Why do applications need organisational data from IAM, and what kind of data is meant?

Applications need to know where a person sits in the organisation (department, cost centre, manager, location, function) to decide access, route approvals and fill in forms; IAM delivers these "org data" together with the identity.

Many applications do more than check "is this person allowed in?". An expense tool must know who the person's manager is to route approvals; an ERP system needs the cost centre; a document system grants access by department; a time-tracking tool needs the location for public holidays. Without IAM, every application would have to collect and maintain these data itself, and they would soon be inconsistent and outdated.

IAM solves this by attaching organisational information to the identity (OrgDaten zu Person) and passing it to the applications, typically as attributes in a token or assertion, or through provisioning. The data usually originate in authoritative sources such as the HR system or the organisational chart, and IAM processes keep them current when someone changes department. This is also the basis for attribute-based access decisions: the better the org data, the more access can be granted automatically by rule instead of by manual request.

Go deeper:

• Human resource management system (Wikipedia) — the typical authoritative source of organisational data about employees.