Identity and Access Management has become one of the most important areas of cybersecurity. As organisations adopt cloud applications, hybrid infrastructure, remote work, privileged automation and AI agents, identity has become the new security perimeter.
IAM interviews therefore go beyond definitions. Employers want professionals who can explain authentication protocols, manage identity lifecycles, apply least privilege and respond to real access-control problems.
This guide covers 25 frequently asked IAM interview questions with practical answers—from foundational concepts to real-world scenarios.
IAM Fundamentals
1. What is Identity and Access Management?
Answer: Identity and Access Management is the combination of policies, processes and technologies used to ensure that the right identities receive the right access to the right resources at the right time—and for the right reason.
IAM manages digital identities throughout their lifecycle, including identity creation, authentication, access assignment, review, modification and removal. It applies to employees, contractors, partners, customers, applications, service accounts, workloads and AI agents.
2. What is the difference between identification, authentication and authorisation?
Answer:
- Identification is the act of claiming an identity, such as entering a username.
- Authentication verifies that the claimant is genuinely associated with that identity, such as through a password, passkey or security key.
- Authorisation determines what the authenticated identity is permitted to access or perform.
A simple way to remember the difference is: Who are you? Can you prove it? What are you allowed to do?
3. What is the principle of least privilege?
Answer: Least privilege means giving an identity only the minimum access required to complete an authorised task, for the minimum necessary period.
It reduces the potential impact of compromised accounts, insider threats, configuration errors and privilege misuse. Least privilege should be enforced through narrowly defined roles, limited scopes, time-bound access, regular reviews and removal of unused permissions.
4. What is the identity lifecycle?
Answer: The identity lifecycle describes how an identity and its access are managed from creation to deletion. For employees, it is commonly represented through the Joiner–Mover–Leaver process:
- Joiner: Create the identity and provide approved initial access.
- Mover: Modify access when the employee changes role, department or location.
- Leaver: Disable access, revoke active sessions and tokens, recover privileged credentials and remove unnecessary accounts.
Strong lifecycle management prevents orphaned accounts, delayed deprovisioning and privilege accumulation.
5. What is Single Sign-On?
Answer: Single Sign-On allows a user to authenticate once with a trusted identity provider and access multiple connected applications without entering credentials separately for each one.
SSO improves user experience and enables centralised enforcement of authentication policies. However, because the identity provider becomes a critical control point, it must be protected using strong authentication, Conditional Access, secure federation configuration and comprehensive monitoring.
6. What is identity federation?
Answer: Identity federation establishes trust between separately managed security domains. An identity provider authenticates the user and sends a trusted assertion or token to a relying application.
Federation allows users to access external or cloud applications without creating and managing a separate password in every system. Common federation technologies include SAML 2.0 and OpenID Connect.
7. What is multifactor authentication?
Answer: Multifactor authentication requires evidence from at least two different authentication factor categories:
- Something you know, such as a password or PIN
- Something you have, such as a security key or registered device
- Something you are, such as a biometric characteristic
MFA significantly improves security, but not every MFA method provides equal protection. NIST states that passwords and manually entered OTPs are not phishing-resistant. Cryptographic methods that bind authentication to the legitimate verifier provide stronger protection.
8. What is phishing-resistant authentication?
Answer: Phishing-resistant authentication prevents an attacker operating a fake login page from capturing or relaying a reusable authentication secret.
FIDO2 security keys and properly implemented passkeys use public-key cryptography and bind authentication to the legitimate service. This makes them stronger against credential phishing than passwords, SMS codes and manually entered one-time passwords.
IAM Protocols and Architecture
9. What is the difference between SAML, OAuth 2.0 and OpenID Connect?
Answer:
- SAML 2.0 is commonly used for enterprise federation and browser-based SSO. It uses XML assertions to communicate authentication and attribute information.
- OAuth 2.0 is an authorisation framework that allows an application to obtain limited access to a protected resource without receiving the user’s password.
- OpenID Connect is an identity layer built on OAuth 2.0. It adds authentication and provides an ID Token containing claims about the authenticated user.
