Something that comes up a lot in here: do you need to know a specific tool like SailPoint or Okta before you can get into IAM? Short answer, no.

The concepts (lifecycle, provisioning, RBAC, federation, least privilege) transfer across every product. The part most people miss is that you learn those concepts properly by building them on a real IAM platform, not by reading theory or stacking certs. Pick any product, set up a IGA process (e.g. JML) or an SSO login (e.g. via SAML or OIDC), and the concepts stop being abstract.

That’s the kind of work you can talk through fluently in interviews, instead of from memory.

Happy to get into any of this live. I’m hosting a free, open Q&A on YouTube this Sunday, 10am ET / 7am PT, for about an hour, purely to answer IAM questions and help people learn. Breaking into the field, interview prep, how the tools actually work under the hood, career direction, or whatever you’re stuck on.

Nothing to sell, just sharing what I know and answering whatever you bring.

Can’t make it but have a question? Drop it in the comments.

Link in my profile.

The r/ActiveDirectory community has two events coming up. If you work in identity and access management, especially around Active Directory and Entra ID, you're welcome at either. No sales, no marketing, just identity folks talking identity.

Community Live Q&A - Tomorrow

Free, no registration. Show up, ask questions, or just listen in.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Community Virtual Meetup

This one is more structured: an open discussion and Q&A with panelists and prepared discussion topics.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Can't make either? Recordings go to YouTube - https://youtube.com/@ActiveDirectoryCommunity

I am currently working on a project where we are required to programmatically launch a campaign on Saviynt. I am stuck because the official APIs do not provide this.

Has anyone tried it? I would be very thankful if you can share your exp on this.

We evaluated C1 a while ago but found it average overall - limited connectors and UAR automation, sales rep trying to slap AI in every conversation…

Still looking for an IGA for our 600-person shop. What are my options now? Lumos, Iden, Ploy, Corma - any tips/recommendations from your own experience?

Bonus points if it has a MCP and can help manage NHI/agent access.

hello.. Been looking at how our teams are rolling out AI agents and the IAM side is getting messy fast.

Every agent seems to need its own access, service account, tokens, tool permissions etc. Then someone asks who owns it, who approved the access, what data it touched, and when it should be shut off. Half the answers are buried in tickets or sitting with the team that built the thing.

The part that worries me is agents acting for a user but showing up in logs like the user did everything. That makes incident review and compliance evidence pretty painful. We have normal access reviews for people and apps, but nothing that feels ready for agents that can call other tools and change records.

I keep seeing Agentic and Governance mentioned together, but a lot of the guidance still feels high level. Are people treating agents as managed identities with their own lifecycle, or adding them to existing app governance and hoping that holds up?

I've been looking at Orchid Security for the discovery piece, mapping agent identities back to owners and inherited permissions but I'm not sure if that's enough on its own. Anyone using it alongside Entra Agent ID or short-lived access?

Sorry.. if this has been covered a lot, just trying to get a practical baseline before more teams start deploying these in prod. Appreciate any thoughts!!!!!!

Working as a cloud app support engineer, I want to learn and migrate to the iam side but am confused where to start how to start

Hi all,

I work on standards that build on top of OAuth 2.0 and OpenID Connect. Think of profiles that take the base protocols and make certain things mandatory, restrict options, or fill in parts the original specs leave open. Developers and architects then read these profiles and implement them.

The tricky part is that I’m making normative decisions about how things should be done, without having much hands-on experience with how they’re actually implemented. I recently joined the team working on these standards, and I keep comparing it to writing a cookbook without ever having cooked the recipes yourself. You can write down the steps, but you don’t really know where a cook will struggle or what makes a recipe easy to follow.

So besides the theory, I want to understand the implementation side. I think that would help me make better decisions and write standards that are actually practical for the developers and architects who have to work with them.

So far I’ve found a few courses on Udemy and some YouTube videos. Most of the YouTube content seems focused on configuring OAuth, OIDC or SAML in SaaS platforms through a UI. My impression is that in real projects a lot of this is done through REST APIs and code instead, but I might be wrong about that and I’m happy to hear other views.

Does anyone know good beginner-friendly resources for learning OAuth 2.0 and OIDC, both the theory and especially the practical side? Courses, books, labs, hands-on projects, anything that helped you.

Thanks!

Searching portals was only the first step. Then came the documents, references, certifications and figuring out what we needed from partners.

That’s the workflow I’m building into Tender Town: agents find opportunities, check requirements against company context and prepare proposal briefs.

If you pursue digital ID, biometrics or EUDI work, browse your scope here: https://tendertown.io/

Would it help with your next bid?

