What are the "practical reasons" for introducing IAM, and why do they reinforce each other?
Comfort and usability through single sign-on, cost savings through central administration, and fewer accounts per person: they all come from managing one identity centrally instead of many separately.
Without central IAM, every application keeps its own user list. A person then has a dozen accounts and passwords, each created, changed and (hopefully) deleted by a different administrator. Central IAM replaces this with one identity used everywhere:
- Comfort and usability: with single sign-on (SSO), the user logs in once and reaches all connected applications. Fewer password prompts, fewer forgotten passwords, fewer help-desk calls.
- Cost savings through central administration: an account is created, changed and removed in one place, ideally automatically. Password resets, one of the most frequent help-desk requests, drop sharply.
- Fewer accounts per person: each extra account is an extra password to forget or reuse and an extra place where access can be forgotten when the person leaves.
The three reinforce each other: fewer accounts make SSO possible, SSO reduces support cost, and central administration keeps the number of accounts low. They also improve security as a side effect, because a single, well-protected login with strong authentication beats twelve weak ones.
Go deeper:
Single sign-on (Wikipedia) โ benefits, risks and the protocols that implement SSO.