The five IAM domains

Five conversations that sound like one

Sara spends her first month at a regional bank’s security team sitting in on meetings, and she notices something odd. In one meeting “IAM” means the sign-in page and MFA. In the next it means the quarterly access reviews the auditors want. In a third it means the vault where the database admins check out passwords. Product uses it for the sign-up flow of the mobile app, and the SOC uses it for alerts about strange sign-ins at night. Everyone says “IAM”, and they’re talking about five different things.

They are, and the industry has names for them. The previous articles mentioned access management, IGA, PAM, CIAM and ITDR several times, almost always in passing. This one opens them up one by one, for a practical reason: the market is organized this way. A job ad for an “IAM engineer” usually means one or two of these domains, not all five. A consultant scopes a project in these terms. And a tool that calls itself a “Gartner Leader” always means in a particular quadrant. Without this split you end up in crossed conversations, talking about MFA when the real problem is certification, or about privileged accounts when what’s needed is fraud detection. Each domain answers different questions, with its own tools, its own vocabulary and often its own team. Working out which domain a conversation is in, before you answer, saves a lot of credibility.

A building makes a handy picture. Access management is the guards at the main entrance, who check credentials and let people in. IGA is the office that keeps the list of who may come in and checks that the list is right. PAM is the specialist guards on the restricted floors, the server rooms and plant rooms, with their own rules. CIAM is the reception desk for visitors and customers. And ITDR is the cameras and sensors that watch everyone in real time and raise the alarm when something looks wrong.

flowchart TB
  accTitle: Map of the five IAM domains
  accDescr: Identity is the central hub with directed edges to five child domains: Access Management, Identity Governance, Privileged Access, Customer IAM, and Identity Threat Detection.
  ID([Identity])
  AM[Access Management<br/>The front door]
  IGA[Identity Governance<br/>The guardian]
  PAM[Privileged Access<br/>The safe]
  CIAM[Customer IAM<br/>The customer-facing layer]
  ITDR[Identity Threat<br/>The sentinel]
  ID --> AM
  ID --> IGA
  ID --> PAM
  ID --> CIAM
  ID --> ITDR

They aren’t five products for the same problem; they’re five different questions about the same subject. Access management asks whether you are who you say you are and whether you can come in. IGA asks whether you have the right access, today and over time. PAM asks who touched what with elevated privileges. CIAM asks how to give access to millions of people without ruining their experience. And ITDR asks whether anyone is behaving oddly in the identity layer right now.

Access management: the front door

Access management, AM, answers the most basic question: can this identity come in? When you open your banking app, type your username and password, get asked for a second factor and you’re in, that’s AM. It’s the face of IAM that every user sees every day.

Its core is four capabilities. Authentication checks the identity with one or more factors, a password, a one-time code, a passkey, a fingerprint. Single sign-on lets one authentication open many related applications. Federation trusts another organization’s identity provider, usually over SAML or OIDC, to authenticate outside users. And session management decides how long a session lasts, when it expires and how it’s revoked. AM applies to every identity that authenticates, human or machine: employees signing into the ERP, customers opening the mobile app, microservices calling internal APIs. If there’s a sign-in, AM is there.

David, an accountant at a mid-sized company, arrives on Monday at eight. He opens Microsoft 365 on his company laptop, and the company’s identity provider, Microsoft Entra ID, asks for his password and then for a push approval on his phone. Over the next ninety minutes he opens Salesforce, SAP and an internal BI dashboard without signing in again, because they’re all connected to the same identity provider through single sign-on. At half past five he signs out, and the session is ended in every application at once. One authentication at the start, a session that holds, and a coordinated sign-out: that’s AM working as it should.

The big names are Microsoft with Entra ID, formerly Azure AD, dominant wherever Microsoft 365 already is; Okta, with Workforce Identity Cloud, the long-standing vendor-neutral leader; Ping Identity, with PingOne and PingFederate, strong in large, heavily regulated companies, which bought ForgeRock in 2023; and Auth0, aimed at developers and bought by Okta in 2021.

