Cybersecurity
IAM is the directory, sign-in, and the ordinary access a person receives. PAM is the additional control around accounts that can administer systems: a vault, a checkout, and a session record where the product provides one. Novatelia’s identity and access solution covers both questions, but a directory project is not automatically a privileged-access vault.
Revised 2026-10-10. Published by Novatelia. No individual author is named, because no personal credential is claimed for this explanation.
Key points
- Everyone needs IAM. Few accounts need PAM.
- A shared administrator password is the problem PAM is meant to shrink.
- Entra ID is one directory option, not the only one.
Definition
Identity and access management answers who the person is and what they may open. Privileged access management answers how an administrator account is stored, issued, and recorded.
How it works
People authenticate to the directory and receive groups or roles. Administrator accounts stay out of daily use. When needed, a person checks one out, uses it for the task, and the session ends. The record of that checkout is the control.
Architecture
- Directory and sign-in for the workforce.
- A separate store for administrator credentials.
- A checkout and a session record for the systems in scope.
Use cases
- Staff need single sign-on to mail and line-of-business applications.
- Firewall and server administrator passwords are shared and need a vault.
- A joiner-mover-leaver process must remove access when a person changes role.
Comparison
- IAM
- Directory, authentication, and ordinary application access.
- PAM
- Vault, checkout, and recording for administrator accounts.
Selection guidance
- List ordinary users and administrator accounts separately.
- Do not buy a vault before the directory is the source of identity.
- Microsoft Entra ID belongs in the design only when that tenant exists.
Questions
Is multi-factor authentication PAM?
No. It is an IAM control on sign-in. PAM is about how powerful accounts are stored and used. A strong sign-in does not replace a vault for shared administrator passwords.
Which service delivers this?
The identity and access solution is the design. Security architecture and hardening are the related services when the work is a directory change or a build standard, not a product logo.
Related
More in Cybersecurity
This page defines a term so a project can be scoped. It is not a certification, a test result, or a price. Partnerships are stated only on the partners page. The published address and telephone are the company contact, not a service-level commitment.
Describe the requirement
An RFQ saves a browser draft. It does not publish a price or issue a quotation reference.