A new employee arrives on Monday morning, a contractor needs access to one project, and a visitor asks for the guest WiFi password. They're all standing in the same building, but they shouldn't receive the same access. The employee may need email, payroll, internal applications and staff connectivity. The contractor might need one shared workspace for a limited period. The visitor needs internet access, not a route into business systems.
That difference is the practical answer to what is identity management. It's the collection of policies, processes and technologies an organisation uses to establish who a person or system is, verify that identity, decide what it can access, and remove that access when circumstances change.
Identity management now reaches far beyond an IT login screen. It supports customer onboarding, fraud prevention, corporate governance, network access and regulatory controls. In the UK, the digital identity sector had 275 active firms as of January 2026, showing how identity has developed into a significant technology and economic ecosystem, not merely an administrative function. The sector generated about £2.03 billion in annual revenue in 2024/2025, produced £1.04 billion in Gross Value Added, and supported 9,624 full-time equivalent roles according to the UK Digital Identity Sectoral Analysis Report .
This guide builds the idea from first principles, then follows an identity through its lifecycle, authentication protocols, stronger sign-in methods and real network examples such as guest WiFi, staff WiFi , certificates, Passpoint and iPSK . For a wider introduction to the security benefits, protect data with identity management offers useful context from an access-management perspective.
Introduction to Identity Management in Modern Organisations
The office WiFi request often reveals an organisation's identity strategy faster than a security review. If everyone receives the same pre-shared key, the network can't distinguish a permanent employee from a departing contractor or a visitor who copied the password from a reception desk. Changing the key becomes disruptive, so teams delay it, and the old access continues long after the original business need has disappeared.
A better design starts with the person, not the password. A new employee signs in through the organisation's identity provider and receives the staff access associated with their role. A contractor receives a narrower profile, perhaps limited to a project network or specific applications. A guest uses an isolated service that provides internet connectivity without exposing internal systems.
Identity is a trust decision
Each access request asks several questions at once:
- Who is requesting access? The organisation needs a reliable identity record.
- How has that person proved it? A password, authenticator, certificate or another factor may provide evidence.
- What should the person reach? Access depends on role, device, location, risk and business purpose.
- How long should access remain available? Temporary work and changing responsibilities require expiry or review.
- What evidence exists afterwards? Logs and decisions support investigation, accountability and compliance.
This model applies to employees and customers, but also to suppliers, service accounts, devices and business officials. The UK's move towards formal identity verification illustrates the broader shift. Identity is increasingly used to create trust before an organisation permits a transaction, enrolment or legal action.
Why the topic matters beyond IT
Organisations moved more services online, and users now expect digital onboarding to feel quick while regulators expect it to be controlled. That creates a tension. A process that asks for too little evidence can enable impersonation or fraud, while a process that asks for too much can frustrate legitimate users and increase support demand.
Identity management resolves part of that tension by separating different decisions. Proofing a person's identity, authenticating a returning user and authorising access to a particular resource are related, but they aren't identical tasks. Keeping them distinct helps teams apply stronger checks where risk demands them without adding the same friction to every request.
The most useful mental model is simple: identity management is a trust and compliance layer connecting people, systems and access decisions. Login technology is one component. Governance, lifecycle control, network policy and evidence complete the picture.
Understanding Core Concepts Behind Identity and Access Management
Start with a passport and a building pass. The passport contains identifiers that distinguish you from other people. It represents an identity, but the passport itself isn't proof that the person holding it is the rightful owner. A border officer checks evidence, then applies a decision about whether you may enter.
Digital identity and access management follows the same pattern.
The vocabulary in plain English
An identifier is a label used to refer to something. A username, employee number, email address or device name can identify a record. An identifier doesn't automatically prove who is using it.
An identity is the digital representation associated with that record. It may contain attributes such as department, job role, manager, employment status, customer relationship or device ownership. A directory stores and updates these attributes so other systems can use them.
Authentication answers, “How do you know?” The user presents evidence linked to the claimed identity. That evidence could be a secret, a possession factor, a biometric characteristic or a cryptographic certificate.
Authorization answers, “What may you do?” After authentication, a policy evaluates the user's identity and context before granting access to an application, file, network or administrative function. Authentication without authorization would prove a person's identity but provide no useful boundary around their permissions.
An identity provider, often called an IdP, performs or coordinates authentication and sends trusted information to another service. The receiving application is the service provider. Federation creates a trust relationship between them, so an application can rely on an established identity source rather than maintaining an isolated password database.
One identity model does not fit every user
Workforce identity management covers employees, contractors and other people working on behalf of an organisation. Customer identity management serves external users who create accounts, purchase services or access personal information. The workflows overlap, but their priorities differ. Workforce access often follows employment roles and internal policy, while customer access must balance fraud controls, privacy, conversion and support.
Least privilege is the principle that connects both environments:
Grant each identity only the access required for its current purpose, and remove it when that purpose ends.
