2022 IAM Reference Architecture

Identity and Access Management (IAM) is vital for managing identities, accounts, and access to resources in organizations. Digital transformation has intensified the need for robust IAM as digital identities become central. The KuppingerCole Analysts introduced the 'Identity Fabric' concept in 2018, further updated in 2022 to adapt to current trends. This framework serves as a blueprint for individual IAM architecture designs and offers standardized, yet flexible, infrastructure tailor-made for hybrid digital environments. It helps design initial architectures, analyze existing setups, and transform architectures incrementally. The blueprint’s phased implementation approach ensures continuous delivery from legacy IAM infrastructures. Key components within the architecture are divided into four capability areas—Administration, Analytics & Risk, Authentication, and Authorization—with each area containing specific building blocks. These blocks are categorized as core, supplementary, or integrable, providing a structured landscape for IAM processes, policies, and technologies. The modular layout of the architecture enables identification of functional gaps, optimization of module limitations, and ensures interoperability through standardized protocols and APIs. Recommendations emphasize focusing on a clear layered architecture, strategic roadmaps, core capabilities, and continuous improvement in accordance with the specific needs of the organization.

• The KuppingerCole IAM Reference Architecture was first introduced in 2018.
• It was updated in 2022 to reflect current trends and requirements.
• The architecture is based on distinct building blocks with minimal overlap.
• IAM encompasses Administration, Analytics & Risk, Authentication, and Authorization as capability areas.
• The IAM blueprint approach allows for phased implementation, enhancing continuous delivery.
• Standardized protocols, APIs, and interfaces lay the foundation for interoperability.
• CIEM (Cloud Infrastructure Entitlement Management) and DREAM (Dynamic Resource Entitlement & Access Management) are part of the modern IAM components.
• Access governance answers three questions: who has access to what, who accessed what and why, and who granted that access.
• Privilege Elevation Management allows temporary elevation of access rights for specific purposes.
• Policy-based Access Management uses attributes and context for real-time access decisions.

• "Digital transformation is accelerating the need for IAM even more, with digital identities moving to the center of digital transformation."
• "Without the ability to manage and control everyone's access to every service, enterprises will fail in their transformation initiatives."
• "This concept has been designed to evolve over time to adapt to changes in functionality and overall context."
• "This approach allows step-by-step and uninterrupted delivery from legacy IAM infrastructure during a consistent modernization."
• "The IAM blueprint and IAM Reference Architecture, this knowledge and advice can be leveraged into establishing individual target architectures."
• "Identity lifecycle management goes far beyond these processes and reflects detailed knowledge of organizational policies and processes."
• "Access governance is one of the key IAM technologies for any organization due to the massive impact of potential security risks."
• "The goal of adaptive authentication is to provide the appropriate risk-mitigating assurance levels for access to sensitive resources."
• "Shared accounts are resources that have a single pair of credentials but are used to authenticate multiple users."
• "Policy-based Access Management leverages identity and access management to control access to restricted resources in real-time."