IAM users

The IAM User Model utilizes portal and role-based permission profiles to manage users’ access and asset permissions effectively. Instead of simply assigning Full Access or Limited Access, IAM administrators select access types defined by the portal and roles when creating permission profiles. This approach allows for a more nuanced control over user access and asset permissions.

The following table demonstrates key concepts:

Permission profiles	IAM administrators create permission profiles within the IAM portal, defining access types for users. These profiles are tailored to match the specific needs of different user roles within the organization.
Permission scope	Asset permissions are based on the organizational structure or asset folders within the Asset Management (AM) portal. This enables a granular combination of access and asset permissions, ensuring users only have access to the assets relevant to their role.
Master user (Account Owner)	The master user, or Account Owner, has access to the IAM portal and sets permissions for IAM users. This centralizes control and ensures consistent management of user access across the organization.
User groups	IAM supports user groups, streamlining the process of creating new users by applying predefined permissions. This saves time and ensures consistency in access control.
Two-Factor Authentication (2FA)	IAM provides support for two-factor authentication at the account level, enhancing security by requiring an additional verification step for user logins.
Granular permission granting	Users are granted access only to the portals and assets they require for their roles. This ensures least privilege access and minimizes the risk of unauthorized access to sensitive information.
Asset Management folder structure	Permissions can be assigned based on the folder structure of the organization’s Asset Manager, allowing for easy alignment of access controls with the organization’s workflow.
API users	IAM supports API users for programmatic access tailored to each portal, enabling automation and integration with other systems.
External Identity Provider (IdP) integration	IAM offers support for external Identity Provider (IdP) authentication, allowing organizations to integrate their existing identity controls seamlessly.

Resources for Further Information:

• For more detailed information on Identity & Access Management (IAM), additional guidance, and best practices, refer to the Identity & Access Management (IAM) guide.

• Explore External IdP integration for instructions on integrating external identity providers.

By leveraging these features, organizations can effectively manage user access and permissions within their IAM framework, enhancing security and productivity across their digital ecosystem.