Identity and access management (IAM) is the set of products that decide who may log in to a company's systems, how they prove who they are, and what each account may do once it is in. An identity is an account that belongs to a person or to a program.
Consider a food delivery company in Bengaluru with 6,000 employees and about 400 internal systems. A new data analyst joins on a Monday. Identity governance and administration (IGA) reads her joining date from the HR system. It creates her accounts in the directory services, the master list of users, computers and permissions. On her first morning, she signs in once through single sign-on (SSO). Then she opens email, the code repository and the dashboards without typing another password. When she signs in, multi-factor authentication (MFA) asks for a second proof, such as a code on her phone.
Some accounts can change anything. They can delete a database or create new users. These are called privileged accounts. Privileged access management (PAM) keeps their passwords in a vault and hands them out for one recorded session at a time.
Many identities do not belong to people. Programs log in to other programs with service accounts and keys. These are called non-human identities, and a company has many more of them than it has employees. Cloud infrastructure entitlement management (CIEM) finds the cloud identities that have more power than they need. Identity security posture management (ISPM) maps every permission across every system, so that the team can answer the question: what can this account actually do? Machines also prove who they are with digital certificates. Certificate lifecycle management renews these certificates before they expire.
Two products deal with people outside the company. Customer identity and access management (CIAM) gives a company's own app a ready-made login for its customers. Vendor privileged access management controls and records the logins of suppliers who work on the company's systems.
One rule lies behind all of these products. It is least privilege: each identity gets only the access that its job needs, and loses it when the job ends. Passwords stolen through phishing are the main reason why the rule matters. Checking who a new customer is, at the time of opening an account, is a different job, called identity verification.