Zero Trust: Identity and Access Management

This reference manual covers identity and access management (IAM) as it applies within a Zero Trust architecture: the terminology of identity, authentication, authorization, and accounting (IAAA); the authentication factors that make up multi-factor authentication (MFA); conditional access and least-privilege enforcement mechanisms such as just-in-time (JIT) and just-enough access (JEA); and the full IAM lifecycle from account creation through deprovisioning, including automated lifecycle workflows in the cloud.

This module builds the foundational vocabulary needed to reason about IAM in a Zero Trust context: what an identity actually is, how authentication, authorization, and accounting (IAAA) fit together, and how identity verification has evolved from legacy on-premises directory services to federated and cloud-native identity providers aligned with NIST SP 800-207.

Within identity and access management, identity is formally defined as a set of claims about a subject. A subject is any entity that may need to gain access to a resource — this could be a person/user, a device, an application, or an entire organization.