A common interview mistake is calling OAuth an authentication protocol. OAuth primarily handles delegated authorisation; OpenID Connect adds the identity layer.
10. What is the difference between an access token, ID token and refresh token?
Answer:
- An access token is presented to a resource server or API and represents the permissions granted to the client.
- An ID token is intended for the client application and contains claims about the user’s authentication.
- A refresh token allows a client to request a new access token without asking the user to authenticate again.
ID tokens should not be used as substitutes for API access tokens. Tokens must be validated for issuer, audience, signature, expiry and other protocol-specific requirements.
11. What is SCIM and why is it important?
Answer: SCIM, or System for Cross-domain Identity Management, is an HTTP-based standard for provisioning and managing identity data across systems.
It can automate the creation, update and removal of users and groups in connected applications. SCIM helps organisations reduce manual provisioning, improve Joiner–Mover–Leaver processes and disable downstream access more consistently when a user leaves.
SCIM manages identity data and lifecycle operations; it does not replace authentication or application-level authorisation.
12. What is the difference between RBAC and ABAC?
Answer:
- Role-Based Access Control assigns permissions to roles and then assigns identities to those roles. It is easier to understand and audit when business responsibilities are clearly defined.
- Attribute-Based Access Control evaluates attributes relating to the identity, resource, action and environment. Examples include department, data classification, device compliance, location or time.
RBAC is usually simpler to operate, while ABAC can support more dynamic and granular decisions. Many mature IAM programmes combine both models.
13. What is the difference between Active Directory and Microsoft Entra ID?
Answer: Active Directory Domain Services is primarily an on-premises directory service. It commonly uses protocols such as Kerberos and LDAP and supports domain-joined systems, Group Policy and traditional Windows infrastructure.
Microsoft Entra ID is a cloud identity and access management service designed for cloud applications, Microsoft 365, SaaS access and modern authentication. It supports capabilities such as SAML, OAuth, OpenID Connect, Conditional Access, passwordless authentication, managed identities and identity governance.
The two technologies can work together in a hybrid identity environment, but Microsoft Entra ID is not simply Active Directory hosted in the cloud.
14. What is Conditional Access?
Answer: Conditional Access evaluates identity-driven signals and enforces access policies. A policy can consider factors such as the user, application, location, device state and detected risk.
Depending on the conditions, the system may allow access, block access or require controls such as MFA, a compliant device, an approved application or a stronger authentication method.
Conditional Access supports Zero Trust by helping organisations verify explicitly, apply least privilege and assume breach.
15. What is a workload identity?
Answer: A workload identity is a digital identity used by software, applications, services, containers, automation or other non-human workloads to access resources.
Examples include service principals and managed identities. Workload identities should be uniquely identifiable, assigned only necessary permissions, monitored for unusual activity and protected from long-lived secret exposure. Where possible, organisations should use managed identities, workload identity federation or short-lived credentials instead of embedded passwords and static API keys.
Identity Governance and Privileged Access
16. What is Identity Governance and Administration?
Answer: Identity Governance and Administration helps organisations control who should have access, who approved it, whether the access remains necessary and whether it violates policy.
IGA commonly includes access requests, approval workflows, entitlement management, lifecycle automation, access certification, role management, policy enforcement and separation-of-duties controls.
IAM enables access; identity governance ensures that access remains justified, reviewable and compliant.
17. What is an access review?
Answer: An access review is a periodic evaluation of an identity’s access to roles, groups, applications or privileged resources.
The reviewer decides whether access should be retained, modified or removed. Effective reviews involve the appropriate manager, resource owner or application owner and provide enough context to make a meaningful decision.
Access reviews are especially important for privileged accounts, external users, sensitive applications and permissions that do not have automatic expiry.
18. What is separation of duties?
Answer: Separation of duties prevents one person from controlling every stage of a sensitive process.
For example, the same employee should not be able to create a vendor, approve the vendor and release payment without independent oversight. IAM and governance tools can detect conflicting entitlements during access requests and periodic reviews.