AM produces the events that ITDR uses to spot anomalies. The identity provider is also where IGA’s lifecycle changes show up: a new employee, an account created, the ability to sign in. And the line with CIAM is blurry, because technically CIAM does AM too, for a customer audience at a different scale. When someone says “we’re going to deploy Okta”, they usually mean an AM project, but Okta also sells governance features, which confuses people. The useful question is “which problem are we solving first?”. If it’s “get everyone signing in with MFA”, that’s AM. If it’s “find out who has access to what”, that’s IGA.

IGA: the guardian

Where AM cares about the authentication of the moment, identity governance and administration, IGA, cares about access over time. Its question is: does the right identity have the right access today, and do we take it away the day it’s no longer needed?

It does six things. Lifecycle management automates joiners, movers and leavers, the JML cycle. Access requests offer a catalog where people ask for access through an approval workflow. Access certification periodically reviews what has been granted, with managers or application owners deciding whether it’s still valid. Role management groups permissions into business roles so they can be handled at scale. Separation of duties catches toxic combinations, such as “create a supplier” plus “approve a payment” in SAP. And audit and reporting produce evidence auditors accept for SOX, HIPAA, PCI DSS and the like. IGA was built for the workforce, employees, contractors and partners, in places where HR triggers the lifecycle and managers approve access. It has started to stretch to non-human identities in recent years, but its heart is still the workforce.

Sara joins a regional bank as a credit analyst. HR creates her record in Workday on Tuesday. That night the bank’s IGA platform, SailPoint, picks up the event and starts its workflows: it creates her Active Directory account and gives her the “credit analyst” role, which automatically grants the scoring application, the CRM and the intranet. On Wednesday morning everything works from the first click, with no tickets and no waiting. Three months later Sara is promoted to senior analyst, a role that can approve loans up to a certain amount. The change sets off a separation-of-duties alert, because the new role plus a permission left over from the old one would let her create and approve the same operation. The system holds the change until her manager removes the leftover permission, and Sara gets her new role clean. A year later she resigns. HR closes her record, IGA sees her status change to “terminated” and removes everything in cascade: her directory account, her roles, her open sessions, with a note to IT. In under thirty minutes she can’t sign into anything at the bank. That’s IGA at its best, invisible when it works and ruthless when it needs to be.

SailPoint, with IdentityIQ and Identity Security Cloud, is the historical leader. Saviynt was born in the cloud and is strong in SaaS-first companies. Omada is strong in Europe and known for being simple. One Identity sells an integrated suite. And Microsoft offers governance inside its own stack with Entra ID Governance. To follow the market, there’s Gartner Peer Insights for IGA, the annual Gartner Magic Quadrant, the KuppingerCole Leadership Compass and the Forrester Wave.

IGA is the source of truth for who should have access to what, so it connects to AM, which applies that access at sign-in, and to PAM, which takes the elevated identities and puts them under tighter control. With ITDR the line is interesting: IGA catches toxic combinations that sit still, while ITDR catches strange behavior as it happens. The most expensive mistake in IGA projects is underestimating role design. With badly designed roles, an expensive governance tool turns into a machine for approving everything in bulk, the very thing it was bought to stop. An IGA program succeeds over years, not months, and depends more on business analysts than on technology.

PAM: the safe

Privileged access management, PAM, deals with a critical subset: accounts with elevated privileges. Linux root, Windows domain admins, the AWS root account, database administrators, service accounts with broad permissions. These are different because losing one means losing the whole organization, so they get controls far stronger than anything else. PAM’s question is how do I control, watch and audit every use of a privileged credential?

