Identity and Access Management (IAM) is the framework of policies, processes, and technologies organizations use to create, verify, and govern digital identities – for people, devices, and services – and to control exactly what resources each identity may reach, and under what conditions.
Key takeaways
- IAM governs who and what can access resources, and under what conditions.
- Identity providers verify identities via LDAP, SAML, RADIUS, or certificates.
- IAM covers people, devices, and service accounts, not just human users.
- Zero Trust access decisions depend on IAM as their identity source of truth.
- Versa NGFW and ZTNA enforce policy against identities IAM verifies.
On this page: Why it mattersHow it worksTypesIAM & VersaFAQ
Why is IAM important?
Every access decision – a user opening an application, a device joining a network, a service calling an API – starts with “who or what is this, and what should it be allowed to do?” IAM answers that consistently across an organization instead of leaving each application to authenticate and authorize on its own, which is how credential sprawl and inconsistent policy enforcement creep in.
IAM matters more now because the perimeter that used to make identity secondary is gone. Users connect from anywhere and devices are not always corporate-owned. Compromised credentials are consistently among the leading causes of breaches, and Zero Trust architectures – which evaluate every connection rather than trusting network location – cannot function without a reliable identity source. IAM is that source: it turns “verify explicitly” into an enforceable, auditable control.
What is IAM?
IAM covers four connected functions. Identity lifecycle creates, updates, and retires digital identities as people join, change roles, or leave. Authentication verifies that an identity is who it claims to be, using passwords, certificates, or multi-factor challenges. Authorization determines what an authenticated identity may do, typically through role- or attribute-based policy. Administration and audit tracks entitlements over time so access can be reviewed and revoked.
These functions are delivered through protocols and providers. Lightweight Directory Access Protocol (LDAP) and Active Directory hold directory-based identities; RADIUS authenticates network and remote access; Security Assertion Markup Language (SAML), OAuth, and OpenID Connect federate identity across independent applications for single sign-on (SSO); and X.509 certificates establish identity for devices rather than people. An identity provider (IdP) – Microsoft Entra ID, Okta, or a directory server – is the system of record other services trust for these determinations.
Types of IAM
IAM is implemented through several coexisting approaches rather than one model. On-premises directory services, built on LDAP or Active Directory, remain common where identities and infrastructure are self-hosted. Cloud-based IAM (Identity-as-a-Service) – Okta, Microsoft Entra ID, Google IAM – delivers identity, SSO, and multi-factor authentication as a managed cloud service. Federated identity and SSO, using SAML or OAuth/OIDC, lets one set of credentials grant access across independently operated applications through a trust relationship rather than a shared directory. Certificate-based identity authenticates devices and machines using X.509 certificates instead of, or alongside, user credentials, which matters once policy must evaluate the device as well as the person.
IAM & Versa
Versa integrates with external IAM platforms through user and device authentication profiles configured in Concerto: LDAP and Active Directory, RADIUS, SAML (including Okta, Microsoft Entra ID, PingIdentity, and Office 365), the built-in Versa Directory, and certificate-based profiles – optionally combined for multi-factor authentication. These profiles feed rules that Versa SSE gateways, NGFW, and ZTNA evaluate before routing traffic to the internet or private applications, so access decisions rest on a verified identity and device posture rather than network location alone.
IAM also governs the Versa platform’s own access to infrastructure it provisions. When Versa VOS branch devices and vCSGs are deployed on AWS, a CMS connector authenticates using an AWS IAM policy or instance role, controlling what the connector may provision – a second, infrastructure-facing sense of IAM alongside the user-facing one.
Frequently asked questions
What is the difference between IAM and identity management (IdM)?
They largely overlap, but IdM commonly emphasizes creating and maintaining identities, while IAM explicitly folds in access control – deciding what a verified identity can reach, and under which conditions. Most vendors and analysts now use the two terms interchangeably in practice.
What is the difference between authentication and authorization?
Authentication verifies who or what an identity is, using credentials, certificates, or multi-factor challenges. Authorization is the separate decision, made only after authentication succeeds, about what that identity may do or access – sequential steps, not synonyms for one process.
What is federated identity?
Federated identity lets one identity provider’s credentials grant access across independently operated applications and services, through a trust relationship rather than a shared directory. SAML and OAuth/OpenID Connect carry this trust, and single sign-on is its most visible everyday result for users.
Does Versa provide its own IAM platform?
No. Versa integrates with an organization’s existing IAM platforms – LDAP, Active Directory, RADIUS, SAML identity providers, or certificates – through configurable authentication profiles, and also offers a built-in Versa Directory option for organizations without an external identity provider in place.
How does IAM support Zero Trust?
Zero Trust requires continuous, per-connection verification instead of implicit trust from network location, and that verification needs an authoritative source. IAM is that source: it supplies the verified identity and, with certificate profiles, the device posture Zero Trust engines evaluate on every request.
More on IAM
If you want to learn more, these are sources we trust.
| NIST: Identity and Access Management |
|---|
| NIST’s working definition of IAM, used across federal security guidance, control catalogs, and audit frameworks. |
Related terms
If you’re reading about IAM, these are worth looking at next.
| Zero Trust Network Access | Next-Generation Firewall | Cloud Access Security Broker |
|---|---|---|
| A security framework that grants per-application access based on continuous identity and device verification – IAM is its source of truth. | A firewall that applies policy by application and by user or group identity, relying on IAM to resolve who is generating the traffic. | A control point for cloud and SaaS access that uses identity to monitor and govern user activity such as uploads, downloads, and shares. |