Identity and Access Management
The Identity and Access Management domain tests how users prove who they are and what they can reach. Questions cover directory integration, SSO, SAML and OIDC, MFA, conditional access, RBAC, group design, provisioning, password and certificate authentication, and session policy. The exam focuses on the chain: identity source, authentication, authorization, and audit.
Core rules
- Separate authentication from authorization. Authentication proves identity; authorization decides resource access through roles, groups, and policy.
- Federate with SAML 2.0 or OIDC for SaaS SSO. Map attributes and groups deliberately; an IdP-initiated flow and an SP-initiated flow can behave differently.
- Use MFA and conditional access for risk signals: user, device compliance, location, app sensitivity. Avoid broad exclusions that become permanent.
- Automate lifecycle with SCIM or directory sync. Joiner, mover, and leaver processes must revoke group membership and sessions, not just disable a login.
Worked example
A SaaS CRM must use corporate SSO and only allow compliant laptops. The IdP group CRM Users is mapped to the CRM role; SAML assertion includes department. A conditional access policy requires MFA and a compliant device. A contractor is added to the group but uses a personal phone; authentication succeeds, but authorization is blocked because the device is noncompliant. The reasoning: group membership grants the role, while policy evaluates the context.
Traps
Do not confuse IdP-initiated and SP-initiated SSO when debugging. Do not rely on nested groups if the app cannot read them. Do not leave orphaned accounts after a mover event. Do not assume MFA replaces least privilege.