Start here
Identity and Access Management Explained
A plain-language overview of how organizations decide who can reach which systems, from creating accounts to granting, reviewing and removing access.
Running IT
Identity and Access
Who can sign in to what, and how access is granted and reviewed.
Authentication Versus Authorization
Authentication proves who you are; authorization decides what you may do. Learn the difference with everyday examples and why mixing them up causes problems.
How Multi-Factor Sign-In Works
See why requiring a second proof of identity adds protection, which kinds of factors exist, and the practical limits and trade-offs of each approach.
Managing Shared and Service Accounts
Shared and service accounts are not tied to one person, which creates accountability and security risks. Learn practical ways to inventory, limit and control them.
Onboarding and Offboarding Accounts Safely
A practical look at joiner, mover and leaver steps for user accounts, so new staff get the right access quickly and departing staff lose it completely.
Role-Based Access Control in Plain Language
Role-based access control grants permissions by job role instead of by individual. Learn how it works, how to design roles, and the pitfalls to avoid.
Running an Access Review
Learn how to run a periodic access review: define scope, gather permission lists, ask reviewers the right questions, record decisions and follow through.
Single Sign-On for Everyday Users
Single sign-on lets one sign-in unlock many applications. See how it works in everyday terms, what it improves, and the trade-offs organizations should weigh.
The Principle of Least Privilege
Least privilege means giving people and systems only the access their work needs. Learn why it limits damage from mistakes and attacks, and how to apply it.
Related topics
More in running it
Cybersecurity Basics Everyday security habits for passwords, networks and online life. IT Operations Help desks, service management and keeping track of equipment. Governance and Policy Oversight, risk, written policies and training for staff. Projects and Vendors Delivering IT projects and working with outside partners. Incident Response Preparing for, handling and learning from security incidents. Privacy and Data Protection Handling personal and sensitive information responsibly.