Identity and access management is how organizations decide who gets to see what

Identity and access management (IAM) is a set of tools and rules that organizations use to confirm who you are, then decide what you're allowed to do once you're logged in. It answers two questions: "Are you really who you say you are?" and "What are you allowed to access?"

You use IAM systems every time you log into your work email, your bank account, or a hospital patient portal. The organization running that system is using IAM to make sure the person typing your password is actually you, and then to make sure you can only see your own information — not someone else's medical records or financial data.

IAM is not one piece of software. It's a combination of passwords, security questions, sometimes a code sent to your phone, and behind the scenes, a database that tracks who has permission to do what. The goal is to keep the right people in and the wrong people out, while making sure employees or authorized users can actually do their jobs.

Key Takeaways

  • IAM systems verify your identity (usually through a password or code) and then control what information or systems you can reach once you're logged in.
  • Most IAM systems now use multi-factor authentication, meaning you prove who you are in more than one way — like a password plus a code texted to your phone.
  • Your employer or the organization running the service decides what access level you get, and can change it if you move to a different role or leave.
  • IAM protects you by making sure strangers can't access your accounts, and protects the organization by making sure employees only see data they need for their job.

The two parts: proving who you are, then what you can do

IAM splits into two separate jobs. The first is authentication — proving you are who you claim to be. This is usually a password, but increasingly it's a password plus something else: a code from an app on your phone, a fingerprint, or a security key you plug in. The more ways you prove your identity, the harder it is for someone else to fake being you.

The second job is authorization — deciding what you're allowed to do once you're logged in. If you work in human resources, your IAM settings might let you see salary information and performance reviews. If you work in accounting, you might see budget data but not personnel files. A customer using a bank's website can see their own account but not anyone else's. The system enforces these boundaries automatically.

A weak IAM system might let you log in with just a password, and then let you see everything in the database. A strong one makes you prove your identity multiple ways and then limits you to only what you need. Most organizations are moving toward stronger systems because data breaches are expensive and the rules around protecting personal information keep getting stricter.

Why organizations use IAM instead of just passwords

Passwords alone are not enough. People reuse them, write them down, share them with coworkers, or use ones that are straightforward to guess. If someone gets your password, they can log in as you and see everything you can see. That's a problem if you work somewhere that handles medical records, financial data, or customer information.

IAM systems add layers. If you have to prove who you are in two or three different ways, a stolen password is not enough to break in. You also need the phone that receives the code, or the fingerprint, or the security key. An attacker would have to steal multiple things at once, which is much harder.

IAM also keeps a record of who logged in, when, and what they did. If something goes wrong — if data goes missing or someone accesses files they shouldn't — the organization can look back and see exactly who was logged in at that time. This record is often required by law for industries like healthcare, finance, and government.

What happens when you change jobs or leave

When you move to a new role at the same organization, your IAM access changes. Your manager or IT department updates your permissions so you can see what you need for the new job and lose access to what you don't. This usually happens within a day or two.

When you leave an organization, your access is supposed to be turned off when ready. In practice, this sometimes takes a few hours or even a day, which is why organizations have procedures to make sure it happens. If access doesn't get turned off, a former employee could theoretically log back in and see confidential information. That's a security risk and often a legal violation.

Some organizations use single sign-on (SSO), which means one login gets you into multiple systems at once. If your access is turned off in the main IAM system, you lose access to everything at the same time. If an organization doesn't use SSO, they have to turn off your access in each system separately, which is slower and more error-prone.

The difference between IAM and a password manager

A password manager stores your passwords and fills them in for you. IAM is what the organization on the other end uses to decide whether to let you in and what you can do once you're there. They work together but they're different things.

You might use a password manager like Bitwarden or 1Password to keep track of your passwords. That's your tool. The bank or employer you're logging into uses IAM to verify you and control your access. You can have the best password manager in the world, but if the organization's IAM system is weak, your account is still at risk.

What to watch for in your own accounts

When you set up an account somewhere — a bank, email, work system, or healthcare portal — look for options to turn on multi-factor authentication. This is usually in settings under "Security" or "Account Protection." If the organization offers it and you don't turn it on, you're relying on a password alone, which is weaker.

If you notice you can log into an account from anywhere without any extra verification, that's a sign the organization's IAM is basic. That's not necessarily a deal-breaker for low-risk accounts, but for anything that holds money or medical information, you want to see multi-factor authentication as an option.

If you leave a job, ask IT to confirm your access has been turned off. If you change your password somewhere and the system doesn't ask you to verify your identity in a second way, that's another sign the IAM could be stronger. None of this means the organization is doing something wrong — it just means you understand what level of protection you're getting.

Frequently Asked Questions

Is IAM the same as two-factor authentication?

No. Two-factor authentication is one part of IAM — it's the verification step. IAM also includes what happens after you log in: which files you can see, which systems you can use, and which actions you're allowed to take. Two-factor authentication is just the lock on the door. IAM is the lock plus the rules about what's behind it.

Can I see what access I have in my work account?

Usually yes. Most organizations let you log into a portal and see your own permissions, or you can ask your manager or IT department. If you're curious what data you can reach, it's reasonable to ask. You might be surprised how much access you have, or how little.

What does it mean if a website asks me to verify my identity before changing my password?

That's IAM working. The organization is making sure the person changing the password is actually you, not someone who got access to your account. They might send a code to your email or phone, or ask security questions. This extra step protects you from someone else locking you out of your own account.

Why do some organizations make me log in again after I've been inactive for a while?

That's an IAM security rule. If you leave your computer unlocked and walk away, the organization wants to make sure the next person who sits down has to prove they're you before they can access sensitive data. The timeout period varies — some organizations do it after 15 minutes, others after an hour.