Sana Ullah Khan
English

Roadmaps Security roadmaps Core domains

Identity and Access Management (IAM)

Make sure the right people, and only the right people and services, can reach the right things, for the right reasons.

Estimated time: 24–42 months · At about 10 hours a week.

  1. BeginnerAccounts, authentication and directories2–3 months
  2. IntermediateFederation, SSO and access automation4–6 months
  3. AdvancedPrivileged access, governance and cloud identity6–9 months
  4. ExpertIdentity architecture and strategy12–24 months

Overview

Identity and Access Management covers how people and machines prove who they are (authentication), what they are allowed to do (authorisation), and how access is granted, reviewed and removed over time (identity governance).

It includes directories such as Active Directory and Microsoft Entra ID, single sign-on with SAML and OpenID Connect, multi-factor authentication and passkeys, privileged access management, and the identities of services, APIs and AI agents.

Why it matters

Stolen credentials and abused permissions are behind a large share of breaches. Attackers increasingly log in rather than break in, so identity has become the main security boundary, especially in the cloud.

Typical job roles

  • EntryIAM analyst / identity administrator Handles accounts, groups, access requests and MFA issues.
  • Mid-levelIAM engineer Builds SSO integrations, automates joiner-mover-leaver processes and runs the identity platform.
  • Mid-levelPrivileged access (PAM) engineer Protects admin accounts, secrets and just-in-time access.
  • Mid-levelIdentity governance (IGA) specialist Runs access reviews, roles and segregation of duties.
  • SeniorSenior IAM engineer / identity architect Designs the identity architecture across cloud and on-premises.
  • LeadHead of identity / IAM programme lead Owns identity strategy, budget and the roadmap to zero trust.

Prerequisites

  • Basic IT administration: users, groups and permissions on Windows and Linux.
  • How the web works: HTTP, cookies, sessions and redirects.
  • Basic cryptography: hashing, public and private keys, certificates.
  • Some scripting in PowerShell or Python, for automation.

Foundations of computer science Cybersecurity

Learning path

  1. Beginner Accounts, authentication and directories 2–3 months

    Topics

    • Identification, authentication, authorisation
    • Passwords and hashing
    • Multi-factor authentication
    • Active Directory basics
    • Microsoft Entra ID basics
    • Groups and roles (RBAC)
    • Least privilege
    • Joiner-mover-leaver process

    Skills

    • Create and manage users, groups and policies in Active Directory and Entra ID.
    • Explain why SMS codes are weaker than authenticator apps, and why passkeys resist phishing.
    • Apply least privilege to a set of roles.

    Hands-on projects and labs

    • Build a Windows Server domain controller in a VM, join a Windows client, and set up group policies and a password policy.
    • Create a free Microsoft Entra ID tenant (with a Microsoft 365 developer or trial account) and turn on MFA for a test user.
    • Run Keycloak in a container and sign in to a sample app through it.

    Done when you can…

    • Explain the difference between authentication and authorisation with examples.
    • Set up MFA and a sensible password policy, and justify each setting against NIST SP 800-63.
    • Describe what should happen to accounts when someone joins, changes role and leaves.
  2. Intermediate Federation, SSO and access automation 4–6 months

    Topics

    • SAML 2.0
    • OAuth 2.0 and OpenID Connect
    • JSON Web Tokens
    • Conditional access
    • SCIM provisioning
    • Service accounts and API keys
    • Active Directory attack paths
    • Kerberos

    Skills

    • Integrate an application with SSO using SAML and OpenID Connect.
    • Read and validate a JWT, and spot common token mistakes.
    • Automate user provisioning and removal with SCIM or scripts.
    • Find and fix risky AD settings and attack paths.

    Hands-on projects and labs

    • Connect a sample web app to Keycloak with OpenID Connect, then to Entra ID with SAML, and compare the flows in your browser's developer tools.
    • Run BloodHound Community Edition and PingCastle against your own lab domain and fix the top findings.
    • Do the OAuth and JWT labs in the PortSwigger Web Security Academy.

    Done when you can…

    • Draw the OAuth 2.0 authorisation code flow with PKCE from memory and explain each step.
    • Show a lab domain where you removed the easiest attack paths to Domain Admin.
    • Automate a joiner-leaver process end to end in your lab.
  3. Advanced Privileged access, governance and cloud identity 6–9 months

    Topics

    • Privileged access management
    • Just-in-time and just-enough access
    • Identity governance and access reviews
    • Cloud IAM (AWS IAM, Azure RBAC, Google Cloud IAM)
    • Workload identity and federation
    • Secrets management
    • Identity threat detection and response (ITDR)
    • Passkeys and FIDO2 rollout

    Skills

    • Design tiered admin access with just-in-time elevation.
    • Write and review cloud IAM policies, and find over-privileged roles.
    • Replace long-lived secrets with workload identity federation.
    • Detect identity attacks: token theft, MFA fatigue, consent phishing.

