Identity and Access Management
Design authentication and authorisation with directory services, federation, MFA, and privileged access control.
- Certification
- CompTIA Security+
- Recommended study time
- 6h 35m
- Status
- Not started
Recommended study time
About 6h 35m in total, measured from the material on this page. At your session length of 45 minutes that is 9 sittings.
- Read the lesson21 min
About 2,784 words at a careful technical reading pace.
- Second pass with notes13 min
Re-read the harder parts and write your own notes.
- Recall from memory12 min
2 written recall questions.
- Practice decision12 min
One applied decision with feedback.
- Teach it back20 min
Write the topic in your own words.
- Real-world scenario15 min
Read the situation and justify your decision in writing.
- Hands-on practice3h 20m
Labs, commands and configuration until you can do it unaided.
- Spaced review1h 40m
4 short review sessions spread over the following weeks.
Learning objectives
- Distinguish authentication, authorisation, and accounting in real systems.
- Compare directory, federation, and SSO protocols and when each applies.
- Apply least privilege and privileged access controls to administrative accounts.
Start here
About 8 minutes of reading, in 10 short parts.
Identity and access management decides who is allowed to do what on a system, and it is one of the highest-value areas of security because so many real breaches come down to weak or misused access rather than exotic technical exploits. Getting the basics right, strong authentication and least privilege, closes off a huge share of real-world attack paths.
Where you meet it: An IT administrator sets up a new employee's account with access to exactly the systems their role requires, rather than copying an existing employee's account wholesale, which often carries years of accumulated excess permissions.
The lesson, part by part
Open one part at a time. Each part stands on its own, so you can stop and come back.
Think of a building with a front door, individual office keys, and a sign-in sheet. Authentication is proving you are who you say you are at the front door, usually with something like an ID badge. Authorisation is a separate question: even once you are inside the building, which specific offices does your key actually open? Just because you got through the front door does not mean every office should be unlocked for you.
Accounting is the sign-in sheet: a record of who entered, when, and which offices they visited, so that if something goes wrong later, there is a trail to follow. Together these three ideas, proving identity, granting appropriate access, and recording activity, form the backbone of how organisations control who can touch what.
Key ideas
If you remember nothing else from this topic, remember these.
- Identity and access management centres on ensuring the right individuals have the right access to the right resources at the right time, and no more.
- Multifactor authentication combines at least two independent factor categories, something you know, something you have, and something you are, making stolen credentials alone insufficient.
- The principle of least privilege grants users only the minimum access necessary to perform their role, reducing the damage possible from a compromised account.
- Role-based access control assigns permissions to roles rather than individuals, simplifying management as staff change positions or leave the organization.
- Single sign-on lets a user authenticate once and access multiple systems through federation protocols like SAML or OAuth, improving usability but concentrating risk on the identity provider.
- Regular access reviews and prompt deprovisioning of departing employees' accounts are essential because stale accounts are a common vector for later compromise.
Investigating an account with excessive lingering access
A worked example, step by step.
An internal audit flags that a former marketing employee's account was used to access the finance server three months after their departure.
- 01Confirm the account statusCheck the identity system and find the account was disabled in the general directory but not removed from the finance server's local access group.
- 02Review the access historyPull authentication logs and confirm the finance server access occurred using cached or synced credentials rather than a fresh interactive login through the disabled account.
- 03Assess least privilegeDiscover the marketing employee had been granted finance server access temporarily for a one-off project two years earlier and it was never revoked.
- 04Check role-based access control setupFind that access was granted directly to the individual account instead of through a project-specific role, making it easy to overlook during offboarding.
- 05Deprovision immediatelyRemove the account from the finance server's access group and confirm no further authentication is possible from that identity.
- 06Review MFA enforcementConfirm whether multifactor authentication was required for finance server access, and find it was not, which is corrected as part of the response.
- 07Redesign the access modelMigrate finance server access to a role-based group with defined membership criteria and an expiration date for temporary project access.
- 08Schedule recurring reviewsImplement a quarterly access review process so similar stale grants are caught automatically rather than discovered by chance during an audit.
Outcome: A direct, individually granted access right without an expiration date or role structure let a departed employee's credentials remain valid on a sensitive system for months, corrected through deprovisioning, role-based redesign, and recurring reviews.
Identity and access management concepts
Worth keeping at hand while you work.
- Something you know
- Password or PIN, one authentication factor category
- Something you have
- Hardware token or authenticator app, one authentication factor category
- Something you are
- Biometric such as fingerprint or facial recognition, one authentication factor category
- Multifactor authentication (MFA)
- Requires at least two independent factor categories
- Least privilege
- Granting only the minimum access required to perform a role
- Role-based access control (RBAC)
- Permissions assigned to roles, not individuals
- Discretionary access control (DAC)
- Resource owner decides who gets access
- Mandatory access control (MAC)
- Access decided by a central authority based on classification labels
- Single sign-on (SSO)
- One authentication grants access to multiple systems
- SAML
- XML-based protocol commonly used for enterprise SSO federation
- OAuth
- Authorization framework commonly used for delegated access between applications
- Deprovisioning
- Removing a departing user's access promptly and completely
- Access review
- Periodic audit confirming existing access is still appropriate
Common misunderstandings
What most beginners get wrong here.
