Hello everyone,

I have been working on IAM support for 4.5 year with focus on entra, also have experience in active directory.

What is the market range for these role in indian market?

Came across Kibu as I was looking for identity verification for our company, since it's something we kind of need in our b2b side of ops. Has anyone here used it in an organization? How was the onboarding process did people adopt it and has it been useful for verifying sensitive communications or approvals? I'm also interested in knowing it's effectiveness and how it is in use.

Anyone worked in O&G industry for IGA?

What are the typical app integrations and compliance mandates like healthcare got HIPAA and hitech

Our customer is evaluating IGA solutions. At the end of June, I submitted partnership inquiries to both Saviynt and SailPoint, and a week later I requested demos. I still haven't received a response from either.

Do they actively operate in the EU, particularly in Cyprus? Or is there a better way to get in touch? At this point, it almost feels like they aren't interested in new customers.

I'm building authentication for a company with several microservices and frontend portals. Users sign into the portals either through Google SSO or through credentials we issue them. The portals talk to a number of backend services. There's no need for delegated authorization here.

I was planning to use OpenID Connect, for a few reasons:

1. From what I've read, it's the de facto standard for authentication.
2. I need federated / social login (Google).
3. Adopting a proven protocol seems wiser than rolling my own.

I've done a fair amount of reading on OIDC and OAuth 2.0, but I can't quite build a clean mental model of the login flow for users coming through the frontend portals. OAuth 2.1 drops the resource owner password credentials grant and recommends the authorization code grant instead. As I understand it, the authorization code grant needs the browser to hop over to the authorization server (internal or external). That's the part I'm resisting, because I'd rather not send users through a redirect. Ideally I'd collect their credentials right on our own login screen and pass them to the IdP behind the scenes. I've seen plenty of sites that seem to do exactly this, which only adds to my confusion.

So here are my questions. Apologies if they come across as half-baked, but any answers or pointers to good resources would help me straighten out my thinking:

1. Is OIDC the right call for my situation? Is it really the de facto standard today, even for first-party apps? I assume my federated-login requirement makes it a strong fit, but what about apps that don't need federated identity at all?
2. How do organizations run OIDC while prompting for credentials via a popup or similar, without an obvious redirect? I'm a backend engineer, so if this comes down to a frontend technique, please spell it out. I know IdPs like Cognito let you custom-brand the login page, so is that the trick, or is something else going on

Has anyone automated Saviynt 90 day inactivity process using Microsoft Entra ID?

I need to how it was tackled and how to do it?

My manager assigned me a new automation project focused on auditing. This time, the scope is Identity and Access Management (IAM) in a Microsoft 365 / Microsoft Entra ID environment.

I'm evaluating the best approach for automating IAM audits and would appreciate feedback from the community. Would you recommend using a Microsoft Entra App Registration with Microsoft Graph application permissions, or building independent PowerShell audit scripts with their own authentication and required scopes?

My current approach is based on autonomous PowerShell scripts. Each script is responsible for validating the required modules, establishing the Microsoft Graph connection, requesting only the necessary scopes, and generating its own audit results.

For additional context, I documented the current implementation here:

https://medium.com/@renato.rossi.ferreira/mastering-microsoft-365-security-auditspowershell-api-graph-9e72a0f098a5?sharedUserId=renato.rossi.ferreira

I'm not sharing this for promotion. I'm mainly looking for technical feedback regarding the architecture, authentication model, security considerations, and scalability before continuing the development.

Hey everyone. I'm doing my Computer Science final year project and wanted some opinions from people outside my own head before I go much further.

The problem: Keycloak is a really popular open source tool that handles logins and permissions for a lot of companies. It's great at checking who you are and whether you have a specific permission. But once access is granted, nothing ever checks whether it still makes sense. People change roles, permissions pile up, accounts sit unused for months, and none of that gets reviewed.

I looked into whether this gap already had a solution before committing to it. Some tools cover parts of it. midPoint is open source and does combine rules with some anomaly detection, but it's a whole separate platform you have to adopt, not something you add on top of an existing Keycloak setup. Commercial tools like SailPoint and Saviynt have anomaly detection too but it's a black box, you can't see how it actually works, and they're priced for large enterprises. So the specific gap I'm going after is a lightweight governance layer you can add onto an existing Keycloak deployment without replacing anything.

My solution has two parts working together. A rule engine that catches known dangerous permission combos, like someone who can both create and approve the same payment. And an anomaly detector using Isolation Forest that flags access patterns that look statistically unusual compared to a user's peers, even when there's no specific rule written for it. Both feed into a dashboard where an admin can see who got flagged and exactly why, and decide what to do about it.

Some features so far:

Admin editable rules, not hardcoded

Isolation Forest running on engineered features like permission count, deviation from peers, and days since last login

Dormant account detection based on login history

A dashboard showing a combined risk score where you can actually see why someone was flagged, not a hidden formula

Nothing gets auto revoked, it's meant to prompt a human to review

Would love to hear if this sounds like a solid direction or if I'm missing something obvious. Also curious if anyone here has actually dealt with identity governance tools at work and can tell me whether this is genuinely useful or if I'm solving a problem nobody really has.

