The act of presenting an identity claim, such as a username, account ID, or workload ID.

Verifying that a requester controls an identity using one or more authenticators.

Determining whether an authenticated identity may perform a requested action on a resource under policy.

Identity Provider (IdP)

A system that authenticates identities and commonly issues signed assertions or tokens for relying applications.

A store of identity records and attributes, such as groups, department, status, and device ownership.

Recording access events and decisions so an organization can investigate, demonstrate accountability, and improve controls.

A system that stores identity records and attributes such as names, groups, roles, lifecycle state, and device associations.

Current security and operational signals, such as device compliance, sign-in risk, malware alerts, or anomalous behavior.

Identity as the New Security Perimeter — Enterprise IAM and Zero Trust Architecture

Q: Which control denied the payroll request?

Authorization. The passkey completed authentication: it established confidence in the student's identity. The payroll denial was authorization because a policy evaluated whether that identity had permission to access the payroll resource.

1. Redefine the Perimeter

The old perimeter

Traditional security assumed the corporate network was a trusted inside. Once connected, users often received broad access to internal systems.

Why that changed

Remote work, SaaS, cloud platforms, APIs, and third parties mean important resources now exist beyond one corporate network.

The new decision

Modern access decisions combine identity, device posture, resource sensitivity, policy, and live telemetry rather than network location alone.

A useful picture

Imagine many secure doors rather than one castle wall. Each door evaluates a specific request before granting access to a specific resource.

2. Separate the Four Identity Questions

Identification

Identification is the claim: "I am Maya Chen" or "I am the billing API." A username, account ID, or workload ID is an identifier.

Authentication

Authentication tests the claim. The requester proves control using an authenticator such as a passkey, security key, certificate, or MFA factor.

Authorization

Authorization asks whether the authenticated identity may take a requested action on a requested resource under current policy.

Auditing

Auditing preserves evidence: who acted, what was requested, what decision was made, and what contextual signals influenced it.

Quick Check: Authentication or Authorization?

A student signs in successfully with a passkey, then is denied access to the payroll system because they are not in the payroll role. Which control denied the payroll request?

Which control denied the payroll request?

Identification
Authentication
Authorization
Auditing

Show Answer

Answer: C) Authorization

The passkey completed authentication: it established confidence in the student's identity. The payroll denial was authorization because a policy evaluated whether that identity had permission to access the payroll resource.

3. Understand the IAM Control Plane

Directory and IdP

A directory stores identity data and attributes. An IdP authenticates a requester and commonly issues a signed token or assertion for applications.

Decision and enforcement

A policy engine decides whether access is allowed. A policy enforcement point applies that decision at an application, gateway, proxy, or resource.

Telemetry is context

Device health, sign-in risk, location anomalies, and resource sensitivity can change an access decision without changing the user's basic identity.

Request path

Request → authenticate at IdP → receive token → validate token → evaluate policy → enforce decision → log the outcome.

4. Walk Through a Context-Aware Access Decision

Scenario

Priya signs in from home and requests a restricted research-data download. Her network location alone does not determine the decision.

Verify identity and device

The IdP verifies Priya with a passkey. Device telemetry then reports whether her laptop is managed, encrypted, and adequately patched.

Evaluate the action

Policy checks Priya's project assignment, role, requested action, data classification, and device posture before allowing or limiting access.

Same person, different outcome

Priya may be authenticated but still denied a download from an unmanaged device. Identity is valid; the context is not sufficient for that action.

5. Thought Exercise: Build the Policy

Design a Download Policy

You protect a financial reporting portal. A finance analyst requests to export quarterly results as a spreadsheet.

Choose the signals you would use

Write a rule using at least one item from each category:

Identity: employee status, department, role, project membership
Authentication: passkey used, MFA completed, session age
Device: managed status, encryption, endpoint detection status, patch level
Resource: report classification, environment, data sensitivity
Behavior and risk: unusual location, impossible travel, bulk-download pattern
Action: view, export, edit, approve, delete

Then decide the response

Choose one:

Allow
Allow with controls, such as watermarking or download limits
Require step-up authentication
Require a managed device or virtual desktop
Deny and alert security operations

One possible policy

Allow export only when the requester is an active Finance employee with the `QuarterlyReportingAnalyst` role, has completed phishing-resistant MFA during the current session, uses a compliant managed device, and requests an approved report. Otherwise, require step-up authentication or deny export.

Reflection: Which signals are stable attributes, and which must be evaluated in real time?

6. Secure Human and Machine Identities Differently

Identity is broader than people

Employees, contractors, applications, APIs, containers, service accounts, and devices can all act as security subjects with identities.

