What is the difference between IAM technology and IAM processes?
IAM technology is the set of building blocks (standards, protocols, IT components); IAM processes are what an organisation builds and runs with those blocks to manage identities and access day to day.
IAM can be studied from two sides:
| IAM technology | IAM processes | |
|---|---|---|
| What it is | Building blocks: standards, protocols, IT components | Workflows assembled from those blocks |
| Typical vocabulary | OIDC, SAML, token, service provider (SP), identity provider (IdP), claims, trust | Data sources, life cycles, joiner/mover/leaver, approvals, provisioning |
| Key question | How does a login or an assertion work? | Who triggers what, when, with which data, and who is responsible? |
The two depend on each other. A perfectly configured SAML federation is useless if nobody creates the account when a person joins or removes it when they leave; and the best-designed joiner/mover/leaver process still needs a protocol to deliver the result to the applications. In practice most IAM failures (orphaned accounts, permission creep, onboarding delays) are process failures, not protocol failures, which is why the process side deserves its own attention.
Go deeper:
eCH-0107: design principles for IAM — the Swiss e-government standard that models an IAM landscape as stakeholders, actors, processes and information model, not just protocols (in German).