Most breaches now start with a stolen or misused identity. How SSO, MFA and least privilege work together, what has changed in the guidance, and where a mid-sized company should begin.
In short
Identity and access management (IAM) is the set of processes and tools that decide who or what can access which systems, and proves it at each sign-in. Single sign-on (SSO) gives people one strong identity across applications, multi-factor authentication (MFA) makes that identity hard to steal, and least privilege limits the damage if it is stolen anyway.
Attackers increasingly log in rather than break in. A phished password, an approved push notification or a forgotten admin account is often all they need. This explainer is written by Devies, a Gothenburg-based product and engineering consultancy, for CTOs, IT managers and product leaders who need a clear picture of IAM (in Swedish often identitetshantering) before deciding what to fix first. It covers the core terms, how the pieces fit, which kinds of MFA hold up against phishing, and a practical starting order.
What is IAM?
IAM is the discipline of managing digital identities and their access rights across their whole life cycle, from the day an account is created to the day it is removed.
Core definitions:
- Identity is the digital representation of a person, service or device, with attributes such as role, department and employment status.
- Authentication is proving that an identity is who it claims to be, for example with a password plus a security key.
- Authorisation is deciding what an authenticated identity is allowed to do.
- Single sign-on (SSO) is signing in once to a central identity provider and reaching many applications without separate passwords, using standards such as SAML or OpenID Connect.
- Multi-factor authentication (MFA) is authentication that requires two or more different kinds of proof: something you know, have or are.
- Least privilege is, in NIST's definition, the principle that each entity is granted the minimum system resources and authorisations it needs to perform its function.
IAM is often confused with neighbouring terms:
Term
What it is
How it relates to IAM
Directory
What it is
The database of users and groups
How it relates to IAM
A component IAM builds on
Identity provider (IdP)
What it is
The service that authenticates users and issues tokens for SSO
How it relates to IAM
The central engine of workforce IAM
PAM (privileged access management)
What it is
Extra control over administrator access
How it relates to IAM
A specialised part of IAM for high-risk accounts
CIAM (customer IAM)
What it is
Sign-in and accounts for your product's customers
How it relates to IAM
Same principles, different scale and user experience
Zero trust
What it is
A security model that verifies every request
How it relates to IAM
Uses IAM as its foundation
How do SSO, MFA and least privilege work together?
SSO, MFA and least privilege work as layers: SSO concentrates sign-in in one place, MFA protects that place, and least privilege limits what a successful attacker can reach.
Each layer covers a weakness in the others. SSO without MFA turns one stolen password into access to everything. MFA without SSO means dozens of separate sign-ins with varying protection, some of them without MFA at all. Both without least privilege mean that a compromised junior account may still read every file share or change cloud settings.
SSO brings an often overlooked benefit: joiner, mover and leaver processes become manageable. When someone leaves, disabling one account in the identity provider removes access to every connected application. Without SSO, local accounts in SaaS tools tend to survive for months.
The same logic is at the heart of zero trust: no request is trusted because of where it comes from, so identity and device signals decide access each time.
Which MFA methods resist phishing?
Phishing-resistant MFA is MFA where the protocol itself prevents an attacker's fake site from capturing and reusing the credentials, which in practice means FIDO2/WebAuthn security keys and passkeys, or certificate-based smart cards.
Not all MFA is equal:
Method
Resists phishing?
Notes
FIDO2 security keys and passkeys
Resists phishing?
Yes
Notes
Bound to the real site's domain, so a look-alike site gets nothing usable
Smart card or certificate-based
Resists phishing?
Yes
Notes
Strong, but needs card or certificate infrastructure
Authenticator app with number matching
Resists phishing?
Partly
Notes
Reduces push fatigue, but a real-time phishing proxy can still relay it
Simple push approval
Resists phishing?
No
Notes
Vulnerable to "MFA fatigue", repeated prompts until someone approves
One-time codes by app
Resists phishing?
