What does IAM stand for?

IAM stands for Identity and Access Management. It's the framework of policies and technologies for managing digital identities and controlling access to resources. It encompasses authentication, authorization, user lifecycle management, and governance. Examples of IAM tools include Okta, Entra ID, SailPoint, YeshID, and ConductorOne.

The SSO Tax is when SaaS vendors charge significantly more for SSO and SCIM features. For example, Salesforce Enterprise ($175/user/mo) vs Professional ($25/user/mo) represents a 700% price increase just to get SCIM provisioning. The term highlights how vendors gate basic security capabilities behind premium pricing tiers.

SCIM (System for Cross-domain Identity Management) is an open standard protocol for automating user provisioning and deprovisioning between identity providers and SaaS applications. It handles creating, updating, and deleting user accounts across multiple services automatically.

Identity
Glossary

Every abbreviation, acronym, and concept in identity & access management — explained in plain English.

Identity & Access Management Glossary

Protocols & Standards

SCIM (System for Cross-domain Identity Management): Open standard protocol (RFC 7644) for automating user provisioning and deprovisioning between identity providers and SaaS applications. Handles creating, updating, and deleting user accounts and group memberships across services.
SAML (Security Assertion Markup Language): XML-based open standard for exchanging authentication and authorization data between an identity provider (IdP) and a service provider (SP). Enables single sign-on (SSO) by passing identity assertions.
OAuth 2.0 (Open Authorization 2.0): Authorization framework that enables third-party applications to obtain limited access to a web service. Uses access tokens rather than credentials. The foundation for most modern API authentication.
OIDC (OpenID Connect): Authentication layer built on top of OAuth 2.0. Adds identity verification to OAuth's authorization, providing both who you are (authentication) and what you can access (authorization). Used by Google, Microsoft, and most modern IdPs.
FIDO2 (Fast IDentity Online 2.0): Authentication standard that enables passwordless login using biometrics, security keys, or device PINs. Includes WebAuthn (browser API) and CTAP (device communication). The technology behind passkeys.
LDAP (Lightweight Directory Access Protocol): Protocol for accessing and maintaining distributed directory information services. The backbone of Active Directory and most on-premises identity systems. Being replaced by cloud-native protocols.
CRUD (Create, Read, Update, Delete): The four basic operations for persistent data. In identity management, CRUD maps to SCIM provisioning actions: Create (onboard a new user), Read (query user attributes), Update (modify roles or profile data), and Delete (deprovision/deactivate an account). A vendor's SCIM implementation quality is often measured by which CRUD operations it supports.
RADIUS (Remote Authentication Dial-In User Service): Network protocol for centralized authentication, authorization, and accounting (AAA). Commonly used for VPN, Wi-Fi, and network access control.
Kerberos: Network authentication protocol using tickets to prove identity. The default authentication protocol in Active Directory environments. Uses a Key Distribution Center (KDC) and time-based tickets.

Identity Management

IdP (Identity Provider): Service that creates, maintains, and manages digital identities. Authenticates users and provides identity assertions to other applications. Examples: Okta, Entra ID, Google Workspace, JumpCloud.
IAM (Identity and Access Management): Framework of policies and technologies for managing digital identities and controlling access to resources. Encompasses authentication, authorization, user lifecycle management, and governance.
IGA (Identity Governance and Administration): Subset of IAM focused on governance: access reviews, certification campaigns, separation of duties, and compliance reporting. Examples: SailPoint, Saviynt, YeshID, ConductorOne.
SSO (Single Sign-On): Authentication method that lets users access multiple applications with one set of credentials. Login once, access everything. Implemented via SAML, OIDC, or proprietary protocols.
MFA (Multi-Factor Authentication): Security method requiring two or more verification factors: something you know (password), something you have (phone/key), or something you are (biometrics). Blocks 99.9% of automated attacks per Microsoft.
Directory: Centralized database of user identities, groups, and attributes. Active Directory (on-prem), Entra ID (cloud), Google Directory, and JumpCloud are common examples. The single source of truth for identity data.
Federation: Trust relationship between two or more identity domains that allows users authenticated in one domain to access resources in another. Enables cross-organization SSO without sharing credentials.
NHI (Non-Human Identity): Any identity that isn't a person: service accounts, API keys, bot tokens, machine identities, certificates. Average organization has 17 NHIs per human employee. A growing security blind spot.
CIAM (Customer Identity and Access Management): Authentication, registration, and consent management for customer-facing applications. Unlike workforce IAM (managing employees), CIAM handles external users at scale — login flows, social sign-in, progressive profiling, and privacy compliance. Examples: Auth0, ForgeRock.
JML (Joiner-Mover-Leaver): The three lifecycle events for employee identities: Joiner (onboarding — create accounts, grant access), Mover (role change — adjust permissions), Leaver (offboarding — revoke all access). Automating JML is the core of identity lifecycle management.

Access & Authorization

RBAC (Role-Based Access Control): Access control model where permissions are assigned to roles, and users are assigned to roles. Simplifies management but can lead to role explosion in complex organizations.
ABAC (Attribute-Based Access Control): Access control model using attributes (user department, location, device, time) to make authorization decisions. More flexible than RBAC but more complex to implement and audit.
PAM (Privileged Access Management): Controls and monitors access to critical systems by privileged users (admins, root accounts). Includes credential vaulting, session recording, and just-in-time access. Examples: CyberArk, Delinea, BeyondTrust.
JIT Access (Just-In-Time Access): Granting temporary, time-limited access only when needed rather than permanent standing privileges. Reduces attack surface by ensuring access expires automatically. Examples: Opal, ConductorOne, Britive.
Least Privilege: Security principle that users should have only the minimum access necessary to perform their job. Sounds simple, rarely implemented well. The gap between theory and practice is where breaches happen.
SoD (Separation of Duties): Security principle preventing a single person from having conflicting permissions (e.g., both creating and approving purchase orders). Critical for SOX compliance and financial controls.
Entitlement: A specific permission or access right granted to a user within an application. One user might have hundreds of entitlements across dozens of apps. Managing entitlements at scale is what IGA tools do.