It does five things. A credential vault stores admin passwords encrypted, so nobody knows them by heart and they’re checked out and back in on demand. Automatic rotation changes privileged passwords after each use or on a schedule. Privileged session management sends admin sessions through a proxy that records the screen and keystrokes for later investigation. Just-in-time access grants privileges only when they’re needed, for as short a time as possible, and takes them away automatically. And endpoint privilege management removes local admin rights from users and elevates specific commands instead of the whole session. PAM covers every identity with privileges, human or not: system administrators, obviously, but also service accounts running batch jobs, certificates that sign software releases, API tokens with admin rights in the cloud and AI agents with broad scopes.

Daniel is a platform engineer at a fintech and needs to get into the production Kubernetes cluster to investigate an incident. He doesn’t have a permanent kubectl-admin account. Instead he opens the PAM portal, CyberArk in this case, and asks for just-in-time access with a reason, “investigating incident INC-4521”. His manager approves it four minutes later. PAM issues temporary credentials valid for sixty minutes, Daniel connects, and the whole session is recorded. He finds the problem, fixes it and closes the session. When the sixty minutes are up the credentials expire, PAM closes the ticket and the recording stays available for audit. If an attacker had used Daniel’s personal credentials instead, they would have needed a human approval, couldn’t have stayed indefinitely, and everything they did would have been recorded. Those three controls shrink the possible damage enormously.

CyberArk is the historical leader, sometimes called the Microsoft of PAM. BeyondTrust is strong in endpoint privilege management. Delinea came out of the merger of Thycotic and Centrify. HashiCorp Vault, open source, is strong in DevOps and in secrets for non-human identities. And One Identity offers Safeguard alongside its governance suite.

PAM overlaps heavily with IGA in governing privileged accounts: who should have admin access, and who certifies it? It overlaps with AM in stronger authentication, with specific MFA for admins. And it overlaps with ITDR in watching privileged sessions for strange behavior; an admin who suddenly exports a whole database at three in the morning should set off alarms.

CIAM: the face customers see

Customer IAM, CIAM, is identity for an outside audience: customers, prospects and subscribers. Workforce IAM measures success in efficiency and compliance; CIAM measures it in conversion, retention and experience. Every extra step in a sign-up flow loses a share of users, and every failed sign-in dents satisfaction. The economics are harsh and very different from the world of employees. CIAM’s question is how do I give millions of outside users secure access without spoiling their experience?

That takes a broad set of capabilities. Self-registration, where users create their own account, confirm their email or phone and fill in their profile bit by bit. Authentication designed for the experience: passkeys, social sign-in, magic links and phone biometrics. Identity proofing and KYC, checking that the person is real with a document, a selfie and a liveness check, which is regulated in banking and online gambling. Consent management that is granular, revocable and auditable under the GDPR, the CCPA or the LGPD. Progressive profiling, asking for the minimum at sign-up and more as the relationship grows. Fraud detection against account takeover, credential stuffing, bots, SIM swapping and phishing. And an identity that follows the customer across the web, the mobile app, kiosks and phone support. Any digital business with outside customers needs it, banking, retail, streaming, telecoms, government, healthcare and gaming, and scale matters: an app with 10,000 users can get by with a generic identity provider, but one with 10 million needs real CIAM.

Picture the team designing the sign-up for a new online shop. Every choice touches conversion. Email and password, or just an email with a magic link? They pick the magic link to cut friction. Verify the email before the first purchase? No, only before the first order over 50 dollars. Ask for an ID and a photo on day one? No, only when someone tries to send money to another user. Allow sign-in with Apple and Google? Yes, so they don’t lose the people who hate creating accounts. Make MFA mandatory? Only for sensitive actions, changing the password, adding a card, an order over 200 dollars. Every decision is a negotiation between security and conversion, and the team measures each cohort: “the magic-link flow converts 14% better than the password flow, but creates 2% more duplicate accounts.” That kind of measurement never happens in a workforce project, and it’s the essence of CIAM.

Okta’s Customer Identity Cloud, built on Auth0, leads on developer experience. Microsoft Entra External ID is the successor to Azure AD B2C. Ping Identity’s PingOne for Customers is strong in regulated companies. Transmit Security focuses on passwordless sign-in and fraud. And Curity’s Identity Server does OIDC and OAuth at a professional level.

