You do not need to read every standard before understanding IAM. Follow this short route, then explore the areas that match your work. Each step builds on the last.
01 — Learn the vocabulary
Begin with What is IAM?. Then distinguish identities, accounts, and credentials and compare authentication and authorization.
You should be able to explain: why a successful sign-in is only part of managing access.
02 — Describe the identity
Read a basic identity model and sources, attributes, and correlation.
Try it: sketch a person with two accounts, one affiliation, and a time-limited access assignment. Mark which system owns each fact.
03 — Connect the components
Explore the components of an IAM architecture and a workforce reference architecture.
Try it: draw a runtime sign-in flow separately from an administrative account-creation flow.
04 — Follow the lifecycle
Read joiner, mover, leaver, then sessions, tokens, and revocation.
You should be able to explain: why an account-disablement event does not necessarily end all active access immediately.
05 — Choose the right integration
Use a map of IAM standards and federation and provisioning.
Try it: identify which mechanism handles application sign-in and which mechanism handles account removal.
06 — Apply the ideas
Walk through onboarding an employee and giving a workload access to an API. Compare how ownership, authentication, and revocation differ.
Next: use the capability map to connect these technical building blocks to an operating IAM program.
07 — Govern and limit privilege
Read identity governance, roles, groups, and entitlements, and privileged access management. Then see how just-in-time access reduces standing privilege.
Try it: pick one administrative role and describe how it would be requested, activated, logged, and removed.
08 — Secure the runtime
Study JWT and token validation and authorization in APIs. Continue with policy engines when rules outgrow application code.
You should be able to explain: why a valid token for the right user can still be the wrong token for a request.
09 — Prepare for things going wrong
Read emergency access, identity threat detection, and responding to identity incidents. Walk through offboarding a leaver urgently.
Try it: list every place a compromised account could still have access after its password is reset.
Go deeper
Choose the branch that matches your work:
- Customer identity: customer IAM and identity assurance levels.
- Workloads and automation: non-human identities and deploying from CI/CD without stored secrets.
- OAuth and OpenID Connect: grant types and clients, authorization server endpoints, token claims, DPoP, and threats and mitigations. Then apply them in authorizing a payment with PAR, RAR, and DPoP.
- Web and mobile applications: backend for frontend, native and mobile apps, and cookies and sessions.
- Authorization design: access control models compared and API gateway policies.
- Other protocols: Shared Signals and LDAP and Kerberos.
- AI agents: connecting an AI agent to a protected API.
- Running the program: measuring an IAM program, partner access, and the product landscape.
Keep a working glossary
Return to the IAM glossary whenever an abbreviation gets in the way. Understanding the relationship between terms matters more than memorizing them.