What does the typical IAM situation in a model company look like, and what is the task of IAM processes in it?
Many business areas with different requirements, many people, many IT and OT applications, several IT departments, plus cloud and IoT: IAM processes must make access work securely and economically across this distributed, complex landscape.
* IAM sits in the middle of every business area and every kind of actor, inside and outside the company. *
Picture an ordinary manufacturing company. Purchasing works with suppliers along a supply chain, production runs machines and wind turbines, logistics stores and ships goods, sales works with sales partners and customers, and administration and management hold it all together. Each area has its own applications and its own idea of who should see what.
Four things make IAM hard here:
- Many people act: employees, but also suppliers, partners and customers.
- Many applications: classic IT applications and OT (operational technology) systems that control physical plant.
- Distribution: often several IT departments, each with its own tools and habits.
- Even more distribution: cloud services and IoT devices, which live outside the company network altogether.
The task of IAM processes is therefore not "install an IAM product". It is to make access functional, secure and economical across exactly this mess: the right people and components get the right access, in time, at acceptable cost, and nobody keeps access they should no longer have.
Go deeper:
Identity and access management (Wikipedia) — how enterprise IAM extends from employees to partners, customers and devices.