CIAM technically does everything AM does, sign-in, MFA and single sign-on, but with the opposite priority, experience over control. It overlaps strongly with ITDR in fraud detection, though the threats are different from the workforce side: mass account takeover and bots rather than privilege escalation. That’s also why the same vendor can sell two products. Okta Workforce Identity Cloud is built for employees and Auth0 for customers, and using the first for a customer app gives customers an employee-grade experience, which kills conversion.

ITDR: the sentinel

Identity threat detection and response, ITDR, is the newest domain, named by Gartner around 2022. Its job is to watch the other four in real time, detect threats and respond automatically, much as EDR does for endpoints. Its question is is anyone behaving suspiciously in my identity layer right now?

It does four things. It finds exposure, hidden attack paths such as forged Kerberos golden tickets, Kerberoasting paths, hidden admins and accounts with inflated permissions. It detects in real time, running analytics and machine learning over identity events to catch what fixed rules miss. It responds, revoking sessions, disabling accounts, forcing a fresh sign-in and alerting the SOC. And it supports the investigation, letting you rebuild afterwards which identity did what and when. ITDR covers every identity it watches, especially the riskier ones, administrators, service accounts and federated identities. It cuts across everything; it doesn’t protect one group, it watches the whole layer.

At 2:14 in the morning, a fintech’s ITDR, Microsoft Defender for Identity, sees three signals within thirty seconds. An admin account, admin_db_prod, signs in from a country it has never appeared in. The same account starts a huge query against the customers table. And that admin’s manager is being MFA-bombed, fifteen push notifications in a minute. The engine ties the three together into one high-severity alert and acts on its own: it revokes the admin_db_prod session, locks the account until someone looks at it, cancels the pending pushes to the manager, opens a SOC ticket with a detailed timeline and texts the CISO. At 2:18, four minutes later, the SOC has enough context to confirm a real intrusion attempt. The containment is already done, and what’s left is the investigation and closing the original way in. Without ITDR, those three events would have sat in separate logs, the database’s, the identity provider’s and the MFA provider’s, for someone to connect the next day, far too late.

Microsoft Defender for Identity is strong wherever Active Directory and Entra ID are. CrowdStrike Falcon Identity Protection has grown fast since 2022. Silverfort works without agents and covers legacy systems. Semperis specializes in Active Directory. And Quest, with One Identity, is a veteran of AD monitoring. Forrester published its first Wave for the category in 2024, and Gartner’s ITDR definition dates from 2022.

ITDR is cross-cutting by definition. It takes signals from AM (authentication events), from PAM (privileged sessions), from IGA (suspicious changes in access) and from CIAM (fraud attempts). In SOC terms, it’s a specialist layer between the IAM world and general detection.

How the five fit together

A few confusions come up again and again. “AM and IGA are the same thing”: no, AM authenticates in the moment and IGA governs over time; AM says “you may come in”, IGA says “you should be able to come in”. “PAM is part of IGA”: in concept, yes, but PAM has operational capabilities, the vault, session recording, just-in-time access, that IGA doesn’t, and in practice they’re different products. “CIAM is just workforce IAM with another label”: they share protocols, but their priorities are opposite, and mixing them up leads to bad designs. “ITDR is just a SIEM with another label”: a SIEM takes in every log, while ITDR specializes in the identity layer and knows its context, Active Directory, Kerberos, OIDC, golden tickets.

A frequent consulting question is which domain to fund first on a limited budget. A practical guide by maturity:

CIAM sits apart because it runs in parallel rather than in sequence. A consumer business needs CIAM from the start, however mature it is in the other four. Mixing workforce and customer identity in one platform, a common pattern in fast-growing startups, usually ends in an expensive migration a few years later.