Human identity lifecycle

For people, access should change as they join, change roles, take leave, or depart. Stale accounts create unnecessary access paths.

Machine identity risk

A service account with a long-lived secret can be more dangerous than a user account because it may run continuously and access many systems.

Practical control

Assign every machine identity an owner, minimal permissions, managed credentials, logging, and a retirement process.

Quick Check: Machine Identity

A cloud application needs to call an internal API. Which option best follows modern machine-identity practice?

Which option is the strongest default design?

Embed a shared administrator password in the application's configuration file
Use a dedicated workload identity with narrowly scoped permissions and short-lived or rotated credentials
Reuse the developer's personal account so all API calls appear in one place
Allow any application on the internal network to call the API without authentication

Show Answer

Answer: B) Use a dedicated workload identity with narrowly scoped permissions and short-lived or rotated credentials

A dedicated workload identity makes the caller accountable and permits least-privilege authorization. Short-lived or rotated credentials reduce exposure if a credential is stolen. Shared passwords and personal accounts destroy accountability.

7. Sketch a Hybrid IAM Architecture

One common sign-in layer

A hybrid organization can use a central IdP and MFA service for applications running on-premises, in SaaS platforms, and in cloud environments.

Federate instead of copying passwords

Federation lets an application rely on a signed assertion or token from the IdP rather than maintaining a separate password database.

Authorization remains distributed

A central IdP may authenticate a person, while each application or API still enforces detailed resource-specific permissions and actions.

Shared responsibility

Cloud providers operate parts of the platform, but customers still own user lifecycle, tenant roles, access rules, data handling, and monitoring choices.

8. Architecture Challenge: Find the Gaps

Diagnose This Design

A startup has these practices:

Every employee uses one shared VPN account.
Employees sign in to SaaS tools with separate passwords.
A production API accepts requests from any internal IP address.
A deployment script uses a permanent administrator key.
Logs record only whether a user signed in, not which data they accessed.

Your task

For each practice, identify:

The identity or access-control problem
The likely consequence
A better control

9. Key Terms Review

Flip each card, then explain how the term fits into an access request.

Identification: The act of presenting an identity claim, such as a username, account ID, or workload ID.
Authentication: Verifying that a requester controls an identity using one or more authenticators.
Authorization: Determining whether an authenticated identity may perform a requested action on a resource under policy.
Identity Provider (IdP): A system that authenticates identities and commonly issues signed assertions or tokens for relying applications.
Directory: A store of identity records and attributes, such as groups, department, status, and device ownership.
Policy Enforcement Point: The component that applies an allow, deny, limit, or challenge decision at a resource boundary.
Machine Identity: An identity used by a non-human entity, such as an application, service account, API client, container, or device.
Telemetry: Contextual signals, such as device health, anomalous behavior, and risk indicators, used to inform security decisions.

10. Apply the Identity-First Checklist

Start with the resource

Do not begin with the network. Begin by naming the application, API, data set, workload, or administrative function that needs protection.

Map every requester

Identify all human and machine requesters, how they authenticate, the permissions they need, and who owns their lifecycle.

Locate enforcement

Know where policy is decided and where it is enforced: application, gateway, proxy, database, platform, or another resource boundary.

The lasting principle

Strong IAM makes access explicit, least-privileged, context-aware, enforceable, and auditable for every meaningful request.

Key Terms

auditing: Recording access events and decisions so an organization can investigate, demonstrate accountability, and improve controls.
directory: A system that stores identity records and attributes such as names, groups, roles, lifecycle state, and device associations.
telemetry: Current security and operational signals, such as device compliance, sign-in risk, malware alerts, or anomalous behavior.
federation: A trust arrangement in which an application accepts identity assertions or tokens from an identity provider instead of maintaining its own password system.
access token: A signed or otherwise protected credential that represents an authenticated identity and may carry claims used by an application or API.
authorization: The process of deciding whether an authenticated identity may perform a particular action on a particular resource.
policy engine: A component that evaluates rules and contextual signals to produce an access decision.
authentication: The process of verifying that a requester controls the identity they claim.
least privilege: Granting only the minimum access required to complete an approved task.
machine identity: A non-human identity for a service, API client, application, device, virtual machine, container, certificate, or workload.
identity provider: A service that authenticates identities and commonly issues signed assertions or tokens to applications.
zero trust architecture: An approach that protects resources through explicit, context-aware access decisions rather than implicit trust based on network location.
policy enforcement point: A component that applies an access decision at a resource boundary, such as an application, API gateway, proxy, or database.