacked employee account gave an attacker full access to everything, the damage could be catastrophic. IAM limits the harm any single compromised account can do by restricting what that account can reach.

When you change jobs within a company, your IAM permissions change too. Your old manager might remove you from the project folder, your new manager adds you to theirs, and your access to the old department's systems disappears. This happens through IAM rules, not through someone manually going through files and changing permissions one by one.

How IAM Works With Cloud Services and File Sharing

When you use Google Drive, Dropbox, Microsoft OneDrive, or similar services, IAM controls who can access your files and what they can do with them. When you share a folder with a coworker, you're using IAM to grant them access. When you choose whether they can "view only" or "edit," you're setting their authorization level — what they're allowed to do.

The same applies to shared documents. You might share a Google Doc with your team and set it so they can comment but not edit. You might share a spreadsheet with your manager and let them edit it. You might share a presentation with a client and set it to view-only so they can't accidentally change your slides. Each of these permission levels is part of the IAM system behind the service.

If someone's email is hacked and they lose access to their account, the service's IAM system can help recover it. You prove your identity through backup email addresses, phone numbers, or security questions, and once verified, you regain control of your account and all the files you shared.

IAM and Password Managers Are Different Tools

A password manager like 1Password, Bitwarden, or LastPass stores your passwords securely in one place so you don't have to remember them. It fills in your login information when you visit a website. It's a tool you use to manage your own passwords.

IAM is the system on the other end — the one checking whether your password is correct and deciding what you can do next. A password manager helps you create and use strong passwords; IAM is what validates them. You might use a password manager to store a 20-character random password, but the IAM system at your bank is what checks that password against its records and then decides whether to show you your account balance.

Some organizations use both. A company might require employees to use a password manager to store their work passwords securely, while the company's IAM system controls which systems those passwords unlock and what employees can do in each one.

Why IAM Matters for Your Personal Security

For you as an individual, understanding IAM helps you protect your accounts. When a service offers two-factor authentication, enabling it uses IAM's authentication layer to make your account harder to break into. When you review who has access to your shared files and remove people who no longer need them, you're managing IAM permissions. When you use a strong, unique password for each service, you're making it harder for a breach at one company to compromise your account at another.

IAM also explains why some services ask for more verification when you log in from a new device or location. The system is trying to authenticate you more carefully because the login looks unusual. If you try to access your bank account from a country you've never visited before, the IAM system might require additional proof you're really you — a code sent to your phone, answers to security questions, or a call to verify the login.

When you change your password after a data breach, you're updating the authentication credential that IAM uses to verify you. When you remove an old device from your account's trusted devices list, you're changing which devices the IAM system will let log in without extra verification.

Common IAM Terms You'll Encounter

Single Sign-On (SSO) means logging in once and then accessing multiple services without logging in again. Many companies use this so employees log in to their company account once and then can access email, file storage, and project management tools without entering a password for each one.

Multi-Factor Authentication (MFA) or Two-Factor Authentication (2FA) means proving your identity in more than one way — usually something you know (password) plus something you have (your phone) or something you are (your fingerprint).

Role-Based Access Control (RBAC) means permissions are tied to your job title or role rather than your individual account. Everyone in the "manager" role gets the same access; when you're promoted to manager, your access changes automatically.

Provisioning means setting up access for a new user — when you're hired, IT provisions your account with the right permissions for your job. Deprovisioning means removing access — when you leave, IT deprovisions your account so you can't log in anymore.

Frequently Asked Questions

Is IAM the same as a firewall?

No. A firewall controls what traffic can enter or leave a network — it's like a security guard at the building entrance checking if visitors are allowed in. IAM controls what authenticated users can do once they're inside — it's like assigning key cards that open specific doors. You need both for security.

What happens if I forget my password and can't access my backup phone for two-factor authentication?

Most services have account recovery options. You can usually verify your identity through a backup email address, security questions you set up earlier, or by contacting customer support with proof of identity. The IAM system will let you reset your password and regain access once you've proven you're the account owner.

Can my employer see everything I do on my personal phone if I use their Wi-Fi?

Not through IAM alone. IAM controls access to company systems and data, not what you do on your personal device. However, if your employer requires you to install a mobile device management app on your phone to access company email, that app may have broader monitoring capabilities. Check your company's policy before installing work apps on personal devices.

Why do some websites ask me to verify my identity again even though I just logged in?

The IAM system re-authenticates you for sensitive actions — like changing your password, viewing payment information, or authorizing a large transaction — because these actions carry higher risk. Even if someone has your password, this extra verification step makes it harder for them to cause damage.

If I share a Google Doc with someone and then delete my account, can they still access it?

Yes. The IAM permissions you set (who can access the file and what they can do) remain in place. The file itself stays accessible to anyone you shared it with, even if your account is gone. If you want to revoke access, you must do so before deleting your account.