IAM and Zero Trust: managing employee access to systems

IAM manages identities and permissions across systems. Zero Trust verifies access against defined policy rather than granting universal trust to everyone inside the office network. Start with people, resources and ownership rather than buying a product with the right label.

Identity and permission are different checks

Sign-in establishes who is requesting access. Authorisation determines what that person may do. Successful MFA does not establish entitlement to financial documents. Resources need owners who approve access according to work requirements.

Inventory applications, accounts and roles. Identify shared logins, excess administrative privileges and former employees’ accounts. Single sign-on can simplify management, but both connected and unconnected services still need accounting for.

Build the access lifecycle

Define workflows for onboarding, role changes and departure. Each needs an initiator, approval, timing and accountable executor. Permissions from a previous role should not automatically remain when an employee changes departments.

For example, a manager may receive temporary report access for a project. Agree expiry and review so an exception does not quietly become permanent. Retain approval in managed records rather than only the administrator’s personal messages.

Add relevant signals and sign-in protection

MFA strengthens sign-in, but methods differ in resistance and requirements. Where supported, consider device condition, risk and connection context. Verify capabilities and licensing for the exact product rather than promising identical behaviour everywhere.

Pilot with a defined group, testing routine work and account recovery. Administrative emergency access needs separate protection and oversight. A policy must not lock out every responsible person without a managed recovery path.

Review permissions after configuration

Test allowed and denied actions under real roles. A hidden menu does not prove direct requests or exports are protected. Check revocation, active sessions and integration accounts within platform capabilities.

Periodic review involves data owners. Reports show exceptions, unconnected systems and unresolved access. Zero Trust remains an ongoing verification and improvement process rather than a badge earned through one configuration.

Sources and further reading

• Microsoft: Conditional Access and policy signals
• OWASP: Zero Trust architecture
• Microsoft: multifactor authentication

• Related subservice: IAM and Zero Trust
• Explore this service area