No
Notes
Can be typed into a fake site and relayed
SMS codes
Resists phishing?
No
Notes
Also exposed to SIM swapping
CISA's fact sheet on phishing-resistant MFA calls phishing-resistant MFA the gold standard and FIDO/WebAuthn the only widely available phishing-resistant option; CISA treats push notifications with number matching as a stopgap where that is not yet possible. The final NIST SP 800-63B-4, published in July 2025, requires that at least one phishing-resistant option is offered at its middle assurance level, treats SMS as a restricted authenticator, and drops forced periodic password changes and composition rules.
As of October 2026, NIS2, Directive (EU) 2022/2555 lists the use of multi-factor or continuous authentication among the risk-management measures for covered entities, which in Sweden apply through the Cybersecurity Act (cybersäkerhetslagen).
Where should a mid-sized company start?
Start where most of the risk is concentrated: administrator accounts, email and cloud consoles, then widen coverage and tighten rights step by step.
A practical order:
- Inventory identities and applications. Which identity provider, which apps, which local accounts, which service accounts.
- Protect administrators first. Phishing-resistant MFA for all admin and cloud console access, separate admin accounts, and two monitored break-glass accounts.
- Turn on MFA for everyone, with number matching as a minimum and passkeys as the goal.
- Connect applications to SSO, starting with those holding sensitive data, and disable local sign-in where possible.
- Automate joiners, movers and leavers from the HR system, so access follows employment status.
- Introduce role-based access with a small number of well-defined roles, and remove standing admin rights in favour of time-limited elevation.
- Review access regularly. Quarterly reviews of privileged roles, yearly for the rest, with owners who actually confirm or remove access.
- Cover machine identities too. Service accounts, API keys and workload identities need the same discipline; see secrets management.
In the cloud, permissions drift quickly. Continuous checks for over-privileged roles and public access are part of cloud security posture management.
What does IAM mean for the products you build?
For product companies, IAM is also a product feature: customers expect SSO with their own identity provider, MFA and fine-grained roles inside your application.
Plan for it early. Support standard protocols such as OpenID Connect and SAML instead of custom login code, offer passkeys, design authorisation as a separate, testable layer, and log sign-ins and permission changes so customers can audit them. Broken access control has topped the OWASP Top 10, which shows how often the authorisation part goes wrong.
Keep reading
From our work
Consilium and Devies Cybersecurity+Consilium Safety Group and Devies Cybersecurity+: a partnership for future-proof cybersecurity in fire, flame and gas safety systems.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
What is the difference between SSO and MFA?
SSO (single sign-on) lets a person sign in once to a central identity provider and then reach many applications without separate passwords. MFA (multi-factor authentication) requires more than one kind of proof at sign-in, such as a password plus a security key. They solve different problems and work best together: SSO reduces the number of places to protect, and MFA makes the central sign-in hard to steal.
What is phishing-resistant MFA?
Phishing-resistant MFA is authentication where the protocol stops a fake website from capturing and reusing what the user provides. FIDO2/WebAuthn security keys and passkeys achieve this by binding the cryptographic proof to the genuine site's domain, and certificate-based smart cards offer similar protection. SMS codes, one-time codes and simple push approvals are not phishing-resistant, because an attacker's site can relay them in real time.
What does least privilege mean in practice?
Least privilege means every person, service and device gets only the access needed for its current task, and nothing more. In practice: no everyday work with admin accounts, time-limited elevation for administrative tasks, roles based on job functions rather than individual exceptions, separate access to production and test, and regular reviews that remove rights people no longer use.
Do we need a separate PAM tool?
Not always. Many identity platforms now include privileged identity features such as time-limited role activation, approval workflows and access reviews, which cover the needs of many mid-sized companies. A dedicated privileged access management tool becomes worthwhile with many on-premises servers, shared administrator credentials, session recording requirements or strict regulatory demands. Start by removing standing admin rights with what you already have.
