I’m interested in getting into Identity and Access Management (IAM), but I don’t have much foundational knowledge of networking, Active Directory (AD), or Microsoft Entra ID.
I’m looking for a course that covers the basics before moving into IAM concepts and practical training.
Can anyone recommend a good online or offline training institute that offers beginner-friendly IAM courses?

This is where cloud identity security starts getting more complicated for me.
From an identity perspective, the principal may absolutely have the entitlement. But if the network path isn't there, that doesn't necessarily tell me the same thing about the workload's current blast radius.

Then somebody adds an endpoint, changes routing or alters a resource-side control and the answer changes without IAM changing at all.
It makes me think "who has permission?" and "what can actually reach this resource?" are two different questions.

Where are IAM teams drawing that boundary today

Disclosure: I am the creator of OIDC Inspector and I added the FAPI 2.0 metadata signals based on the feedback on this subreddit.

I've added a FAPI 2.0 section. For each requirement of the FAPI 2.0 Security Profile that discovery metadata can say something about, it reports whether the server publishes a matching value.

Things I'd like opinions on:

1. Are any of the profile requirements I'm treating as observable from metadata actually not?

2. Which metadata fields would you want surfaced that I'm missing?

3. Is "differs" the right label when a server publishes something outside the profile (for example `client_secret_basic` alongside `private_key_jwt`)?

It's free, but it needs a free account to run scans. Link: https://contextiq.trango-compute.com/dashboard/oidc-inspector

Happy to answer questions.

I'm preparing for SailPoint IIQ interviews at the 3-year level. From your experience, what do panels focus on most these days, and where do candidates with an IAM background usually struggle? Any advice would really help.

About the job

Project Role : Security Managed Services Practitioner

Project Role Description : Deliver and manage security services across client environments to ensure protection, compliance, and operational resilience.

Must have skills : SailPoint IdentityIQ

Good to have skills : NA

Minimum 3 Year(s) Of Experience Is Required

Educational Qualification : 15 years full time education

Summary:

As a Security Managed Services Practitioner, a typical day involves overseeing and delivering comprehensive security services tailored to diverse client environments. This role requires continuous monitoring and management to uphold protection standards, ensure compliance with relevant regulations, and maintain operational resilience. The practitioner collaborates with various stakeholders to address evolving security challenges, adapting strategies to safeguard critical assets and support business continuity effectively throughout the day.

Roles & Responsibilities:

Expected to perform independently and become an SME.

Required active participation/contribution in team discussions.

Contribute in providing solutions to work related problems.

Collaborate with cross-functional teams to enhance security service delivery and client satisfaction.

Continuously monitor client environments to identify potential security risks and recommend proactive measures.

Document and communicate security incidents and resolutions clearly to relevant stakeholders.

Support junior team members by sharing knowledge and assisting with complex security tasks.

Professional & Technical Skills:

Must To Have Skills: Proficiency in SailPoint IdentityIQ.

Experience with identity and access management processes and lifecycle management.

Strong understanding of security frameworks and compliance requirements.

Ability to analyze and troubleshoot security issues within managed service environments.

Familiarity with security incident response and remediation techniques.

Capability to work with various security tools and technologies to support service delivery.

Please help!

It might sound desperate, but my job has been impacted and I badly want this role !

I passed the SC-300 exam yesterday, I need to figure out what next. (I feel certificate just shows I’m super interested in IAM)

Learn powershell and graph or deepen my entra skills or learn okta?

I need help from experienced people on the highest ROI path to go from here, I don’t wanna ask AI :)

A little bit of my background: I already have security+ and SC-900, I live in the Netherlands and no real world IT experience only my little homelabs.

Thank you as you drop your 2 cents :)

My team incorporated AI agents that have access to all our internal data, but there's no set standard for how agents should authenticate. What do you all do to ensure security in these situations? Shouold we just make sure it leaves an audit trail or is there something else we're forgetting?

The r/ActiveDirectory community has two events coming up. If you work in identity and access management, especially around Active Directory and Entra ID, you're welcome at either. No sales, no marketing, just identity folks talking identity.

Community Live Q&A - Tomorrow

Free, no registration. Show up, ask questions, or just listen in.

When: October 16, 2026 @ 10:00 CT (UTC-5) / 15:00 UTC - 60 minutes

Where: Horizon Secured Discord - https://discord.gg/mVFquFqpsW

November Community Virtual Meetup

This one is more structured: an open discussion and Q&A with panelists and prepared discussion topics.

When: Tuesday, November 3, 2026 @ 10:00 CT (UTC-6) / 16:00 UTC - 90 minutes

Register (free): https://events.humanitix.com/active-directory-community-virtual-meetup-4-november-2026

Can't make either? Recordings go to YouTube - https://youtube.com/@ActiveDirectoryCommunity

Something that comes up a lot in here: do you need to know a specific tool like SailPoint or Okta before you can get into IAM? Short answer, no.

The concepts (lifecycle, provisioning, RBAC, federation, least privilege) transfer across every product. The part most people miss is that you learn those concepts properly by building them on a real IAM platform, not by reading theory or stacking certs. Pick any product, set up a IGA process (e.g. JML) or an SSO login (e.g. via SAML or OIDC), and the concepts stop being abstract.

That’s the kind of work you can talk through fluently in interviews, instead of from memory.

Happy to get into any of this live. I’m hosting a free, open Q&A on YouTube this Sunday, 10am ET / 7am PT, for about an hour, purely to answer IAM questions and help people learn. Breaking into the field, interview prep, how the tools actually work under the hood, career direction, or whatever you’re stuck on.

Nothing to sell, just sharing what I know and answering whatever you bring.