Separation of duties reduces fraud, abuse and unintentional errors.
19. What is the difference between IAM and PAM?
Answer: IAM manages identities and access across the organisation. Privileged Access Management focuses specifically on accounts and sessions with elevated permissions.
PAM capabilities may include credential vaulting, password rotation, privileged session monitoring, command controls, approval workflows, endpoint privilege management and just-in-time access.
PAM complements IAM by applying stronger controls to high-impact privileges.
20. What are Just-in-Time and Just-Enough Access?
Answer:
- Just-in-Time access provides privileges only when required and automatically removes them after a defined period.
- Just-Enough Access limits the identity to only the specific commands, actions or resources needed for the approved task.
Used together, these controls reduce standing privilege and limit both the duration and scope of administrative access.
Real-World IAM Scenario Questions
21. An employee has left, but the account is still active. What would you do?
Answer: First, disable the primary identity and revoke active sessions, refresh tokens and remote access. Then identify linked accounts, privileged access, API credentials, application sessions, shared secrets and physical-access dependencies.
The incident should be assessed to determine whether the account was used after the employee’s departure. Relevant logs must be preserved, and the failure in the offboarding workflow should be investigated.
The long-term fix is to integrate the authoritative HR event with automated deprovisioning, define clear ownership and test the process regularly.
22. A user changes departments but retains old access. What is the risk and how would you fix it?
Answer: This is privilege accumulation, sometimes called access creep. It increases the attack surface and may create policy or separation-of-duties conflicts.
The user’s new role should be evaluated against the old entitlements. Access that is no longer required must be removed—not simply supplemented with new permissions. Automated mover workflows, birthright access rules, role mapping and post-transfer access reviews can prevent recurrence.
23. Users are approving unexpected MFA notifications. How would you respond?
Answer: Treat the event as a potential credential-compromise and MFA-fatigue attack.
Block or challenge the risky sign-in, revoke active sessions, reset compromised credentials, investigate source IPs and devices, and review subsequent account activity. Number matching and context can reduce accidental approvals, but the stronger long-term control is phishing-resistant authentication.
Users should also be trained to report unexpected prompts instead of approving them.
24. An application requests broad Microsoft Graph permissions. What would you check?
Answer: Determine whether the permissions are delegated or application permissions, because application permissions can allow the workload to act without a signed-in user.
Review the application’s business purpose, publisher, ownership, data requirements, requested scopes, consent requirements and whether narrower permissions are available. Test the integration in a controlled environment and document the approval.
After deployment, monitor the service principal, review its permissions regularly, remove unused credentials and rotate or replace long-lived secrets.
25. How would you securely provide an AI agent with access to business systems?
Answer: Treat the AI agent as a distinct non-human identity rather than allowing it to operate through a shared user account.
Give the agent a unique owner, defined purpose and minimum required permissions. Use short-lived tokens, separate read access from high-risk actions, require human approval for sensitive operations, record tool calls and outcomes, and provide an immediate way to revoke its access.
The design must also consider indirect prompt injection. An agent that reads untrusted emails, documents or webpages should not automatically be able to perform privileged actions based on instructions hidden in that content.
How to Answer IAM Interview Questions Effectively
A strong IAM interview answer should contain three elements:
- Explain the concept clearly.
- Describe the security or business risk.
- Connect it to a practical control or example.
For scenario questions, explain how you would contain the immediate risk, investigate the cause and improve the process so the issue does not happen again.
IAM is not only about creating accounts or resetting passwords. It is about continuously controlling trust across people, applications, privileged accounts, workloads and autonomous agents.
Build Practical IAM Skills with Wiseman CyberSec
Wiseman CyberSec’s IAM Foundation to Advanced Training helps professionals develop practical knowledge across:
- Active Directory
- Microsoft Entra ID
- Okta
- Delinea Privileged Access Management
- MFA, SSO and identity federation
- Identity lifecycle and access governance
- Interview preparation and career support
- Post-training and on-the-job mentorship
– Wiseman CyberSec
