Establish and Document the Application's Identity and Access Management (IAM) - Application Management Best Practices

Establish and Document the Application's Identity and Access Management (IAM)

(Chapter 68 of Application Management Best Practices)

Executive Summary: Chapter Overview

IF4IT

The Bottom Line

Granting the right access quickly, removing it reliably, and proving to auditors that access is controlled all depend on a documented access design. This chapter establishes, with Security and the IT Application Owner, the Application’s authentication, roles-and-permissions authorization model, provisioning and deprovisioning, privileged access, service accounts, and segregation of duties. Everything is recorded in the Security documentation clearly enough for access reviewers and auditors, and never includes credentials or other Security Secrets.

Core Concepts

Concept	Definition & Strategic Role
Authorization Model	The roles, groups, and permissions the Application uses and what each allows. It must be documented in enough detail that access reviewers and auditors can understand what every role permits, which is what makes periodic access reviews meaningful.
Provisioning and Deprovisioning	The procedures by which access to the Application is requested, approved, granted, changed, and removed, including when people join, move, or leave. Documenting them lets the enterprise grant the right access quickly and remove it reliably.
Segregation of Duties	Defined combinations of access to the Application that must not be held by the same person. Recording them as part of the access design gives reviewers and auditors a clear basis for confirming that conflicting access is controlled.
Service and System Accounts	Non-human accounts the Application uses or provides, each with a documented owner. Recording them alongside privileged and administrative access ensures that accounts not tied to a person are still owned, controlled, and accounted for.

Quick Q&A

Question: What may and may not be recorded about credentials in an Application's identity and access management documentation?

Answer: Credentials and other Security Secrets must never be recorded; only where and how they are managed is recorded, following the practice for documenting Security Secrets without exposing them. The access design and procedures themselves, including the roles and permissions model, belong in the Security documentation and are reviewed with every Release that changes access.

Question: How does design-level IAM documentation differ from the Application's security and access configuration documentation?

Answer: This chapter addresses the access design decided during design: authentication, authorization, provisioning, privileged access, service accounts, and segregation of duties. The specific security and access settings that implement that design in each Instance are documented separately under the Application’s security and access configuration.

This chapter explains how to establish and document how an Application identifies its users and controls what they can do. It addresses the access design decided during design; the specific security and access settings that implement it in each Instance are addressed in the chapter “Establish and Document the Application’s Security and Access Configuration.”

Establish the Application’s Identity and Access Management

Establish, with Security and the IT Application Owner:

Authentication: how users and other Systems prove their identity to the Application, including integration with the enterprise’s identity services and any multi-factor requirements.
Authorization model: the roles, groups, and permissions the Application uses, and what each allows.
Provisioning and deprovisioning: how access is requested, approved, granted, changed, and removed, including when people join, move, or leave.
Privileged and administrative access: who holds elevated access, how it is controlled, and how its use is monitored.
Service and system accounts: the non-human accounts the Application uses or provides, and who owns each.
Segregation of duties: any combinations of access that must not be held by the same person.

Record the Application’s identity and access management design and procedures in its Security documentation. Record the roles and permissions model in enough detail that access reviewers and auditors can understand what each role allows. Do not record credentials or other Security Secrets; record only where and how they are managed, as described in the chapter “Establish and Document the Application’s Security Secrets — Without Exposing Them.” Review the documentation with every Release that changes access.

Establish and Document the Application's Identity and Access Management (IAM) — Governed generative AI-assisted Application… — Figure: Governed generative AI-assisted Application Documentation workflow illustrating the use of approved authoritative sources, AI-generated drafts, security and confidentiality guardrails, source traceability, mandatory human review and validation, corrections, formal approval, controlled publication, and ongoing maintenance. Accountable human stakeholders retain ownership of documentation accuracy, completeness, and compliance.

Establish and Document the Application's Identity and Access Management (IAM) — Application Identity and Access Management… — Figure: Application Identity and Access Management (IAM) architecture illustrating human and non-human identities, identity providers, authentication, role-based authorization, permissions, security policies, and protected Application resources. Includes provisioning, deprovisioning, privileged access management, segregation of duties, access reviews, and audit logging, while distinguishing identity verification from access authorization.

Best Practice: Establish and Document the Application’s Identity and Access Management

It is a best practice to both establish and document the solution for who can use an Application and what they can do: define its authentication, authorization model, provisioning and deprovisioning, privileged access, service accounts, and segregation of duties, and record them clearly enough for reviewers and auditors to use.

Benefits: Documented access management lets the enterprise grant the right access quickly, remove it reliably, and demonstrate to auditors that access is controlled. It also makes access reviews meaningful, because reviewers can see what each role actually permits.

The IT Operating Environments Best Practices addresses access governance across environments. The Application Portfolio Management (APM) Best Practices addresses assessing the security posture of every application in the portfolio.

How to cite this page

When referencing this page in academic work, internal standards, or external publications, include the page title, IF4IT as author and publisher (The International Foundation for Information Technology (IF4IT), LLC), the URL, and your access date.

Example (informal web citation):

The International Foundation for Information Technology (IF4IT), LLC. Establish and Document the Application's Identity and Access Management (IAM) | Application Management Best Practices. https://if4it.org/best-practices/application-management-best-practices/establish-and-document-the-application-s-identity-and-access-management-iam/ (accessed 2026-10-31).

See About Us for content governance and site-wide citation guidance.

Legal Disclaimers

Establish the Application’s Identity and Access Management

Document and Share the Identity and Access Management

Best Practice: Establish and Document the Application’s Identity and Access Management

Connections to Related IF4IT Practices and Inventories

How to cite this page