Identity and Access Management (IAM)

Identity and Access Management (IAM)
👤 Read — Files Edit — Reports ✗ Admin — Denied IDENTITY & ACCESS ✓ Least-privilege roles ✓ SSO — one identity ✓ MFA enforced ✓ Access reviews quarterly ✗ Shared accounts ✗ Permanent admin rights

How identity lifecycle management, role-based access control, SSO and access reviews protect your organisation from over-privileged accounts.

Identity and Access Management (IAM)

IAM is the set of policies and technologies that controls who has access to what, and under what conditions. Your other security controls rest on it.

The IAM Core Concepts

IDENTITY Who are you? User, service, device, app AUTHENTICATION Prove you are who you claim to be Password + MFA AUTHORISATION What are you allowed to do? RBAC, permissions ACCESS Granted to approved resource Logged + audited AUDIT Who accessed what, when Forensics trail Authentication ≠  Authorisation — proving WHO you are doesn’t determine WHAT you can do

Role-Based Access Control (RBAC)

RBAC assigns permissions to roles, then assigns roles to users. This makes access management scalable and auditable.
Role Permissions Example Users
Finance Officer Read/write invoices, read customer data Finance team
Support Technician Read customer data, create/update jobs Helpdesk staff
Team Leader All technician permissions + assign jobs Senior staff
System Administrator Manage users, configure systems IT admins
Global Administrator Full control of everything Break-glass only, heavily audited
⛔ Important
Never assign Global Administrator as a default admin role. Even IT administrators should use standard accounts for day-to-day work and activate privileged roles through PIM only when a task requires it. An attacker holding a Global Admin account can delete your Microsoft 365 tenant, email, SharePoint and Azure resources included, in seconds.

The Joiners-Movers-Leavers Process

IAM must track employees throughout their lifecycle:
Event IAM Action Required
New starter (Joiner) Provision accounts with role-appropriate access only
Role change (Mover) Add new permissions and remove the old ones, so nothing accumulates
Resignation / Termination (Leaver) Disable all accounts on last day; revoke MFA; remove from groups
Long-term leave Suspend account; review on return
Contractor engagement Time-limited account with expiry date set at creation
⚠ Warning
Access accumulation (also called privilege creep) occurs when users accumulate permissions from previous roles that were never revoked. An employee who moved from Finance to IT three years ago may still have read access to payroll data. Run access reviews at least annually to catch this.

Single Sign-On (SSO)

SSO allows users to authenticate once and access multiple applications without re-entering credentials. Benefits:
  • Fewer passwords to manage and forget
  • Centralised enforcement of MFA and Conditional Access
  • Instant account deprovisioning. Disable the SSO account and every connected app loses access at once
✓ Key Point
Put as many applications as you can under your SSO provider, whether that is Entra ID, Okta or another. When an employee leaves, disabling one account revokes access to every connected application at once, so no forgotten app account stays live.

Mobile Techs IT Consulting

Who has access to what in your business?

If you can’t answer that quickly, or a former staff member’s account might still be active somewhere, your access management needs attention. Mobile Techs IT Service helps Gold Coast businesses take control: least-privilege roles and permission audits, SSO and MFA rollout across your apps, proper onboarding and offboarding processes, and regular access reviews that catch privilege creep before it becomes a breach. Home users welcome too, on-site or remote, anywhere in Australia.

Get your access under control Talk to us first

Call 1300 644 588  ·  office@mobiletechs.com.au
More on our managed IT services and remote security audit.

Business Continuity and Disaster Recovery
Business Continuity and Disaster Recovery
June 30, 2026
Email Authentication - SPF, DKIM, and DMARC
June 30, 2026
Email Authentication - SPF, DKIM, and DMARC