Five domains on an ordinary Friday

Follow a Friday afternoon at a regional fintech with 800 employees and 1.2 million customers. In under two hours, all five domains act.

sequenceDiagram
  accTitle: Five IAM domains interacting on an ordinary Friday
  accDescr: A manager and five domain participants exchange messages between 14:00 and 15:42, showing how IGA, AM, PAM, CIAM, and ITDR work together during an access approval, a Black Friday sign-in surge, a just-in-time request, and a sign-in from an unusual country.
  actor M as Manager
  participant IGA as IGA
  participant AM as AM
  participant PAM as PAM
  participant CIAM as CIAM
  participant ITDR as ITDR
  M->>IGA: 14:00 approves senior access for Sara
  IGA->>AM: 14:01 syncs the new role
  CIAM->>CIAM: 14:32 200k customers sign in (Black Friday)
  CIAM->>ITDR: 14:33 3k credential-stuffing attempts
  ITDR->>CIAM: 14:33 turn on CAPTCHA and rate limit
  PAM->>PAM: 15:10 Daniel asks for JIT to the K8s cluster
  PAM->>M: 15:10 asks for approval
  M->>PAM: 15:14 approves
  PAM->>AM: 15:14 issues temporary credentials
  ITDR->>ITDR: 15:42 admin signs in from a new country
  ITDR->>AM: 15:42 revokes the session
  ITDR->>M: 15:42 alerts the SOC

At 14:00 a manager approves Sara’s promotion, and IGA carries out the change and pushes the new role to AM, which now lets her into systems she couldn’t reach before. At 14:32 a Black Friday campaign starts and 200,000 customers try to sign in at once, CIAM working at scale. A minute later, 3,000 of those attempts turn out to be credential stuffing, attackers trying leaked passwords; ITDR recognizes the pattern and asks CIAM to switch on CAPTCHA and rate limiting. Real customers notice 200 milliseconds of extra friction; the bots stay out. At 15:10 Daniel asks for just-in-time access to the Kubernetes cluster, PAM handles the approval and issues temporary credentials, and AM accepts them for sixty minutes. At 15:42 ITDR sees a database admin sign in from an unusual country and, without waiting for a person, revokes the session through AM and alerts the SOC.

Five domains, five events, one identity layer, each with its own logic, priorities and timing. No single platform would cover all of that well, and that’s why there are five domains.

Recap

The five domains are the five questions an organization serious about identity has to answer at the same time. AM: who is signing in right now? IGA: who should have access to what, over time? PAM: who is using elevated privileges, and under what controls? CIAM: how do I let millions of customers in without hurting conversion? ITDR: is anyone misbehaving in my identity layer? An organization that only asks one or two of them has big gaps. But trying to solve all five at once is also a common mistake, because there’s never enough budget, people or executive attention. Maturity is a matter of order, and knowing that order makes you useful in any IAM conversation, which is roughly what Sara worked out after her first month of meetings.

To keep track of who leads each domain, the industry reads four sources. The Gartner Magic Quadrant is an annual report per domain that places vendors as leaders, visionaries, challengers or niche players; it’s paid, but leading vendors usually hand it out free on request. Gartner Peer Insights collects verified reviews from real users and is free with registration. The KuppingerCole Leadership Compass is an independent European analysis, partly free. And the Forrester Wave is the main alternative to Gartner, paid but often shared by vendors. When a vendor says “we’re a Gartner Leader”, ask for the report and its date. Being a leader in 2021 doesn’t mean being one in 2024, and the quadrants move more than people think, especially in young categories like ITDR.

Three questions to test yourself

1. A retailer with physical stores and a mobile app hires you to “modernize IAM”. It has 600 employees and 2 million customers. In what order would you tackle the five domains, and why?
2. Someone tells you “we already have IGA, we don’t need PAM, because IGA governs our privileged accounts.” What’s your answer, in under a minute?
3. Your CISO asks “what concrete problem does ITDR solve that our SIEM doesn’t?”. Which three examples would you give?