Identity and Access Management

Identity is the new perimeter: most breaches involve stolen or misused credentials. This roadmap covers authentication, federation, authorization, privileged access and identity threat detection. Basic IT and web knowledge is enough to start.

• Know how you sign in to work and cloud services today
• Set up a free identity provider tenant for practice
• Plan your study time

• CyberA4U Academy — courses

Identity management covers who a user or workload is (identity), how they prove it (authentication), and what they may do (authorization), across the whole account lifecycle.

• Explain identities, credentials and assurance levels
• Describe NIST SP 800-63 concepts
• Distinguish human and workload identities

الأدوات والتقنيات: IAM

• NIST SP 800-63-4 — Digital Identity Guidelines

Factors are something you know, have or are. Their strength differs a lot: passwords and SMS are weaker than hardware keys and passkeys.

• Compare authentication factors
• Understand NIST authenticator assurance levels
• Choose factors for different risk levels

الأدوات والتقنيات: IAM

• NIST SP 800-63B-4 — Authentication and Authenticator Management

MFA blocks most account takeovers, but some methods can still be phished. FIDO2/passkeys resist phishing because they're bound to the real site.

• Explain why phishing-resistant MFA matters
• Understand MFA fatigue and relay attacks at a high level
• Plan a passkey or security-key rollout

الأدوات والتقنيات: IAM

• FIDO Alliance — Passkeys

Single sign-on lets users sign in once with a trusted identity provider using standards such as SAML and OpenID Connect.

• Explain identity providers and service providers
• Compare SAML and OIDC
• Understand the security benefits and risks of SSO

الأدوات والتقنيات: IAM

• OASIS — SAML 2.0 Technical Overview

OAuth 2.0 delegates access to APIs; OpenID Connect adds sign-in on top. Understanding flows, tokens and scopes prevents common mistakes.

• Explain authorization code flow with PKCE
• Distinguish access, refresh and ID tokens
• Validate tokens correctly

الأدوات والتقنيات: IAM

• RFC 6749 — The OAuth 2.0 Authorization Framework
• OpenID Connect Core 1.0

Authorization decides what an authenticated identity may do. RBAC, ABAC and relationship-based models suit different needs.

• Compare RBAC and ABAC
• Apply least privilege
• Avoid role explosion

الأدوات والتقنيات: IAM

• NIST SP 800-162 — Guide to Attribute Based Access Control

Admin accounts are the most valuable targets. PAM limits, monitors and protects privileged access with separate accounts, just-in-time elevation and secure workstations.

• Separate admin and user accounts
• Use just-in-time privileged access
• Monitor privileged sessions

الأدوات والتقنيات: IAM

• Microsoft — Privileged access strategy

Joiner-mover-leaver processes keep access correct as people change roles or leave. Automation (e.g. SCIM provisioning) reduces orphaned accounts.

• Automate provisioning and deprovisioning
• Handle role changes
• Find and remove orphaned accounts

الأدوات والتقنيات: IAM

• RFC 7644 — SCIM Protocol

Identity attacks show up in sign-in and directory logs: password spraying, impossible travel, token theft and suspicious privilege changes.

• Recognize common identity attack patterns
• Use identity protection signals
• Write detections for risky changes

الأدوات والتقنيات: IAM

• What is Microsoft Entra ID Protection?

Emergency access accounts let you recover when normal sign-in fails, but must be tightly protected and monitored.

• Create and protect break-glass accounts
• Exclude them carefully from policies
• Alert on every use

الأدوات والتقنيات: IAM

• Microsoft Entra — Manage emergency access accounts

Regular access reviews confirm that people still need the access they have; logs show how access is actually used.

• Run periodic access reviews
• Review privileged role assignments
• Use audit logs to verify usage

الأدوات والتقنيات: IAM

• Microsoft Entra — What are access reviews?

Zero standing privilege means no one holds admin rights permanently; they request time-limited elevation when needed.

• Understand just-in-time and just-enough access
• Configure time-bound role activation
• Measure standing privilege

الأدوات والتقنيات: IAM

• Microsoft Entra Privileged Identity Management

Bring it together: one identity provider, phishing-resistant MFA, SSO for apps, automated lifecycle, least privilege and monitoring.

• Design an end-to-end IAM architecture
• Prioritize improvements
• Document standards

الأدوات والتقنيات: IAM

• CISA — Zero Trust Maturity Model

Check that you can design strong authentication, sound authorization and protected privileged access.

• Choose authenticators by risk
• Design SSO and lifecycle processes
• Protect and monitor privileged access

• CyberA4U CTF Arena — practice challenges

You can now design and secure identity systems. Continue with Zero Trust, Azure Security or Detection Engineering.

• Keep your test tenant
• Choose your next roadmap
• Share an IAM design

• CyberA4U CTF Arena — practice challenges