FREE COURSE / SELF-PACED LEARNING

Identity and Access Management Foundations: From Sign-In to Accountable Access

Build a foundation in identities, access and security control decisions with this free IAM course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
4 modules · 8 lessons
Estimated reading
32 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Map an end-to-end access path and distinguish identity proofing, authentication, authorization, session management, and governance responsibilities.
  • Select authentication and authorization controls that fit an asset's impact, user population, operational constraints, and credible threats.
  • Explain how federation, tokens, sessions, and recovery flows create trust dependencies that require explicit safeguards.
  • Produce a prioritized access-improvement plan with accountable owners, measurable evidence, and a review cadence.

Is this the right course for you?

Who it’s for

Learners building the identity knowledge needed for cloud and security investigations.

Scope and boundaries

Identity and access foundations. Specialized cloud-detection and Windows sign-in courses examine different evidence sources.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic cybersecurity concepts — Learners should understand accounts, networks, applications, common threats, and the difference between confidentiality, integrity, and availability.

About this course

This intermediate course teaches security practitioners, IT administrators, application owners, and technical managers how to make access decisions that are both secure and usable. Rather than treating identity as a sign-in screen, learners follow the entire access lifecycle: establishing an accountable identity, verifying an authenticator, evaluating authorization, managing federated trust, limiting session risk, protecting administrative access, and reviewing whether access remains justified.

The course uses vendor-neutral patterns and realistic decision points. It does not prescribe a particular identity platform. By the end, learners can map an access path, identify its weak trust assumptions, select proportionate controls, and assemble an improvement plan with clear owners, evidence, and review points.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Establishing Identity and Trust

Build the vocabulary and lifecycle model needed to reason about who receives access, what is being verified, and how authentication choices change account-takeover risk.

  1. Accountable Identities and the Access LifecycleLearn why an account must have an owner, a purpose, a lifecycle, and a revocation path before it can be trusted.4 min reading
  2. Authentication, Assurance, and Phishing ResistanceCompare authenticator choices by what they prove, how attackers target them, and what recovery can undo.4 min reading

MODULE 2

2. Making and Delegating Access Decisions

Learn how applications should decide what an authenticated identity may do, and how federation extends that decision across trust boundaries.

  1. Authorization, Least Privilege, and Policy DesignTranslate business permissions into explicit decisions about who can perform which action on which resource under which conditions.4 min reading
  2. Federation, OAuth, and Delegated TrustUnderstand how an application relies on an identity provider and how tokens, redirect flows, scopes, and validation rules shape that trust.4 min reading

MODULE 3

3. Containing Sessions and Privilege

Focus on the trust that continues after sign-in: session boundaries, recovery, administration, elevation, and emergency access.

  1. Sessions, Tokens, and Continuous Access DecisionsTreat an authenticated session as time-bounded authority that must be protected, limited, observed, and revoked when risk changes.4 min reading
  2. Privileged Access, Elevation, and Emergency PathsProtect the identities that can change security controls, administer platforms, approve high-impact actions, or access broad datasets.4 min reading

MODULE 4

4. Governing Access and Improving It

Turn identity and access design into an operating practice through reviews, evidence, monitoring, and a prioritized improvement plan.

  1. Access Reviews, Evidence, and DetectionKeep access justified over time by reviewing meaningful entitlements, recording evidence, and monitoring the events that change trust.4 min reading
  2. Build a Risk-Based Identity Improvement PlanSynthesize the course by turning an access-path assessment into a sequenced plan with owners, evidence, dependencies, and success measures.4 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.