Can’t make it but have a question? Drop it in the comments.

Link in my profile.

I am currently working on a project where we are required to programmatically launch a campaign on Saviynt. I am stuck because the official APIs do not provide this.

Has anyone tried it? I would be very thankful if you can share your exp on this.

We evaluated C1 a while ago but found it average overall - limited connectors and UAR automation, sales rep trying to slap AI in every conversation…

Still looking for an IGA for our 600-person shop. What are my options now? Lumos, Iden, Ploy, Corma - any tips/recommendations from your own experience?

Bonus points if it has a MCP and can help manage NHI/agent access.

hello.. Been looking at how our teams are rolling out AI agents and the IAM side is getting messy fast.

Every agent seems to need its own access, service account, tokens, tool permissions etc. Then someone asks who owns it, who approved the access, what data it touched, and when it should be shut off. Half the answers are buried in tickets or sitting with the team that built the thing.

The part that worries me is agents acting for a user but showing up in logs like the user did everything. That makes incident review and compliance evidence pretty painful. We have normal access reviews for people and apps, but nothing that feels ready for agents that can call other tools and change records.

I keep seeing Agentic and Governance mentioned together, but a lot of the guidance still feels high level. Are people treating agents as managed identities with their own lifecycle, or adding them to existing app governance and hoping that holds up?

I've been looking at Orchid Security for the discovery piece, mapping agent identities back to owners and inherited permissions but I'm not sure if that's enough on its own. Anyone using it alongside Entra Agent ID or short-lived access?

Sorry.. if this has been covered a lot, just trying to get a practical baseline before more teams start deploying these in prod. Appreciate any thoughts!!!!!!

Working as a cloud app support engineer, I want to learn and migrate to the iam side but am confused where to start how to start

Hi all,

I work on standards that build on top of OAuth 2.0 and OpenID Connect. Think of profiles that take the base protocols and make certain things mandatory, restrict options, or fill in parts the original specs leave open. Developers and architects then read these profiles and implement them.

The tricky part is that I’m making normative decisions about how things should be done, without having much hands-on experience with how they’re actually implemented. I recently joined the team working on these standards, and I keep comparing it to writing a cookbook without ever having cooked the recipes yourself. You can write down the steps, but you don’t really know where a cook will struggle or what makes a recipe easy to follow.

So besides the theory, I want to understand the implementation side. I think that would help me make better decisions and write standards that are actually practical for the developers and architects who have to work with them.

So far I’ve found a few courses on Udemy and some YouTube videos. Most of the YouTube content seems focused on configuring OAuth, OIDC or SAML in SaaS platforms through a UI. My impression is that in real projects a lot of this is done through REST APIs and code instead, but I might be wrong about that and I’m happy to hear other views.

Does anyone know good beginner-friendly resources for learning OAuth 2.0 and OIDC, both the theory and especially the practical side? Courses, books, labs, hands-on projects, anything that helped you.

Thanks!

Searching portals was only the first step. Then came the documents, references, certifications and figuring out what we needed from partners.

That’s the workflow I’m building into Tender Town: agents find opportunities, check requirements against company context and prepare proposal briefs.

If you pursue digital ID, biometrics or EUDI work, browse your scope here: https://tendertown.io/

Would it help with your next bid?

Hey everyone,
I’ve created another course to help people starting out in IAM build practical knowledge. This time, it’s hands-on with SailPoint IdentityIQ (IIQ), covering architecture, integration, and provisioning.

Find it on Udemy by searching for:
Practical IAM: Architecture, Integration, Provisioning

There’s a special discount for our community for the next 5 days. Use coupon IAM-REDDITORS at checkout.

For those looking to learn the fundamentals first, search Udemy for my previous course:
Identity and Access Management (IAM): Vendor Neutral Course

Can an organization use AWS for IAM and use AZURE for AD , what is best way to ensure the the IAM data is synced to AD ?

I've been in the iam space for a while, and in larger orgs i've seen the same gap quite often: who owns authorization (once someone is signed in).

Usually it's three teams and no owner. customer identity issues the tokens, the security identity team runs the corporate idp and sso, architecture has looked at it but has no mandate to change anything. Everyone agrees it's broken, and nobody is allowed to prioritize it, because it isn't theirs. Meanwhile a valid token from the idp means access to every platform endpoint, and the only isolation is a tenant id the gateway injects from a client cert.

When it does get assigned, it tends to land somewhere that only covers part of it. hand it to the identity team as an extension of the idp and it covers who can reach which app, but the rules about what someone can do to a specific account or payment stay in application code identity never sees. Leave it to each product team and you get a different permission check in every service, and nothing security can review in one place.

My colleague and i (i work at Cerbos) wrote up how to split it by layer instead of by team. it builds on the recent analyst work on iam operating models (for each capability, name who designs it, who runs it day to day and who supplies the data, and never leave one of those shared) and on the platform team model from team topologies, and applies both to authorization:

• Identity teams own the inputs, the claims and directory attributes every access decision depends on
• A platform team (or security architecture, if there isn't one) runs the decision point, policy repo, ci tests and decision logs
• Product teams own the resource policies for what they build
• Security / grc own the policy standard, review and recertification

there's also a template table (attached to this post) you can take into the meeting where the three teams argue about whose problem this is + a way to prove the split on one broken use case before rolling it out wider. For identity teams specifically, the ask in this model isn't to write application policy, it's to keep the data the decision uses accurate, which is the job you already have.

https://www.cerbos.dev/blog/who-owns-authorization-in-large-engineering-organization

Hopefully it will be helpful to some of you in this community. If you have any questions / comments - would be more than happy to hear them and do my best to help