Making IAM agile and working to the business

IAM has shifted over the last decade from a primarily administrative, security, and access-governance tool focused on employees into a core business enabler for digital services. Digital identities now sit at the center of digital business, spanning consumers and customers, business partners, devices and “things,” and even services—so IAM scope must expand beyond workforce IAM and beyond humans. Without modern IAM, organizations will struggle to execute not only initial digital transformation but also the continuous evolution required in digital business, where agility, volatile partnerships, direct customer interaction, and IoT-like relationships demand fast, reliable identity capabilities.

This expansion creates a multi-dimensional challenge across identity types, deployment/operating models (on-premises through IDaaS and managed services), and capabilities (from lifecycle management and access reviews to multi-cloud entitlements, passwordless authentication, and decentralized identities). New business demands can push organizations toward fragmented point solutions owned by different departments, creating “sprawl,” higher costs, and later integration pain. Large, multi-year “big bang” programs worsen the issue by failing to deliver on business timelines.

Agile IAM requires more than cloud delivery and standards; it needs an architecture, plan, and operating approach that can deliver new capabilities quickly within a defined framework. Six pillars underpin agility: organization, model, plan, target operating model (TOM), extension/customization, and integration. Key tactics include central IAM ownership, a unified capability model (e.g., Identity Fabric), agile roadmap planning (“now, soon, later”), modern API-centric microservice architectures, isolation of custom code via an Identity API layer, and backward compatibility with legacy IAM. GitOps—combining DevOps with infrastructure-as-code—connects customization and operations into repeatable, auditable deployments. Service Layers is presented as an approach that operationalizes GitOps for managed IAM delivery with consistent identity APIs, automation, and high-availability patterns.

• IAM scope now includes consumers, customers, business partners, devices/things, and services in addition to employees.
• Traditional IAM commonly emphasized administrative user management, access security, compliance, and periodic access reviews.
• IAM evolution is described across three axes: identity types, deployment/operating models, and capabilities.
• Point IAM solutions are sometimes implemented by marketing teams for consumer use cases or by decentralized developer teams.
• “Big bang” multi-year IAM deployments can foster sprawl by failing to meet business timelines.
• IAM agility is defined as the ability to serve new requirements quickly and efficiently within a defined framework.
• Six pillars of IAM agility are listed: Organization, Model, Plan, TOM, Extension & Customization, Integration.
• GitOps is described as extending DevOps by applying infrastructure-as-code so runtime environment configuration is managed in code.
• Service Layers provides a managed IAM framework built around established IAM solutions and a consistent Identity API layer.
• Major IAM incidents are attributed in part to upgrade deployment errors such as missing libraries or modules.

• “IAM is a business enabler. Digital identities are at the core of every digital service, and digital business relies on digital identities.”
• “Digital Identities are as essential to the success of the digital business as IoT, AI, or data.”
• “With the need for delivering a way broader set of IAM capabilities than ever before, and the need to cater to new business demands to IAM in an agile manner, the art is to avoid sprawl and still deliver consistent IAM services in an efficient manner.”
• “Successful IAM organizations must manage to get ahead of the curve, not following the business demand but being prepared to deliver when new capabilities are required.”
• “Modern architectures, target operating models, and deployment models are the foundation for a successful IAM delivery.”
• “Modern architectures, supporting APIs, being based on microservices, and enabling segregation of custom code via APIs are essential for rapidly delivering the required customization, integration, and orchestration to the business.”
• “GitOps is about an integrated approach of DevOps and Infrastructure as Code, ensuring that everything can be deployed and operated seamlessly.”
• “Service Layers delivers a modern IAM framework, utilizing existing IAM solutions, that build on the GitOps paradigm and thus overcomes the challenges of traditional IAM deployments.”
• “Utilizing GitOps allows for automated and repeatable deployments.”
• “It is time to think beyond IAM as a set of technical tools, and to build an IAM organization and infrastructure that is ready to serve today's business demand.”