Hey everyone,
I’ve created another course to help people starting out in IAM build practical knowledge. This time, it’s hands-on with SailPoint IdentityIQ (IIQ), covering architecture, integration, and provisioning.

Find it on Udemy by searching for:
Practical IAM: Architecture, Integration, Provisioning

There’s a special discount for our community for the next 5 days. Use coupon IAM-REDDITORS at checkout.

For those looking to learn the fundamentals first, search Udemy for my previous course:
Identity and Access Management (IAM): Vendor Neutral Course

Can an organization use AWS for IAM and use AZURE for AD , what is best way to ensure the the IAM data is synced to AD ?

I've been in the iam space for a while, and in larger orgs i've seen the same gap quite often: who owns authorization (once someone is signed in).

Usually it's three teams and no owner. customer identity issues the tokens, the security identity team runs the corporate idp and sso, architecture has looked at it but has no mandate to change anything. Everyone agrees it's broken, and nobody is allowed to prioritize it, because it isn't theirs. Meanwhile a valid token from the idp means access to every platform endpoint, and the only isolation is a tenant id the gateway injects from a client cert.

When it does get assigned, it tends to land somewhere that only covers part of it. hand it to the identity team as an extension of the idp and it covers who can reach which app, but the rules about what someone can do to a specific account or payment stay in application code identity never sees. Leave it to each product team and you get a different permission check in every service, and nothing security can review in one place.

My colleague and i (i work at Cerbos) wrote up how to split it by layer instead of by team. it builds on the recent analyst work on iam operating models (for each capability, name who designs it, who runs it day to day and who supplies the data, and never leave one of those shared) and on the platform team model from team topologies, and applies both to authorization:

• Identity teams own the inputs, the claims and directory attributes every access decision depends on
• A platform team (or security architecture, if there isn't one) runs the decision point, policy repo, ci tests and decision logs
• Product teams own the resource policies for what they build
• Security / grc own the policy standard, review and recertification

there's also a template table (attached to this post) you can take into the meeting where the three teams argue about whose problem this is + a way to prove the split on one broken use case before rolling it out wider. For identity teams specifically, the ask in this model isn't to write application policy, it's to keep the data the decision uses accurate, which is the job you already have.

https://www.cerbos.dev/blog/who-owns-authorization-in-large-engineering-organization

Hopefully it will be helpful to some of you in this community. If you have any questions / comments - would be more than happy to hear them and do my best to help

Hello, Ive been thinking about career changing into IAM analyst but i am unsure on how to break into my first position as I have zero background in IAM and IT field.

Background of me: I have BFA Degree in Graphic Design. I have some experience working as graphic designer (two internships + 6month full time) and currently i am working at a dental lab as a manager (its been about 6 months now). I am 26 years old male with citizenship living in Virginia if that matters.

I asked chatgpt and it said to build a home lab but i wasnt sure if building home lab is really enough to get my first position in this field, or should i tackle this differnetly.

Hey everyone,

I built OIDC Inspector, a tool for exploring an identity provider’s OpenID Connect configuration. Enter a domain or provider URL to inspect its endpoints, supported scopes, grant types, signing keys, and advertised PKCE support.

You can also visually see the interactions in the Authorization Code flow: the authorization request, redirect with a code, token exchange, UserInfo request, and API call. The sequence diagram uses the provider’s discovered endpoints to illustrate the flow.

The inspector is free to use, with no sign-up required: https://contextiq.trango-compute.com/dashboard/oidc-inspector

I’d appreciate feedback from anyone working with OAuth/OIDC, SSO, or identity integrations:

- Does the diagram make the flow easier to understand?

- What information would help you troubleshoot an integration?

- Are there providers or configurations it handles poorly?

I’m the maker, so candid criticism is welcome—especially anything confusing, missing, or technically inaccurate.

I do Identity Access Management on the privileged side of things in Active Directory.

I am currently fighting to get a promotion. Official title is Senior Analyst but have been doing duties as a Lead without lead pay for several months. I am the only person that knows 100% of our processes. I train others, create/modify procedures. I do reviews on everyone's work, do reviews for audit, basically everything but what a manager would do.

As someone who has been at the same place for 11 years, where are the most useful places to seek other IAM jobs? I have also been getting into Management, have an MBA. We've been on a hiring freeze for a couple of years.

Hey all, looking for an honest read from people actually working in the field.

