Jeff Crume explains that every IAM system is built on four functional pillars:
The "Manager" role. This involves creating user accounts, updating phone numbers, and deleting accounts when people leave.
The "Is it really you?" check. This is your login screen, password prompt, or FaceID scan.
The "Permissions" check. Just because you are allowed in the building doesn't mean you are allowed in the CEO's office. AuthZ decides which files you can open.
The "Security Camera." This keeps a record of who logged in and what they touched, so we can check it later if something goes wrong.
In large companies, you can't manage permissions for 10,000 people individually. You use Roles.
Instead of saying "Bob gets email access," the architect says "Everyone in the 'Teller' role gets access to the Bank App, Email, and HR." This makes security much easier to manage and scale.
User IDs are stored in a Directory. Jeff notes that most companies have many different directories (one for Email, one for Finance, etc.).
This is the standard language computers use to look up user information. If a system "speaks LDAP," it can work with most user directories.
Security happens through the entire "life" of an employee at a company.
Automatically creating all the accounts a person needs the second they are hired in the HR system.
The most important security step. When someone is fired or leaves, the system must instantly kill all their access rights. If this is forgotten, a "ghost account" remains that hackers can use.
This allows you to log in once (e.g., your company portal) and gain access to 50 different apps without typing your password again. It keeps users happy and secure.
Some users (IT Admins) have "Keys to the Kingdom." They can delete the whole database. PAM tools record their screen and require them to "check out" passwords like a library book for extra safety.
The future! Using biometrics (fingerprints) or hardware keys (USB sticks) so users never have to remember a password that can be stolen or guessed.