You Might Already Have IAM Experience

You might not need to “break into IAM.” You might need to realize you’ve already been doing parts of it.

There’s a weird thing that happens when people hear Identity and Access Management.

They immediately think:

• Okta
• Entra
• SailPoint
• CyberArk

Some specialized security engineer sitting in a dark room doing mysterious identity things.

Meanwhile, they’ve spent the last three years:

• Resetting passwords
• Creating accounts
• Adding people to Active Directory groups
• Fixing MFA
• Removing access when someone quits

Come on.

What do you think IAM is?

Plot Twist: You Probably Already Have IAM Experience

IAM sounds specialized because the acronym sounds specialized.

But the work exists almost everywhere in IT.

At the simplest level, IAM is about answering questions like:

Who are you?

How do we prove it?

What are you allowed to access?

When should that access disappear?

If you’ve worked in IT long enough, you’ve probably touched at least one of those questions.

Maybe all four.

The issue isn’t always gaining IAM experience.

Sometimes it’s recognizing the experience you already have.

Ever Reset a Password? Congrats, You’ve Touched IAM

“User forgot password.”

You reset it.

They log in.

Ticket closed.

Basic help desk work.

But you just changed a credential tied to a user identity so they could authenticate again.

That’s IAM.

It doesn’t make you an IAM Engineer.

But you’re not starting from zero.

Beginner isn’t the same as zero experience.

Active Directory Is the Gateway Drug

If you’ve managed Active Directory, you’ve already touched a lot of IAM:

• Create users
• Disable users
• Reset passwords
• Manage groups
• Assign access

That’s identity at scale.

AD is why I call Active Directory the gateway drug of IAM.

Once you understand it, Entra becomes a natural next step.

That MFA Ticket Was More Valuable Than You Thought

User can’t log in.

MFA prompt is broken.

Authenticator changed.

You fix it.

That’s not just support.

You’re troubleshooting authentication:

Something they know.

Something they have.

Something they are.

From there you get into Conditional Access, passwordless, FIDO, and device trust.

The rabbit hole gets deep fast.

Onboarding and Offboarding? Yep. IAM.

New hire starts.

You create their account, add groups, assign apps, and give access.

They leave.

You remove it all.

That’s the identity lifecycle:

Joiner → Mover → Leaver

IAM just takes the same process and asks:

Can we automate it?

Can HR trigger it?

Can access change automatically with the role?

Your manual process is the beginner version of enterprise IAM.

Permissions Are Where Things Get Interesting

Creating a user is identity.

Deciding what they can access is access management.

Salesforce?

Yes.

Finance folder?

No.

Domain Admin?

Hopefully not.

Now you’re dealing with:

Roles. Permissions. Least privilege. RBAC.

And this is where normal IT administration starts turning into security.

A lot of breaches aren’t:

“Someone hacked through seven firewalls.”

They’re:

“Someone had access they shouldn’t have.”

Identity becomes the perimeter.

SSO Is Hiding in More IT Jobs Than You Think

You’ve probably used Single Sign-On even if you’ve never configured it.

You log into your Microsoft account.

Then suddenly you can open a bunch of company applications without entering another password.

Magic?

No.

Federation.

Eventually you’ll start seeing terms like:

• SAML
• OIDC
• Identity Provider
• Service Provider

This is when IAM starts looking like its own engineering discipline.

And it’s also where the value gets more interesting.

Because now you’re not just resetting someone’s password.

You’re helping design how thousands of identities securely access dozens of applications.

Your Microsoft Experience Might Be Your Biggest Clue

If you work in a Windows-heavy company, look around.

Active Directory.

Microsoft 365.

Entra.

Intune.

Conditional Access.

That’s a very natural bridge into identity.

You don’t have to throw away five years of Microsoft experience and randomly become a beginner in something else.

Build from what you already know.

That’s essentially how my own career evolved.

I didn’t sit down one morning and decide IAM would eventually become a $170K+ niche for me.

It kept appearing in my work until I finally recognized the pattern.

I wrote more about that journey here:

​I Didn’t Plan to Work in IAM. It Became My $170K+ IT Niche.​

Stop Saying “I Have No IAM Experience”

Instead, audit your job.

Look for:

• Active Directory
• User provisioning
• Password resets
• MFA
• SSO
• Group management
• Permissions
• VPN authentication
• Certificates
• Microsoft 365
• Entra
• Onboarding and offboarding

Then ask:

Where does identity show up in what I already do?

That’s where I’d start.

Don’t invent experience.

Don’t pretend resetting passwords makes you an IAM Architect.

But don’t throw your experience away either.

Now Go Dig Through Your Own IT Job

Your next niche may not require starting over.

It might require revealing what’s already there.

Then going deeper.

Learn the IAM vocabulary behind the work you’ve already done.

Build labs around the gaps.

Document them.

Start positioning your experience toward IAM roles.

Because sometimes the fastest way into a new IT niche isn’t learning something completely new.

It’s finally putting a name to the thing you’ve already been doing.