The Future of IAM Lies in the Cloud and as a Service

Identity and Access Management (IAM) is positioned as a core enabler of secure, efficient digital business, providing controlled access to services, applications, and data centers for a rapidly expanding mix of identities: employees, customers, partners, applications, service accounts, and IoT devices. As organizations shift to cloud, IaaS, and SaaS—and adopt DevOps, automation, collaboration tools, enhanced data governance, and initiatives like Big Data and AI—the volume and variety of identities grow quickly, while legacy IAM architectures struggle to keep pace. This elevates IAM into a frontline defense against unauthorized access and cyber-attacks using fraudulent identities, while also needing to keep access friction low.

KuppingerCole recommends designing IAM around an Identity Fabric: a unified set of identity-focused services spanning authentication, access management, identity management, and access governance, connected to systems through connectors, scripts, and increasingly APIs. Ideally implemented with containers, Kubernetes, and microservices, the Identity Fabric must still bridge legacy environments, which can exceed many organizations’ operational capacity and drive interest in outsourcing or managed services.

The text contrasts traditional on-premises IAM with Identity as a Service (IDaaS), where cloud-delivered IAM reduces deployment burden, improves time-to-value, provides automatic updates, scales with demand, and simplifies user experience via SSO and fewer credentials. It also highlights a third model: bespoke IDaaS designed by an integrator using best-of-breed components, optionally operated as a managed service. iC Consult presents two offerings: integrating standard vendor IDaaS platforms (e.g., Okta, SailPoint) or delivering a fully managed “Service Layers” platform built on microservices, containers, Kubernetes, and automated “infrastructure/configuration as code,” with dedicated customer instances and regional hosting options.

• IAM must facilitate efficient authentic identity flow and protect the business from unauthorized access.
• There are nine major authentication protocols in use, with differing strengths, weaknesses, and compatibility.
• Some authentication protocols in common use are around thirty years old.
• IDaaS is delivered via cloud or SaaS systems and is typically managed on a subscription basis by third-party providers.
• IDaaS can be operated as a fully managed service, transferring security and maintenance responsibilities to the provider.
• iC Consult has provided IAM solutions for nearly 25 years.
• iC Consult has around 350 consultants with offices in German-speaking countries, the UK, the USA, China, and elsewhere.
• iC Consult’s standard IDaaS offering includes off-the-shelf platforms such as Okta and SailPoint, integrated into the client IT landscape.
• Service Layers is based on a combination of ForgeRock, Ping Identity, and One Identity solutions.
• Service Layers uses dedicated instances per customer, with no shared runtime components across customers.

• “Identity is central to the efficient and secure operation of digitally transformed businesses.”
• “Add the threat of unauthorized access and resulting cyber-attacks from bogus identities to the blend, it is apparent that IAM assumes a new frontline role in protecting the organization.”
• “IAM architectures should be underpinned by an Identity Fabric model.”
• “Managing is the operative word, and this can consume a lot of time when things do not work out.”
• “Increasingly, technology like the protocols at the heart of IAM platforms may prove too granular for fast moving organizations to think about.”
• “The adoption of Identity Fabrics is desirable if business and IT leaders are to enable access by everyone and everything to every service as required, with security and without latency.”
• “This requires, ideally, one single, integrated, and highly scalable IAM platform for current, emerging and future digital services.”
• “Consumers increasingly want to retain control over their identity by bringing their own identity (BYOI).”
• “IAM is shifting from an IT security-based exercise and a supporting function for the business to one that sits at its core and dynamically facilitates the flow of identities through the organization.”
• “IAM must evolve to become a background service akin to a utility that is easy to consume and flexible in supporting emerging business requirements.”