Using a password and a security question together counts as multifactor authentication.
Both are something you know, so they are two pieces of the same factor category, not true multifactor authentication, which requires two different categories.
Single sign-on makes systems less secure because one login opens everything.
SSO can improve security overall by centralizing strong authentication and enabling consistent MFA enforcement, though it does concentrate risk on the identity provider, which must be protected accordingly.
Role-based access control means every employee in a department automatically gets the same access forever.
RBAC assigns permissions to defined roles, but role membership and the permissions tied to each role still require periodic review as responsibilities change.
Disabling an account in the main directory automatically removes all of its access everywhere.
Directory-level disabling does not guarantee removal of locally granted access on individual systems, which is why deprovisioning checklists must cover all systems separately.
Least privilege only matters for highly sensitive systems like finance or HR.
Least privilege reduces the blast radius of any compromised account on any system, since attackers often pivot from a low-value account to a higher-value target using excessive access.
Exam traps
How the question writers try to catch you out.
- Security+ frequently tests whether a described authentication combination truly qualifies as multifactor by checking if the factors come from different categories.
- Expect scenario questions distinguishing RBAC, DAC, and MAC based on who makes the access decision, the owner, a role definition, or a central classification authority.
- Deprovisioning questions test whether you recognize that offboarding must include all connected systems, not just the central directory.
- SSO questions may present the identity provider compromise as the key risk to explain, rather than dismissing SSO as universally insecure or universally safe.
- Least privilege scenario questions often describe an employee with access far beyond their job role and expect you to name least privilege as the violated principle.
Check yourself
Answer in your head first, then reveal. This is not scored.
Why does a password plus a security question not count as multifactor authentication?
What is the core difference between RBAC and DAC?
Why might disabling a directory account not fully remove a departed employee's access?
What principle is violated when an employee retains access far beyond what their role requires?
What is the main security risk introduced by single sign-on?
Why are periodic access reviews important even with well-designed RBAC?
Quick reference
A condensed summary of the lesson above, for revision.
What It Is
Authentication proves identity, authorisation determines permitted actions, and accounting records what happened. Directory services such as Active Directory and Entra ID hold identities and groups. Federation protocols including SAML and OpenID Connect allow one identity provider to authenticate users to many applications. MFA adds independent factors, and privileged access management restricts and records administrative use.
Why It Matters
Group sprawl, permanent admin rights, and unmanaged service accounts are the paths attackers use for lateral movement and escalation. Identity design is where an organisation either contains or amplifies a compromise.
How It Works
- An identity provider authenticates the user and issues a signed assertion or token to the application.
- Applications map claims or group membership to internal roles and permissions.
- Conditional policies evaluate device, location, and risk before issuing access.
Where You See It
- Corporate logins, SaaS access, VPN authentication, service accounts, and joiner-mover-leaver processes.
Key Terms
- SSO
- One authentication event granting access to multiple applications.
- SAML
- An XML-based federation protocol common in enterprise applications.
- OIDC
- An identity layer built on OAuth 2.0 used by modern applications.
- Conditional access
- Policy that evaluates risk signals before granting access.
- PAM
- Privileged access management with just-in-time elevation and session recording.
Examples
- A conditional access policy can require MFA for logins from unmanaged devices only.
- Separate administrative accounts prevent a phished daily-use account from holding domain rights.
Common Problems
- Permanent admin rights
- Orphaned accounts after leavers
- Group nesting sprawl
- Shared service credentials
- MFA fatigue attacks
How It Fails
- A stale privileged account with an unchanged password enables quiet persistence.
- Nested groups grant unintended access nobody can audit.
- Repeated push prompts eventually get approved by a tired user.
How to Troubleshoot
- Trace an access failure through identity provider logs before touching the application.
- Check effective permissions, not just direct group membership.
- Verify token lifetime and session revocation when access persists after a change.
Practical Knowledge
- Use number matching or phishing-resistant factors instead of simple push approval.
- Review privileged group membership on a schedule with a named owner.
Exam Coverage
- Authentication, authorisation, and accounting
- Directory, federation, and SSO protocols
- Privileged access and account lifecycle
Interview Questions
- Why should administrators use separate accounts?
- How does conditional access reduce risk without blocking everyone?
Watch and read
Verified official and reputable sources for this topic. Links open in a new tab.
Video training
Lesson notes and bookmark
Notes and bookmarks for this lesson, saved with everything else you have marked.
No notes on this item yet.
Learning progress
0% across six evidence areas. Reading alone does not change progress.
Prerequisites
Next steps
- 01List every account you hold with administrative rights and justify each.
- 02Read one SAML or OIDC sign-in flow end to end.