    Hands-on projects and labs

    • Set up HashiCorp Vault to issue short-lived database credentials to an app in your lab.
    • In a free AWS account, replace an access key in a GitHub Actions workflow with OIDC federation.
    • Plan a passkey rollout for a fictional company, including recovery and lost devices.

    Done when you can…

    • Show a lab where no human has standing admin rights.
    • Review a set of cloud IAM policies and explain exactly what each one allows.
    • Write detections for three identity attack techniques from ATT&CK.
  4. Expert Identity architecture and strategy 12–24 months

    Topics

    • Enterprise identity architecture
    • Zero trust strategy
    • Customer identity (CIAM)
    • Decentralised identity and verifiable credentials
    • Identity for AI agents
    • Mergers and identity consolidation
    • Identity metrics and risk

    Skills

    • Design identity for a large organisation across employees, customers, partners and machines.
    • Lead a multi-year zero trust programme with identity at its centre.
    • Decide how AI agents and non-human identities get, use and lose access.

    Hands-on projects and labs

    • Write an identity reference architecture for a company with 10,000 employees, a customer app and several clouds.
    • Contribute to an open-source identity project, or write about a protocol topic in depth.

    Done when you can…

    • Present an identity strategy with risks, costs and milestones to leadership.
    • Explain how your design handles a stolen session token, a rogue admin and a compromised agent.

Tools and technologies

  • Keycloak Open source Open-source identity provider with SSO, OpenID Connect and SAML.
  • authentik Open source Open-source identity provider, popular in home labs.
  • FreeIPA Open source Identity, policy and audit for Linux environments.
  • OpenLDAP Open source Open-source LDAP directory server.
  • Microsoft Entra ID Commercial Microsoft's cloud identity service, used by most companies on Microsoft 365. Has a free tier.
  • Okta Developer Free Free developer account to practise SSO and OAuth integrations with Okta.
  • HashiCorp Vault Free community edition Secrets management and dynamic credentials.
  • BloodHound Community Edition Open source Maps Active Directory and Entra ID attack paths.
  • PingCastle Free Active Directory security health check.
  • OpenFGA Open source Fine-grained authorisation engine, based on Google's Zanzibar.
  • midPoint Open source Open-source identity governance and administration.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

  1. Entry Security+ CompTIACovers identity basics alongside everything else.Cost and exam details
  2. Intermediate Identity and Access Administrator Associate (SC-300) MicrosoftThe most useful certification for Entra ID work.
  3. Intermediate Certified Identity Professional (CIDPRO) IDProVendor-neutral identity certification from the identity professionals' association.
  4. Advanced AWS Certified Security – Specialty Amazon Web ServicesIf you work on AWS IAM.Cost and exam details
  5. Advanced CISSP ISC2For architects and identity leaders.Cost and exam details

Resources

Frameworks and standards

  • NIST SP 800-63-4 Digital Identity Guidelines Requirements for identity proofing, authentication (including passwords and MFA) and federation.
  • NIST SP 800-207 Zero Trust Architecture Defines zero trust: never trust a request because of where it comes from, check identity and context every time.
  • OAuth 2.0 (RFC 6749) The standard for delegated authorisation: letting an app act for a user without their password.
  • OpenID Connect The identity layer on top of OAuth 2.0 that most single sign-on uses.
  • FIDO2 and passkeys Standards for phishing-resistant, passwordless sign-in with security keys and passkeys.
  • NIST Cybersecurity Framework (CSF) 2.0 A common way to describe and improve an organisation's security, organised as Govern, Identify, Protect, Detect, Respond and Recover.
  • CIS Critical Security Controls A prioritised list of 18 practical defences, grouped so smaller organisations know what to do first.
  • ISO/IEC 27001 The international standard for an information security management system (ISMS), and the one organisations get certified against.
  • MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

  1. Service desk or IAM analyst0–2 years
  2. IAM engineer2–5 years
  3. Senior IAM, PAM or IGA engineer5–8 years
  4. Identity architect8+ years
  5. Head of identity or security architecture10+ years

Related domains to move into

  • Cloud Security Cloud security is mostly identity and permissions.
  • Application and Software Security Authentication and authorisation bugs are among the most serious in applications.
  • Secrets and Key Management Coming soon Machine identities and credentials.
  • AI Identity and Access Control Coming soon How AI agents get and use permissions.
  • Privacy and Identity Technologies Coming soon Decentralised identity and privacy-preserving credentials.

All security roadmaps Back to top

Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact