Identity and Access Management

Identity and Access Management (IAM) has long been established in enterprises, initially driven by administrative efficiency through identity lifecycle processes often sourced from HR master data and propagated into downstream systems. Over time, the security imperative became central: organizations increasingly require a comprehensive view of granted authorizations, consistent enforcement of “need to know” and “least privilege,” and the ability to monitor, detect, and prevent misuse. Well-defined, consistently executed IAM processes also underpin compliance, because provable, trustworthy documentation of ongoing control is required for legal, regulatory, and industry demands.

Digital transformation expands IAM beyond internal IT security into a foundational business capability. As workloads move to cloud and as-a-service models, digital services proliferate, and partnerships become more volatile, digital identities (employees, partners, customers, consumers, devices, and services) move to the center of enterprise architecture. The former notion of clear network perimeters and isolated identity populations no longer holds in a hybrid reality where access happens from anywhere to services spanning on-premises and cloud environments. Consequently, next-generation IAM must become an “Identity Fabric”: a logical platform that orchestrates standardized identity services to connect everyone and everything to every service securely and at scale, without losing control.

KuppingerCole’s IAM/IAG Reference Architecture frames this evolution using four capability areas—Administration, Audit & Analytics, Authentication, and Authorization—organized into core, extended, and IAM-related building blocks. Achieving an Identity Fabric requires decomposing monolithic IAM into modular services, introducing an identity API platform and layered service consumption model, leveraging microservices and containers for resilience and scaling, and establishing logical boundaries and governance that shift responsibility toward digital services consuming identities and authorizations at runtime. The transition should be incremental, guided by capability mapping, portfolio management, transition architectures, and milestone plans.

• HR management systems often serve as the master data source for identity records that feed IAM and connected systems.
• IAM helps prevent unauthorized access to networks, data, and applications and is a core component of IT security infrastructure.
• The reference architecture distinguishes four high-level capability areas: Administration, Audit & Analytics, Authentication, and Authorization.
• Architectural building blocks are categorized as core (indispensable), extended (complementary), and IAM-related (peripheral).
• IAM building blocks are treated as quasi-stable and are revised over time without aiming to follow short-lived hype.
• Earlier remote access commonly used VPNs that exposed the complete company network after connection.
• The concept of a security perimeter has practically ceased to exist due to cloud/mobile-driven connectivity and networking between companies.
• Many current IAM infrastructures are rooted in traditional enterprise IAM, sometimes with an additional, siloed customer identity system.
• Existing IAM solutions are often monolithic, which makes decomposition into individual components difficult.
• The Identity Fabric is defined as shifting from singular systems to a logical platform that provides and orchestrates IAM services.

• “Without the ability to manage and control the access of everyone to every service, businesses will fail in their transformational initiatives.”
• “Those days are gone, and we have to adapt our IT and our IAM accordingly.”
• “The formerly classic corporate network with clearly defined ‘inside’ and ‘outside’ has given way to a massively hybrid, new IT reality.”
• “IAM (Identity and Access Management) is the essential security infrastructure for this and at the same time a facilitator of these new services, models and forms of cooperation.”
• “The assumption that previously independent identities (employees, customers, partners, mobile devices, etc.) in an enterprise can be regarded as isolated is no longer valid.”
• “The Identity Fabric… is shifting away from isolated, singular systems to a logical platform that provides and orchestrates a varying set of required IAM services and related functions.”
• “Today’s IAM systems meet, if at all, only a fraction of current requirements.”
• “The path to the Identity Fabric requires changes in the way applications deal with identities and data as the processed payload.”
• “Instead of being actively managed from the outside, digital services will have to play a much more active role in handling identities and data in the future.”
• “This transformation of your IAM infrastructure into an Identity Fabric does not need to be and is not meant to be disruptive by any means.”