Microsoft Cloud ebook · 5-page PDF

The Modern IAM Playbook

March 2025 · Big Sky Dynamics

A comprehensive guide to implementing modern identity and access management with zero trust principles.

What modern IAM is for

Identity is the control plane for everything else. Modern IAM answers four questions continuously: who is this, what device are they on, what are they allowed to reach, and should this specific access be allowed right now. The goal is not a stricter login page; it is a system that grants the minimum access needed and proves it can be revoked.

Principle 1: verify explicitly

Authenticate every request with the strongest signal the context allows: phishing-resistant credentials for administrators, multi-factor for everyone, and device compliance as part of the decision. Do not treat network location as proof of identity.

Principle 2: least privilege, by design

Start from no access and add what the role needs. Use role-based groups rather than direct assignments, and review the role catalogue annually. The most common privilege problem is not a malicious user; it is an accumulated set of permissions nobody removed.

Principle 3: assume breach

Design for containment: segmented administrative tiers, just-in-time elevation, short-lived credentials, and logging that reaches a system an attacker cannot edit. Test the detection path — can you tell, within an hour, that a privileged account behaved unusually?

Conditional access that people can live with

Conditional access policies fail when they are monolithic. Build a small number of named policies with clear intent: block legacy authentication, require compliant devices for administrative portals, require stronger authentication for risky sign-ins, and restrict guest access. Pilot each policy in report-only mode, measure the impact, then enforce.

Publish an exception process with an owner and an expiry. Policies without an exception path get disabled in the first incident.

Privileged access and lifecycle

Separate administrative accounts from productivity accounts, require just-in-time activation with approval for the highest tiers, and review standing access quarterly. On the joiners-movers-leavers side, automate provisioning from the HR source of truth and make leaver deprovisioning the fastest path in the system.

Governance and evidence

Access reviews are only useful if they produce decisions. Run them per critical application, with the manager as reviewer and a measurable completion target. Keep the evidence: who approved what, when, and what was revoked. That evidence is what turns IAM from a project into a control that survives an audit.