Security Concepts

Zero Trust: Security model that assumes no user or device is trustworthy by default, even inside the network. Every access request must be verified: identity, device health, location, and behavior. ‘Never trust, always verify.’
ITDR (Identity Threat Detection and Response): Security capability focused on detecting identity-based attacks: credential stuffing, token theft, impossible travel, privilege escalation. The identity layer of XDR. Examples: Oort (acquired by Cisco), Rezonate.
CIEM (Cloud Infrastructure Entitlement Management): Manages and governs access permissions across cloud platforms (AWS, Azure, GCP). Discovers excessive permissions, enforces least privilege for cloud resources. Often bundled with CSPM.
Shadow IT: SaaS applications and cloud services used by employees without IT’s knowledge or approval. Average company has 3-4x more SaaS apps than IT knows about. YeshID discovers shadow IT through agentless scanning.
Credential Stuffing: Automated attack using leaked username/password pairs from data breaches to try logging into other services. Works because 65% of people reuse passwords across sites. MFA is the primary defense.
Passkeys: FIDO2-based passwordless credentials stored on your device. Use biometrics or device PIN instead of passwords. Phishing-resistant because they’re bound to specific domains. Supported by Apple, Google, and Microsoft.

Compliance & Governance

GRC (Governance, Risk & Compliance): Tools and processes for managing organizational governance, risk assessment, and regulatory compliance. In identity context: access certifications, audit evidence collection, policy enforcement. Examples: Vanta, Drata, AuditBoard.
SOC 2 (Service Organization Control Type 2): Audit framework evaluating a company’s controls for security, availability, processing integrity, confidentiality, and privacy. Type I = point-in-time; Type II = over a period (usually 12 months). Required by most enterprise buyers.
SOX (Sarbanes-Oxley Act): US federal law requiring public companies to maintain internal controls over financial reporting. Section 404 requires identity controls: access reviews, SoD enforcement, and change management. Penalties for non-compliance include prison time.
Access Review: Periodic process where managers verify their team members’ access is still appropriate. Required by SOC 2, SOX, HIPAA, and ISO 27001. Also called access certification. The bane of every manager’s existence.
Access Certification: Formal attestation that a user’s current access rights are appropriate for their role. Typically quarterly or semi-annual. Managers ‘certify’ or ‘revoke’ access. Synonymous with access review in most contexts.
ISO 27001: International standard for information security management systems (ISMS). Annex A controls include access control, cryptography, and supplier management. Increasingly required for European business and government contracts.

Business & Pricing

SSO Tax: When SaaS vendors charge significantly more for SSO and SCIM features that should arguably be standard security capabilities. Example: Salesforce Enterprise ($175/user/mo) vs Professional ($25/user/mo) — a 700% increase just to get SCIM. The term highlights how vendors gate basic security behind premium pricing.
Per-Seat Pricing: Licensing model charging per user/seat per month. Standard for most SaaS. Watch for: minimum seat counts, annual commitments, and ‘shelfware’ (paying for seats nobody uses). Negotiate at end-of-quarter for 15-25% discounts.
Identity Sprawl: The uncontrolled proliferation of user accounts, service accounts, API keys, and permissions across cloud services. The average employee has 30+ SaaS accounts, 40% of which are shadow IT. Creates security gaps, compliance risk, and wasted spend.
Vendor Lock-In: When switching identity providers becomes prohibitively expensive or complex due to deep integration, proprietary protocols, or data portability limitations. Okta, for example, makes migration difficult because apps are configured with Okta-specific SAML/OIDC metadata.
ELA (Enterprise License Agreement): Volume licensing deal covering multiple products at a discounted rate. Common with Microsoft (E3/E5), Okta (Workforce Identity bundles), and SailPoint. Negotiate at fiscal year-end for maximum discount.

Infrastructure

MDM (Mobile Device Management): Software for managing and securing employee devices: enforcing encryption, OS updates, remote wipe, and compliance policies. Apple-specific (Jamf, Mosyle, Kandji) or cross-platform (Intune, Omnissa, Fleet, Hexnode). Required for SOC 2 and zero-trust.
UEM (Unified Endpoint Management): Evolution of MDM that manages all endpoint types (laptops, phones, tablets, IoT) from a single console. Includes device management, app management, and security. Examples: Omnissa (ex-VMware), Intune, JumpCloud.
ITSM (IT Service Management): Practices and tools for delivering IT services: ticketing, change management, asset management. In identity context: access request workflows and approval routing. Examples: ServiceNow, Jira Service Management, Freshservice.
SaaS Management: Also called Spend Management. Tools for discovering, managing, and optimizing SaaS application usage and spend. Finds shadow IT, tracks licenses, and identifies waste. Examples: Productiv, Zylo, Torii, BetterCloud, YeshID.
CSPM (Cloud Security Posture Management): Monitors cloud infrastructure for misconfigurations and compliance violations across AWS, Azure, and GCP. Identity-adjacent because many cloud security issues stem from overly permissive IAM policies.
EDR (Endpoint Detection and Response): Security tools that monitor endpoints for threats, detect suspicious behavior, and enable incident response. Examples: CrowdStrike, SentinelOne, Microsoft Defender. Often paired with MDM for comprehensive device security.

STILL CONFUSED? WE GET IT.

YeshID simplifies identity governance so you don't need to memorize this glossary.
From $5/user/mo. Free for teams under 20.

Try YeshID → Join the Slack Community Email Jacob