IAM Training in Chennai & Certification Course (72 Hours Master Program)

Authentication verifies the identity of a user (who you are), typically using credentials, MFA or biometrics. Authorization determines what an authenticated user is allowed to do, based on roles, attributes, or policies. Authentication comes first; authorization comes after.

RBAC (Role-Based Access Control) grants access based on a user’s role. ABAC (Attribute-Based Access Control) uses attributes of user, resource and environment. PBAC (Policy-Based Access Control) uses external policy rules to evaluate access. RBAC is simplest, ABAC is most flexible, PBAC is most auditable.

SAML 2.0 is an XML-based protocol for exchanging authentication and authorization data between an Identity Provider (IdP) and a Service Provider (SP). The user authenticates once with the IdP, receives a SAML assertion, and presents it to the SP to gain access without re-entering credentials.

OAuth 2.0 is an authorization framework that delegates access to resources using access tokens, with no notion of user identity. OpenID Connect (OIDC) is an identity layer built on top of OAuth 2.0 that adds ID tokens (JWTs) to verify user identity. Use OAuth 2.0 for API authorization; use OIDC for sign-in flows.

Least privilege means giving users only the access they need to do their job and nothing more. In Azure AD you implement it through Privileged Identity Management (PIM), Conditional Access, role assignments scoped to the smallest resource, and time-bound (just-in-time) elevation.

A federated identity is a portable identity that a user can use across multiple identity systems and organizations. It relies on trust between an IdP and an SP, typically using SAML or OIDC, so a user authenticated at the IdP is automatically trusted at the SP.

JIT provisioning creates a user account in a target system at the moment they authenticate, based on attributes sent in the SAML/OIDC assertion. It eliminates the need to manually create accounts and reduces stale-account risk.

Detect orphaned (inactive or ownerless) accounts via periodic attestation campaigns, disable them immediately, archive after 30 days, and delete after 90 days. SailPoint and Saviynt both automate this. Always revoke active sessions and rotate keys/tokens before deletion.

SCIM (System for Cross-domain Identity Management) is a standard REST + JSON API for provisioning and de-provisioning users. It lets an IdP push user lifecycle events to SaaS apps automatically, keeping identity in sync without custom code.

SSO is the user experience of authenticating once and accessing multiple systems. Federated identity is the technology that enables SSO across different trust domains. SSO is the goal; federation is the mechanism.

MFA factors fall into three categories: something you know (password, PIN), something you have (hardware token, phone, smart card), and something you are (fingerprint, face). FIDO2/WebAuthn hardware keys are considered strongest because they are phishing-resistant.

Start with named locations (IP allow/block list), define users and groups, target cloud apps, set conditions (device, risk, location), apply grant controls (require MFA, compliant device, hybrid Azure AD join), and enable session controls. Always test in report-only mode first.

Identity governance is the policy-driven management of user identities, access rights, and entitlements. SailPoint is a leading identity governance platform that automates provisioning, access reviews, certification campaigns, role mining, and separation-of-duties enforcement.

Active Directory Domain Services (AD DS) is the on-premises LDAP-based directory from Windows Server 2000. Azure AD (now Microsoft Entra ID) is a cloud-native identity service built on REST APIs and OAuth/OIDC/SAML. Modern workloads use Azure AD; legacy apps and Group Policy still rely on AD DS, often synced via Azure AD Connect.

A service principal is an identity for an application or service that needs to authenticate to Azure resources. A managed identity is a special type of system-assigned or user-assigned service principal whose lifecycle Azure manages automatically and whose credentials never appear in code.

Zero Trust assumes breach and verifies every request as if it originates from an untrusted network. IAM is the foundation: verify identity (strong MFA), validate device posture, enforce least privilege (PIM), and assume breach (continuous logging with Microsoft Sentinel).

A JWT (JSON Web Token) is a compact, URL-safe token format with three base64url-encoded parts: header (algorithm and token type), payload (claims about the user or token), and signature (HMAC or RSA signature over header and payload). Used widely in OAuth 2.0 and OIDC.

Pass-through authentication (PTA) lets users sign in to Azure AD by validating passwords directly against the on-premises AD DS controller through a PTA agent. Password hash sync (PHS) synchronizes the password hash from AD DS to Azure AD on a schedule. PTA is more secure; PHS is more resilient and supports more hybrid scenarios.

PAM is the discipline of controlling, monitoring, and auditing elevated (privileged) access. It includes just-in-time elevation, session recording, credential vaulting, and approval workflows. Microsoft PIM, CyberArk, and BeyondTrust are leading tools.

Use short-lived access tokens, refresh-token rotation with reuse detection, PKCE on public clients, sender-constrained tokens (DPoP or mTLS), and bind tokens to the device (token binding). Always require HTTPS and never store tokens in local storage for SPAs.

LDAP (Lightweight Directory Access Protocol) is a query protocol for reading and writing directory data. SAML is a federated authentication protocol that exchanges assertions between an IdP and SP. LDAP is for directory lookups; SAML is for sign-in.

A directory service is a centralized store of identity data (users, groups, devices, attributes). Active Directory, Azure AD, Okta, and OpenLDAP are examples. Directory services power authentication, group membership, and policy evaluation across the enterprise.

The IdP is the system that authenticates the user and issues tokens/assertions (Azure AD, Okta, Ping, Google Workspace). The SP is the application or service that relies on the IdP for authentication (Salesforce, ServiceNow, custom SaaS). In SSO, the user signs in once with the IdP and the SP trusts the assertion.

Run quarterly certification campaigns, target a small set of users/entitlements, send a notification to the resource owner to approve/revoke, automatically disable unused accounts, document the decision for audit, and re-attest on a fixed cadence.

Kerberos is a ticket-based authentication protocol used in Active Directory environments. The user authenticates to the Authentication Server (AS) and receives a Ticket-Granting Ticket (TGT). To access a service, the user presents the TGT to the Ticket-Granting Server (TGS) and receives a service ticket. Kerberos avoids sending passwords over the network.