What is an IAM stack? The five jobs identity tools do

Why think in jobs rather than products?

Vendor categories overlap and change names. A buyer comparing "identity platforms" can end up with an identity provider, a governance tool and a threat detection product on one shortlist, although they do different work. Thinking in jobs asks a plainer question: what has to happen for every person and account, and which tool does it.

What are the five jobs?

1. Directory and single sign-on (J1): holds the list of people and groups and signs them in to applications once, with MFA and access policies. See the job page.
2. Lifecycle and governance (J2): grants access when people join, changes it when they move, removes it when they leave, and runs access requests and reviews. See the job page.
3. Application coverage (J3): finds the applications and accounts the first two jobs do not reach, such as unmanaged, legacy, custom-built and disconnected apps and the local accounts inside them. See the job page.
4. Privileged access (J4): controls admin and machine credentials through just-in-time grants, vaulting, rotation and secrets management. See the job page.
5. Identity threat detection and response (J5): watches sign-ins, sessions and directory changes for attacks and responds. See the job page.

How do the jobs depend on each other?

The directory is the source the others read. Governance needs to know who works here and who their manager is; detection needs to know whose session looks wrong. Governance acts through connectors, so its reach equals its connector list, and application coverage exists because that list is never complete. Privileged access and detection protect the accounts that would do the most damage if misused.

Where do suites fit?

Microsoft and Okta each document three of the five jobs in our sources: directory and sign-in, lifecycle and governance, and threat detection. That is why many organizations start with one of them. A suite reduces contracts and integration work; a separate product can go deeper on one job. The stack map shows which vendors document which jobs.

What do the other names mean?

Analysts and vendors use other labels for the same work: identity governance and administration (IGA) for J2, privileged access management (PAM) for J4, identity threat detection and response (ITDR) for J5. Identity orchestration is often used for parts of J3. The glossary lists them.

What should you do next?

Write down, for each job, which tool does it today, even if the answer is "a spreadsheet" or "nobody". That list is the starting point for the stack builder and for any buying decision.