Identity & Access Management (IAM)

This initiative focuses on strengthening enterprise identity security by reducing risk from unused, over-permissioned, and unmanaged identities, both human and non-human. Leveraging automation and advanced policy enforcement, the program aims to: Automate Remediation: Continuously detect and remediate unused or excessive permissions across accounts, services, and machine identities to minimize attack surface. Streamline Governance: Simplify identity governance processes by integrating automated workflows that grant, adjust, and revoke access dynamically, enabling effective least-privilege access models without relying on persistent standing privileges. AI Identity Control: Establish visibility and governance over identities tied to AI services, agents, and models, ensuring secure usage and preventing misuse of credentials or entitlements within AI-driven workflows. By combining automation, governance, and modern identity controls, this initiative aims to enable the enterprise to achieve scalable, least-privilege access while maintaining agility and securing emerging AI-enabled environments.

We are looking for a security solution that works best in a hybrid scenario to perform attack path analysis of human identities and managed identities / Service Principles both on-prem and in the cloud.

Have used other tools without clear success around deleting and retaining deleting of identity details. This is an ongoing probel I am trying to solve on a recurring basis, need a new tool that is effective.

Currently, IAMG is all manual. Looking at a comprehensive solution to manage identity lifecycle and identify attestation/assurance. We already have MFA and SSO deployed; so these elements are not in contention. We also have a PAM solution, but would consider replacing our current PAM solution if the overall TCO is competitive. In order of priority, our goals are: a) Provisioning lifecycle into AD+Entra b) Role management in our ERP solution and base entitlements c) Provisioning to our top 10 apps (incl. cloud and apps not integrated to SSO) d) Role attestations across the top 10 e) PAM if selected f) Customer/partner IAM - not a big priority, but see this as an eventual need g) Other apps as required