IAM Architecture Diagram, Explained Layer by Layer

Most "IAM architecture diagrams" on the web are a vendor's product map with the vendor in the middle. This one is built the other way round: from the published reference architectures — the IDPro Body of Knowledge, CISA's ICAM Reference Architecture, NIST SP 800-63-4 and NIST SP 800-207 — and then annotated with where the real products, including SailPoint, actually sit. It is interactive, so you can click rather than squint.

What is an IAM architecture?

An identity and access management (IAM) architecture is the arrangement of systems, data flows and policies that create digital identities, prove them at login, decide what each identity may access, govern that access over time and record the evidence. The IDPro Body of Knowledge (2021) defines identity management as "policies, procedures, technology, and other resources for maintaining identity information."

Two official sources frame everything that follows. Microsoft's identity architecture guidance (updated 26 August 2026) draws the first line: "Authentication controls who or what uses an account. Authorization controls what a user can do in applications." CISA's ICAM Reference Architecture (version 1.3, September 2023) draws the rest, grouping the discipline into identity management, credential management, access management (including privileged access), federation and governance. The diagram below folds those into six layers a practitioner can point at.

If you have read our SailPoint IAM explainer, you have seen a five-layer version of this map from SailPoint's point of view. This page is the vendor-neutral, standards-referenced version — and the one to bookmark when an interviewer asks you to "draw the IAM architecture on the whiteboard."

What does an IAM architecture diagram look like?

An IAM architecture diagram stacks six layers from data sources to privileged access, with applications on one side as relying parties and the audit repository on the other. Click any layer below to open its definition, standard, typical tools and SailPoint role; use the trace buttons to watch a joiner, a login and an access review move through the layers.

Layers 1–2: Where does identity data come from, and where is it stored?

Identity data originates in authoritative sources — the HR system for employees, a vendor register for contractors — and is projected into identity stores such as Active Directory and Microsoft Entra ID, which hold the accounts, passwords and groups every other layer reads. The source decides who exists; the directory decides what account represents them.

The IDPro Body of Knowledge separates these deliberately: "Identity Information Authorities" supply the facts, the "Identity Register" stores the enrolled entities and their credentials. Confusing the two is the most common design error in Indian enterprises we meet in demos — teams treat Active Directory as the source of truth, so when HR terminates someone, nothing tells AD. The fix is architectural, not technical: make HR authoritative, make the directory a target, and put governance between them. Microsoft's reference design reflects the hybrid reality of layer 2: an on-premises domain controller feeding Entra Connect Sync, so the same account exists on-premises and in the cloud.

For SailPoint learners this is the content of the first fortnight. Module 3 (Application Onboarding) distinguishes authoritative from non-authoritative applications and configures Direct Connect to Active Directory; Module 4 (SailPoint Jobs) schedules the aggregation and refresh tasks that keep SailPoint's view of the directory current. Our application onboarding explainer walks through it step by step.

Layer 3: How do authentication and federation work in the architecture?

Authentication proves that the person logging in controls the identity, and federation passes that proof to applications so users sign in once. NIST finalised SP 800-63-4 in July 2025 in three volumes: 800-63A-4 for identity proofing and enrolment, 800-63B-4 for authentication and authenticator management, and 800-63C-4 for federation and assertions.

The identity provider (IdP) is the centre of this layer. It verifies the credential against the directory, applies multi-factor authentication, and issues a signed assertion — SAML 2.0 or an OpenID Connect token — that the application (the relying party) trusts. The strength of the login is graded as an Authentication Assurance Level and the strength of the assertion as a Federation Assurance Level, which is why job descriptions ask for "AAL2" or "phishing-resistant MFA". In practice the IdP is Okta, Microsoft Entra ID or Ping Identity; the Verizon 2026 Data Breach Investigations Report found credential abuse appears at some stage in 39% of breaches, which is why this layer gets the security budget.

SailPoint is not in this layer, and interviewers test whether you know that. Our SailPoint vs Okta comparison covers the career side; the SailPoint IAM explainer quotes the Okta integration guide on exactly how the two co-exist.

Layer 4: Where does zero trust fit in an IAM architecture?

Zero trust is the authorization layer: NIST SP 800-207 (August 2020) defines a zero trust architecture as a policy engine that decides access, a policy administrator that issues the session credential and a policy enforcement point that guards the resource, evaluated per session. CISA lists Identity as the first of its five zero trust pillars.

The policy engine does not work from thin air. NIST lists its inputs: the identity management system, device diagnostics, threat intelligence, activity logs, data-access policy and the SIEM. Two of those inputs come straight from the lower layers — the identity provider says who this is and how strongly they authenticated (layer 3), and the directory and governance layers say which groups and roles they legitimately hold (layers 2 and 5). A zero trust engine evaluating stale entitlements makes confident, wrong decisions. That is the architectural argument for governance: zero trust is only as good as the access data it evaluates.

Layer 5: What does the identity governance layer do, and where does SailPoint sit?

The identity governance and administration (IGA) layer decides what access should exist, who approved it and whether it is still appropriate, through joiner-mover-leaver automation, access requests, certifications and separation-of-duties policy. SailPoint IdentityIQ and SailPoint Identity Security Cloud are purpose-built for this layer; the IDPro Body of Knowledge calls it "Access Governance".

