Identity and Access Management Fundamentals

What this cybersecurity course is

Identity and Access Management Fundamentals is a 6-module cybersecurity course for security engineers, IT engineers, and developers moving into IAM engineering or architecture roles. Every module is grounded in primary-source standards: NIST SP 800-63-3 Digital Identity Guidelines (Grassi et al. 2017, Revision 4 in active development as of 2024), NIST SP 800-207 Zero Trust Architecture (Rose et al. 2020), NIST SP 800-162 Attribute-Based Access Control Guide (Hu et al. 2014), the OAuth 2.0 RFC 6749 (Hardt 2012) and OpenID Connect Core 1.0 (Sakimura et al. 2014), SAML 2.0 OASIS specifications (2005), and FIDO2 with W3C WebAuthn (2019). The course covers identity proofing and authenticator assurance, federated authentication via SAML and OIDC, modern phishing-resistant MFA via FIDO2, the privilege-management primitives that produce least-privilege IAM, and the workforce-identity blast-radius problem. Designed by Julian Calvo, Ed.D. in Applied Learning Sciences (University of Miami, 2026).

The course sequences six modules around the IAM operational lifecycle: identity proofing, authentication, federation, authorization, privileged access, and lifecycle management. Each module pairs a primary-source standard with a hands-on artifact: read the standard, configure a real federated identity flow against a free-tier identity provider (Microsoft Entra External ID, Okta Workforce or Auth0 free tier, Google Cloud Identity), document the security review the way an IAM engineering team would expect to see it. The pedagogical pattern follows Kolb's experiential learning cycle (1984): concrete IAM configuration, structured reflection against the standard, abstract conceptualization through the protocol specification, then active experimentation in the free-tier environment. Every claim cites NIST, an IETF or OASIS specification, the FIDO Alliance, BLS, ISC2, or peer-reviewed research. No identity-vendor white paper without primary-source backing.

Six modules

1. Module 01 · 130 minDigital Identity and the NIST 800-63 Stack+

   What identity assurance, authenticator assurance, and federation assurance levels mean per NIST SP 800-63-3, why the stack is the most-cited US Government identity standard, and how to apply it to a real authentication flow.

   Learning objectives

   • Cite the three Identity Assurance Levels (IAL1, IAL2, IAL3), three Authenticator Assurance Levels (AAL1, AAL2, AAL3), and three Federation Assurance Levels (FAL1, FAL2, FAL3) per NIST SP 800-63-3
   • Map a real authentication flow (such as US federal agency staff logging into an HSPD-12 PIV-protected resource) to the appropriate IAL/AAL/FAL combination
   • Distinguish identity proofing (the IAL question) from authentication (the AAL question) and explain why a system can have high AAL with low IAL or vice versa
2. Module 02 · 140 minOAuth 2.0 and OpenID Connect+
3. Module 03 · 110 minSAML 2.0 and Federated Workforce Identity+
4. Module 04 · 120 minFIDO2, WebAuthn, and Phishing-Resistant MFA+
5. Module 05 · 110 minLeast Privilege and Privileged Access Management+
6. Module 06 · 100 minThe IAM Career Trajectory+

Target audience

• Security engineers stepping into IAM-focused engineering or architecture
• IT engineers moving from on-prem Active Directory work into modern IAM (Entra ID, Okta, federated SaaS)
• Developers responsible for the application-layer identity integration (OAuth, OIDC, SCIM)
• GRC analysts who need primary-source fluency in identity controls (NIST 800-63 IAL/AAL/FAL levels)
• Cybersecurity professionals preparing for the CISSP or CCSP examinations whose IAM domain coverage exceeds prior preparation

Prerequisites

• Working comfort with at least one identity provider (Active Directory, Microsoft Entra ID, Okta, Auth0, Google Workspace)
• Basic understanding of TLS, public-key cryptography, and HTTP
• Familiarity with reading RFC-style specifications and JSON Web Tokens
• Willingness to commit 8 to 10 weeks of 4 to 6 hours per week study

Related cybersecurity content

• IAM Engineer cybersecurity career guide
• IAM Engineer salary data
• Cloud Security Fundamentals (the cybersecurity cloud platform companion)
• GRC and Compliance Fundamentals (the cybersecurity controls-and-audit companion)

Disclaimer

This course is for educational purposes only. IAM decisions affect access to production systems and personal data; readers must adapt course content to the specific platform, threat model, and regulatory context of the consuming organization. NIST publications cited here are public-domain US Government works. IETF RFCs and OASIS / W3C specifications are open standards. FIDO2 and WebAuthn specifications are public. AWS, Microsoft Entra, Okta, Auth0, Google Cloud Identity, and other named platforms are trademarks of their respective owners. DecipherU is not affiliated with any IAM vendor.