Identity is the new perimeter. According to Microsoft’s 2025 Digital Defense Report, over 99% of identity-based attacks are stopped by MFA alone. Yet in 2026, 43% of organizations still have significant populations of users without MFA enrolled. This guide covers the full identity and access management stack — from MFA basics to privileged access management and just-in-time access architecture.
Why Identity Is the Top Attack Vector
The shift to cloud, SaaS, and remote work eliminated the network perimeter. Attackers adapted by targeting identities directly: credential phishing, password spraying, MFA bypass via social engineering, and session token theft. The Verizon 2024 DBIR found credentials were involved in 77% of web application breaches. When attackers have a valid username and password, traditional network controls do nothing to stop them.
MFA: Implementation That Actually Works
Not all MFA is equal. SMS-based OTP codes are vulnerable to SIM swapping and real-time phishing. App-based TOTP (Google Authenticator, Authy) is better but still vulnerable to AiTM (Adversary-in-the-Middle) phishing proxies. The only MFA that fully resists modern phishing attacks is phishing-resistant MFA:
- FIDO2/WebAuthn hardware keys (YubiKey, Google Titan) — Bound to the relying party domain; cannot be used on phishing sites
- Windows Hello for Business — Certificate-based biometric authentication tied to device
- Passkeys — FIDO2-based credential synced across devices; phishing-resistant by design
Mandate phishing-resistant MFA for: all privileged accounts, all remote access, all SaaS applications handling sensitive data, and all financial transactions. Use app-based TOTP as minimum for standard user accounts where hardware keys are not yet deployed.
Warning: MFA fatigue attacks (bombing users with push notifications until they accidentally approve) defeated app-based MFA at Uber and Cisco in 2022. Enable number matching in Microsoft Authenticator and Duo — it requires users to type a number from the login screen into the app, blocking approval of unsolicited push notifications.
Single Sign-On Architecture
SSO centralizes authentication, reducing the attack surface from dozens of credential stores to one identity provider (IdP). More importantly, it enables centralized visibility: one place to see every application a user accesses, and one place to terminate access when they leave the organization. Without SSO, revoking access when an employee leaves requires manual action across every system — a process that consistently has gaps.
Leading enterprise IdPs: Microsoft Entra ID (formerly Azure AD) dominates Microsoft environments. Okta is the most popular for multi-cloud and SaaS-heavy organizations. JumpCloud is strong for smaller organizations. Google Workspace serves Google-centric environments. Evaluate on: application integration breadth, conditional access policy flexibility, and MFA options supported.
Privileged Access Management (PAM)
Privileged accounts — domain admins, local admins, service accounts, root access — are the crown jewels attackers target. PAM solutions protect them through four mechanisms:
- Credential vaulting: Privileged passwords stored encrypted in a vault, never known to users. Systems check out credentials for sessions and return them when done.
- Session recording: Every privileged session recorded for audit. Deters insider threats and provides forensic evidence post-incident.
- Just-in-time (JIT) access: Privilege granted for a specific duration and purpose, then automatically revoked. No standing admin accounts.
- Least privilege enforcement: Service accounts granted only the permissions required for their function. Domain admin used only from dedicated Privileged Access Workstations (PAWs).
Leading PAM platforms: CyberArk (most mature, highest cost), BeyondTrust (strong reporting), Delinea (formerly Centrify/Thycotic, mid-market sweet spot), and open-source Teleport (infrastructure access).
Implementing Least Privilege
Least privilege means every user, system, and application has only the minimum access required for its function — no more. In practice:
- Audit existing permissions quarterly with tools like Varonis, SailPoint, or Microsoft Entra ID Access Reviews
- Remove direct group memberships for privileged roles — use role-based access control (RBAC) with time-limited assignments
- Disable or delete accounts within 24 hours of employee departure
- Review service account permissions annually — most accumulate permissions over time as applications evolve
- Implement separation of duties for sensitive functions: the person who approves wire transfers should not be able to initiate them
Conditional Access Policies
Conditional access evaluates risk signals at authentication time and applies controls dynamically. Microsoft Entra ID and Okta both support conditional access. Key policies to implement:
- Require MFA for all users (baseline)
- Require compliant device for access to sensitive applications
- Block legacy authentication protocols (basic auth, NTLM for cloud apps) — they bypass MFA
- Require phishing-resistant MFA for privileged roles
- Block sign-ins from high-risk locations or flag for step-up authentication
- Impossible travel detection — block sign-ins that are geographically implausible
Identity Governance and Lifecycle Management
Identity governance connects HR systems to IT provisioning: when someone joins, changes roles, or leaves, their access should automatically reflect that change. Without governance, access accumulates: users retain permissions from previous roles, service accounts outlive their applications, and contractors have access months after their engagement ends. Implement automated provisioning and deprovisioning using SCIM with your IdP, and run quarterly access certification campaigns where managers review and recertify their team’s access.
Takeaway: Start with MFA enforcement and SSO consolidation — these two controls deliver the highest identity security ROI. Then layer in PAM for privileged accounts, conditional access for risk-adaptive authentication, and identity governance for lifecycle management. Identity is the first pillar of Zero Trust for good reason. See our Security Tools page for PAM and IdP platform comparisons.
🔗 Further Reading
Frequently Asked Questions
What is Identity and Access Management (IAM)?
Identity and Access Management (IAM) is the security discipline and set of technologies that ensure the right people and systems have the right access to the right resources at the right times, for the right reasons. IAM encompasses authentication (verifying who you are), authorization (determining what you can access), and governance (managing the lifecycle of identities and access rights). Core IAM components include identity providers, MFA, SSO, privileged access management, and access certification.
What is the difference between authentication and authorization?
Authentication answers “who are you?” — it verifies identity through credentials (password, MFA, biometrics, or certificate). Authorization answers “what can you do?” — it determines what resources and actions the authenticated identity is permitted to access. They are distinct processes: a valid authentication does not guarantee broad authorization. Least-privilege access control requires that authenticated identities are authorized only for the specific resources their role requires.
What is Just-in-Time (JIT) access?
Just-in-Time (JIT) access is a privileged access model where elevated permissions are granted only when needed, for a specific purpose and duration, and automatically revoked afterward. Instead of giving administrators standing domain admin rights they use daily, JIT requires them to request elevated access for a defined window (e.g., 1 hour to perform maintenance), use those privileges for the specific task, and have access automatically expire. JIT eliminates standing privilege that attackers can abuse indefinitely after account compromise.
What is Privileged Access Management (PAM)?
Privileged Access Management (PAM) is a security solution that controls, monitors, and audits privileged account access. PAM vaults privileged credentials (so no human knows the actual password), records privileged sessions for audit and forensics, enforces just-in-time access policies, and applies least-privilege controls to service accounts. Leading PAM platforms include CyberArk, BeyondTrust, Delinea, and open-source Teleport. PAM is a critical control in Zero Trust architecture and required by most compliance frameworks including ISO 27001 and SOC 2.
