Identity is a primary security boundary in modern environments. Employees, contractors, administrators, applications and automated services all use identities to access information. Weak identity lifecycle processes can leave organisations exposed even when network and endpoint controls are strong.
Identity lifecycle
Joiner, mover and leaver processes should connect HR or sponsor approval to account creation, role changes and timely deactivation. Access should have an owner, business purpose and review date. Shared accounts reduce accountability and should be replaced with named identities or managed service identities wherever feasible.
Authentication and MFA
Use unique passwords, password managers and multi-factor authentication. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for privileged and high-risk access when supported. Conditional access can evaluate sign-in risk, device compliance and application sensitivity. Provide secure recovery processes so account recovery does not become the weakest link.
Privileged access management
Separate daily-use and administrative identities. Grant elevated access just in time and for limited duration where possible. Protect emergency accounts, monitor their use and test recovery access. Service accounts should have only required permissions, managed secrets and documented owners; avoid embedding credentials in scripts or configuration files.
Access reviews and governance
Review high-risk groups, external users, application consent, mailbox delegation and privileged roles on a defined schedule. Remove dormant accounts and permissions. Log changes to roles, authentication methods and recovery details. Exceptions should be approved, time-bound and revalidated.
Detection signals
Investigate repeated failed logins, unfamiliar device registrations, unexpected MFA changes, suspicious consent grants, impossible travel alerts and unusual privilege elevation. Correlate identity events with endpoint and network telemetry to understand the full sequence.
- Confirm the control has a named owner and documented business purpose.
- Validate configuration against current vendor guidance and organisational policy.
- Test expected and denied access paths; retain evidence of the result.
- Monitor exceptions, failures and configuration changes.
- Review the control after material infrastructure or business changes.
Strong IAM combines accurate lifecycle processes, phishing-resistant authentication, least privilege, privileged access controls and meaningful audit trails.