Updated this quarter
Last updated:
These are the 50 most common IAM interview questions asked at TCS, Cognizant, Wipro, HCL, Capgemini, PayPal, and Standard Chartered in 2026. We have grouped them into 5 sections: fundamentals, Azure AD/Okta, SailPoint, certifications, and scenario-based questions. Practice all of them out loud before your next interview.
Fundamentals (Q1–Q10)
Q1. What is the difference between authentication and authorization? Q2. Explain RBAC vs ABAC vs PBAC. Q3. What is the principle of least privilege? Q4. What is a federated identity? Q5. What is just-in-time (JIT) provisioning? Q6. What is the difference between SSO and federated identity? Q7. What is SCIM and why is it important? Q8. What is a directory service? Q9. What is an identity provider (IdP) vs a service provider (SP)? Q10. What is a Kerberos authentication flow?
Azure AD / Okta (Q11–Q20)
Q11. What is the difference between Azure AD and on-prem Active Directory? Q12. What is a service principal vs a managed identity? Q13. How do you design an Azure AD Conditional Access policy? Q14. What is pass-through authentication vs password hash sync? Q15. What is Azure AD Privileged Identity Management (PIM)? Q16. How do you prevent token theft in OAuth? Q17. What is the difference between LDAP and SAML? Q18. What is MFA and which factor is strongest? Q19. What is a JWT and what are its parts? Q20. How do you design a Zero Trust architecture in Azure AD?
SailPoint (Q21–Q30)
Q21. What is SailPoint IdentityIQ vs IdentityNow? Q22. What is the Identity Cube? Q23. What is the difference between birthright and request-based provisioning? Q24. What is role mining? Q25. What is an access certification campaign? Q26. What is separation of duties (SoD)? Q27. How do you handle joiner-mover-leaver (JML) processes? Q28. What is a refresh task in SailPoint? Q29. How do you write a workflow rule in IdentityIQ? Q30. What is the role of IdentityAI?
Certifications (Q31–Q40)
Q31. What is the Microsoft SC-300 certification? Q32. What topics does SC-300 cover? Q33. What is the Okta Certified Professional exam like? Q34. What is the SailPoint IdentityNow certification? Q35. How long is the (ISC)² CC exam? Q36. How do you prepare for SC-300 in 30 days? Q37. What is the passing score for SC-300? Q38. What is the cost of each IAM cert? Q39. Which cert should I take first — SC-300 or Okta? Q40. How do I maintain my SC-300 certification?
Scenario-Based (Q41–Q50)
Q41. A user is locked out of all SaaS apps because of a SailPoint provisioning failure. How do you troubleshoot? Q42. An employee has left but still has access to GitHub. What do you do? Q43. The Okta dashboard is slow for users in Mumbai. How do you diagnose? Q44. A Conditional Access policy is blocking legitimate users. Walk me through your debug steps. Q45. Your SailPoint certification campaign is showing 90% approval in 2 hours. Is this a problem? Q46. How do you handle a contractor who needs access for 30 days only? Q47. A new app does not support SCIM. How do you onboard it? Q48. Your SC-300 exam failed by 5 points. What next? Q49. You discover an orphaned admin account in production. Walk me through your incident response. Q50. A CISO asks for a quarterly access review. Build me a 30-day plan.
Talk to a Counsellor
SkilBrill's IAM training in Chennai (16 weeks) and IAM training online (live, all-India) prepare you for all 50 questions plus 3 real capstones. Talk to a counsellor at +91 8610964691.
Ready to start? Call +91 8610964691, WhatsApp us, or enrol online. Visit us at No 22, 200 Feet Radial Road, Thoraipakkam, Chennai 600097.