Governance is the layer that regulators actually audit. SOX in the United States, FCA and UK GDPR in Britain, RBI and SEBI in India all ask the same three questions — who has access, who approved it, when was it last reviewed — and only this layer can answer them from a single system. It is also the layer that connects to every other: it reads layer 1, provisions layer 2 and the applications, defines the roles and policies layer 4 evaluates, and governs who may hold the privileged accounts layer 6 vaults. On a whiteboard, draw governance as the hub, not as one more box in the row.

That hub role is why SailPoint is a career rather than a tool. The CISA reference architecture names "Identity Lifecycle Management" as the governance sub-capability; the IAM Careers IIQ curriculum spends nine of its 15 modules on it — Application Rules, Role Management, Policy Management, Risk Score, Groups/Workgroups/Population, Access Certification, Lifecycle Events, Custom Workflow and Quick Link & Reporting. For the product-level view of how IdentityIQ itself is built, read SailPoint IIQ architecture explained; for the definition in depth, what is IGA.

Layer 6: Why is privileged access management a separate layer?

Privileged access management (PAM) is separate because administrator and service-account credentials need controls ordinary accounts do not: vaulting, automatic rotation, session brokering and recording, and just-in-time elevation. CISA's ICAM Reference Architecture places PAM under access management with its own policy decision and enforcement points; CyberArk, BeyondTrust and Delinea are the typical platforms.

The relationship with governance is the one most architecture diagrams get wrong. PAM protects the credential; governance decides who may have it. In a well-built stack, a request to become a database administrator is raised and approved in SailPoint, SailPoint provisions membership of the right safe in the vault, and the vault handles the password from then on. CyberArk became part of Palo Alto Networks in February 2026, and ITJobsWatch shows 66% of UK SailPoint job ads in the six months to 15 October 2026 also cite CyberArk — the two skills are hired together. The IAM vs IGA vs PAM explainer covers the vocabulary; SailPoint vs CyberArk covers which to learn first.

How do the layers connect? Three flows to trace

The layers connect through three recurring flows: a joiner flow that runs top-down from HR through governance into directories and applications, a login flow that runs through authentication and authorization without touching governance, and a review flow that runs from governance back out to revoke access. The trace buttons on the diagram above animate each one.

Seeing the flows separately clears up the question every newcomer asks — "if SailPoint governs access, why is it not involved when I log in?" Because governance is a control-plane layer: it runs before and after sessions, setting up and reviewing the access that the data-plane layers (authentication and authorization) enforce in real time. A SailPoint outage does not stop anyone logging in; it stops new joiners getting access and leavers losing it. That distinction also explains the job split: identity engineers who own layers 2–4 are measured on uptime and latency; governance engineers who own layer 5 are measured on audit findings and leaver-removal time. The lifecycle events guide and the access certification guide go deep on the joiner and review flows in IdentityIQ.

How does this architecture map to SailPoint IIQ and ISC training?

Both IAM Careers tracks teach the governance layer against the other five: Module 1 places SailPoint in this architecture, Modules 3–4 connect it to sources and directories, Modules 6–14 build the governance functions, and Module 15 troubleshoots the connections. The SailPoint IdentityIQ track costs Rs. 25,000 and the Identity Security Cloud track Rs. 27,000, each 45 days live on Zoom.

Module names are the exact 15 modules of the IAM Careers SailPoint IIQ curriculum. The ISC column describes the cloud equivalents taught on the Identity Security Cloud track; ISC feature names follow SailPoint's documentation as of October 2026.

Which track? If your target employers run self-hosted IdentityIQ — most Indian banks, GCCs and Big 4 implementation teams — start with the live online SailPoint IIQ course (IIQ trainer Oishi, 15 years of enterprise IAM and SailPoint experience). If they are migrating to SaaS, the SailPoint ISC course (trainer Kiran, 10+ years) teaches the same architecture on Identity Security Cloud. Both are capped at 15 learners, every class is live and every class is recorded in the LMS, and practical work is guided hands-on practice — trainer-led live demonstrations, step-by-step exercises and real scenarios. Not sure which fits you? The career path finder takes two minutes. Ask on WhatsApp (+91 93909 81953) for the next batch date.

Is this IAM architecture still valid in 2026?

Yes. The six layers are stable; what changed in 2026 is who occupies them and what counts as an identity. NIST finalised SP 800-63-4 in July 2025, Microsoft and Okta now sell governance add-ons, CyberArk sits inside Palo Alto Networks, and AI agents are governed identities — the Verizon DBIR 2026 found 48% of breaches involved a third party.

Three shifts matter for anyone drawing this diagram in an interview. First, convergence: Microsoft Entra ID Governance and Okta Identity Governance mean layers 3 and 5 can come from one vendor for simple estates, while complex estates with SAP, mainframes and multi-step approvals keep a dedicated governance platform — see SailPoint vs Microsoft Entra. Second, non-human identities: the DBIR 2026 found employee use of AI on corporate devices rose from 15% to 45%, with 67% of that through personal accounts — identities nobody provisioned, nobody certifies and nobody removes. SailPoint's 2026 product line explicitly governs machine and agent identities, which our SailPoint in the AI era post covers. Third, the audit layer is becoming an input, not just an output: NIST SP 800-207 feeds logs back into the policy engine, so governance data quality now affects real-time access decisions.

The practical conclusion for a learner has not changed: the authentication layer is becoming a cloud commodity; the governance layer is where regulated enterprises still spend, still customise and still hire. Learning SailPoint with IAM Careers is learning the hub of this diagram.