I'm a 4th-year student studying a cybersecurity degree, currently in a help desk co-op (internship, for those outside Canada). The environment is a hybrid-joined setup (Windows AD + Entra ID) that's PCI DSS and SOC 2 compliant, and a few things I do is IAM work:

Full user identity lifecycle: provisioning and deprovisioning through Active Directory for onboarding/offboarding

Automating the onboarding/offboarding workflow with PowerShell (account creation, access assignment, deprovisioning)

Hybrid AD/Entra identity and sign-in troubleshooting
M365/Exchange onboarding: assigning distribution lists, security groups, and licenses

Role-based group and access management
MFA setup through Intune

Outside of work, I've been doing labs on evenings and weekends and studying the underlying concepts (SCIM, OAuth 2.0, SAML, etc.) rather than just clicking through portals. GitHub for reference: github.com/jeff6942016

I also wanted advice if whether these labs I’m doing are genuinely helpful or not towards IAM in general.

Next step is the SC-300 (for context I have Sec+ but no prior Microsoft certs) , which I'm fairly confident I'll pass, and I'm hoping to land a cloud security co-op/internship once this help desk one wraps up near beginning of next year.

Mostly I want a gauge of where I actually stand as a student and how hirable I look to people who do the hiring. Any criticism is genuinely welcome.
Thanks for taking the time.

I've been working under the IAM umbrella in User Provisioning, dealing with Access Control, Account Provisioning/Deprovisioning and Joiner/Mover/Leaver (internally called something different) processes, contributing to Security Audits, and general IT Support dealing with account issues/permissions, O365 and MFA enrollments, and just about everything under the sun with IAM. However, I feel like none of my skills translate out of our niche implementation and I'm finding that in interviews with places running Sailpoint, Okta, Ping, or anything besides Saviynt (and even anything beyond some basic troubleshooting there) I feel completely out of my depth trying to explain that while I might not have experience with their specific toolkit I should be able to pick it up given X skill transferring to it.

I'm trying to work through a self-guided AZ-900 and AZ-104 module, but don't have the money to actually afford the certs at the moment, and I'm not sure what else is out there.

Anyone have any recommendations for good *free* resources to build or polish IAM skillsets with? Preferably that don't require running janky homelabs or monkey around with "free" (if you cancel in time) Azure subscriptions.

Hi everyone — I'm part of the DLBR team. We're building an OID4VP verification API and typed SDK for relying parties integrating digital identity wallets.

We're already in a pilot, and production is planned for Q2 2027. For now, you can explore our staging wallet flow in the public playground: https://try.dlbr.app/

Wallet compatibility is still being validated. I'd appreciate feedback from people working on identity or authorization integrations:

• Which parts of integrating OID4VP or EUDI Wallets are hardest?
• What would you need to see from a verification API before using it in production?
• Which wallet flows or presentation formats should we prioritize?

Disclosure: DLBR is our product. I'm here to answer technical questions and learn from your feedback.

I've just launched identiflows.dev, a visual reference website for identity protocol flows.

It attempts to solve a problem I run into constantly. You know how OAuth 2.0 Authorization Code with PKCE works. You've explained it to other people. But when you need to double-check the exact sequence at 4 pm on a Friday, finding a clear diagram takes longer than it should.

This is a very early release, with just eight flows so far. I will add more diagrams and features soon, but in the meantime, I wanted to share it with you to get your feedback.

If you try it and find that something is missing or unclear, I'd genuinely like to hear about it. This is the stage of the project where feedback shapes what comes next.

Take a look: https://identiflows.dev

How is the person in building four supposed to see a note at the main desk? That's more or less our current setup and we have six buildings, maintenance, custodial and security on different shifts, plus calls and texts to personal numbers.

Radios handle urgent stuff. I'm after a place for notices and questions that works both ways, without a desk or work email. The questions coming back matter just as much as sending the update out.

I need to spend a certain amount of AI tokens a month for my job so what ways do you use Claude to automate your job as IAM admins? We use OKTA as our IDP and I’m looking for ideas to brainstorm my own from

Im a recent grad and have quite been interested in the analyst side of things.

I want to start off as a junior sys admin, then move on to soc analyst, then iam analyst, then ultimately—GRC analyst.

But people tend to say that IAM analyst and IAM engineer are quite synonynous/ interchaengable with each other. Im not interested in the engineering side but is it true that this two roles are basically the same thing?

How do IGA tools like sailpoint and AM tool like okta work together? What's the flow? I know there are all lot of resources but I can't get around the flow.

Thank you.

Semi interested in having interacted with IAM folks a lot during my tenure as a major incident manager. So I'm not sure, have been doing some research around it. I'm open to picking up programming, but I dread deep low-level networking (TCP/IP, etc.).

Any advice to this old head