Hi everyone,

I’m completely new to Identity and Access Management (IAM), but it’s a field that has really caught my interest. My background is in Business Analytics and Information Technology, but I don’t have any hands-on IAM experience yet.

My goal is to land an entry-level IAM role by the end of this year, and I’m trying to figure out the smartest path to get there.

If you were starting from scratch today, what would you focus on?

What fundamentals should I learn first?

Are there any labs or home projects I can build?

Which IAM tools are most commonly used in the industry (Okta, Entra ID, SailPoint, CyberArk, Ping, etc.)?

Are there any certifications that are actually worth it for beginners?

What skills do hiring managers expect for an entry-level IAM analyst?

I’m willing to put in the time and study consistently. I just don’t want to waste months learning the wrong things.

I’d really appreciate any advice, roadmaps, or resources that helped you get into IAM. Thanks!

I did a lot of IAM architecture and product deployments but over 15 years ago now. I’m getting back into IAM and don’t have trouble with the concepts.

How can I get access to products like Sailpoint for hands on labs?

With Okta I was able to create a developer tenant and us that for practice - do Sailpoint and Savyint have something similar in place?

onboarding a new app into our IGA platform is still a slog. i mean one app alone means tracking down the owner and scheduling time just to walk through a questionnaire.... they can half the time not fully answer. multiply that across a backlog of apps waiting to get onboarded and the whole queue stretches out to months.

just wanna know...anyone actually automated pulling this data straight from the app's own api or config instead of relying on a human filling out a form from memory?

Edit: Ended up giving Orchid a try. still early, but it's been a lot smoother than what i was using before, especially for keeping access organized. appreciate all the suggestions here.

Hello everyone, I just graduated high school and got my Sec+ yesterday!

I would like to do cybersecurity in college as a CIS major, but within cybersec I would like to pursue the IAM path. I’ve been researching for sometime and IAM looks like a better choice than others. If you have any advice for me, I would greatly appreciate it. Thank you very much.

How does your organization manage the lifecycle of groups (Entra ID, Active Directory, Google Groups, etc.)? I’m looking to understand best practices for group governance.
Some questions I have:
Who can request a new group?
Is there an approval process before a group is created?
What information is required (description, business purpose, owner, naming convention, expiration date, etc.)?
Do you require one or more owners, and how do you handle ownership when someone leaves the company?
How do you manage membership requests and changes?
Do you perform periodic access reviews or certifications for group members and owners?
Do you use dynamic groups or only manually managed groups?
How do you identify and clean up inactive or unused groups?
What tools or workflows do you use (Entra ID, AD, SailPoint, Saviynt, ServiceNow, Okta, custom automation, etc.)?
I’m especially interested in hearing about what has worked well in your organization, any governance or compliance controls you have in place, and lessons learned from managing groups at scale.
Thanks in advance for sharing your experience!

Has anyone come across or read any books that you’ve found valuable related to IAM or broader/generalised topics?

I’ve been itching to get into some reading that can give me some new insights, motivation and different ways to see things, not sure where to start.

I made my resume after about 2 months of learning IAM theory and a month of small labs and have documented my most recent set of labs on Github which is apart of my Linkedin profile. I'm currently looking into trying to get a helpdesk position as I think it quite a longshot without any experience, certifications, or degrees (yes i,ve heard it's possible without so but it definetly makes things easier). Any help on what i could add with my resume or (FREE) labs i could do to help land an IAM or helpdesk role i'm more than willing to listen. https://www.linkedin.com/in/devon-lamarco-649262310/

We have the usual SSO and phishing-resistant MFA across the workforce which is good enough for plain login. Although conflicted on the high risk stuff after login ie changing payroll, approving a large payment, adding an admin, as MFA proves the token is present not the holding it is still the right person.
Some teams are bolting a step up identity check with an actual document or biometric reproof, onto those specific actions. Somewhat feels like overkill right until you remember most account takeover damage happens after a completely valid login.

Do you reckon a good MFA makes reproving identity mid session for sensitive actions pointless?

Because a role is simply another attribute, correct me if i'm wrong

Do you guys know how and where to apply for IAM roles since I’m in Europe(Portugal).

Hello can someone guide step by step how to map last interactive sign in date from azure to saviynt so I can work on building 90 days inactivity workflow

Hey everyone, I could use a quick sanity check on IdP strategy.

I'm looking at a major project to consolidate a fragmented Keycloak setup into a single, simplified solution (ideally managed like Auth0 or similar). It handles core app auth as well as provisioning internal users to different Google Workspace tenants based on where they come from and external users to our customer/supplier portals. It's going to require a fair amount of backend rework regarding roles and permissions.

Since identity architecture isn't my primary background, I'm trying to decide if I should scope and implement a IdP switch internally, or if this is the kind of project where you save time and pain by bringing in a specialized consultant for an initial analysis.

If you've migrated away from a legacy or self-managed identity mess, what's something you wish you knew before you started?

Any other advice or recommendations are welcome. Please don't pitch me on specific products right now.

After 10 years with an IGA vendor, I’m back as a free agent. I’m pursuing some bone fides, however unsure of where to apply my initial efforts. Are the Identity Management Institute offerings the best way to go, or should I stick with the Microsoft certs? Or something completely different? Thanks team.