The UK market illustrates the scale of this trust layer. The sector's activity includes identity verification, onboarding, fraud prevention and account-opening workflows, with the government identifying 275 firms active as of January 2026 in its sector analysis. That breadth reflects how identity now supports public services, banking, enterprise systems and consumer transactions rather than only internal directory administration.
How Identity Lifecycle and Governance Work Together
An identity isn't a static database entry. It changes as a person joins an organisation, takes on new responsibilities, moves between teams or leaves. Strong identity management treats those changes as controlled events rather than informal requests sent between colleagues.
From joiner to leaver
Provisioning creates the identity record and connects it to authoritative information, commonly from a human-resources system or customer platform. The organisation establishes the person's status, department and manager before granting application or network access.
Onboarding applies the initial access package. A finance employee might need finance applications, while a temporary worker receives a narrower set of permissions. Automated workflows can reduce manual copying between systems, but automation should follow approved policy rather than grant broad access by default.
A role change is where many environments accumulate risk. A promotion, transfer or new project can add permissions without removing old ones. Over time, the person holds access from several roles, a condition often called privilege creep. A reliable workflow recalculates entitlements from the current role and sends exceptions for review.
Offboarding disables accounts, revokes sessions, removes group membership and addresses connected resources such as certificates, tokens and shared devices. The timing matters. Waiting for a manual ticket creates a gap between the employment decision and the access decision.
Governance turns activity into control
Governance defines who may approve access, how often owners review it and what evidence the organisation retains. Access certification asks a manager or application owner to confirm that permissions remain appropriate. Segregation of duties prevents one person from holding combinations of authority that could enable an inappropriate transaction.
Useful operational measures include time to provision, time to revoke, unresolved access-review findings and the number of accounts without a clear owner. These measures don't replace judgement, but they reveal where the lifecycle is dependent on slow manual work or incomplete data.
The UK identity sector's employment grew by an average of 11.7% per year since 2020, reflecting sustained demand for identity verification, onboarding, fraud prevention and account-opening workflows in the government's analysis. That demand reinforces a practical point: lifecycle operations need dedicated ownership as identity processes become central to business services.
For network teams, the same logic applies to staff connectivity. A staff WiFi lifecycle approach can connect directory changes to network permissions, so a role change or departure doesn't leave an unmanaged wireless credential behind.
Practical rule: Treat every access grant as a decision with an owner, an intended duration and a method of withdrawal.
Authentication Protocols That Power Single Sign On
Protocols are the plumbing of identity trust. They define how one system communicates an authentication result or authorisation decision to another. They don't all solve the same problem, so choosing between them requires clarity about whether the request concerns an employee signing into an application, a customer authorising an API call or a device joining a protected network.
Four protocols with different jobs
| Protocol | Primary purpose | Best fit use case |
|---|---|---|
| SAML | Federated exchange of authentication assertions | Enterprise single sign-on for established web applications |
| OAuth | Delegated authorisation | Allowing an application to access a resource without exposing the user's password |
| OIDC | User identity layer built on OAuth | Modern applications that need sign-in and standard identity claims |
| RADIUS with 802.1X | Centralised network authentication and policy exchange | Enterprise wired and wireless access controlled by an identity service |
SAML remains common in enterprise single sign-on. An employee authenticates with the identity provider, which sends a signed assertion to the application. The application trusts the configured relationship and starts a session without asking the employee for a separate application password.
OAuth is primarily about delegated access, not proving a person's identity. It lets a client receive permission to use a defined resource on a user's behalf. OIDC adds an identity layer to OAuth, making it suitable for modern applications that need standardised information about the signed-in user.
RADIUS with 802.1X serves a different environment. It connects network access equipment, an authentication service and a user or device credential. The result can be a policy decision that places a device on the correct network or assigns a particular access profile.
Trust must be explicit
Single sign-on is convenient because users authenticate with a trusted identity provider instead of maintaining separate credentials for every application. Federation also creates responsibility. Administrators must protect signing keys, validate assertions, define claim mappings and remove trust relationships that are no longer needed.
UK government guidance separates identity proofing from service authentication. GOV.UK's digital identity guidance links proofing and verification to GPG 45, while service authentication is governed by GPG 44. That separation helps organisations choose an appropriate level of assurance for the service rather than treating every login as an identical event.
Teams that need a broader explanation of how one trusted sign-in can span services may also benefit from unified global unified login explained . For network-specific deployments, RADIUS as a service is one architectural option for centralising authentication without maintaining every RADIUS component on premises.
Strong Authentication With MFA and Passwordless Options
A protocol describes how systems exchange trust. An authentication factor describes what the user presents as evidence. Keeping those ideas separate prevents a common mistake: assuming that implementing single sign-on automatically makes authentication strong.
Build an authentication ladder
A password is a knowledge factor, something the user knows. Passwords remain familiar, but users reuse them, choose weak ones or disclose them through phishing. A password manager and sensible policy can improve the baseline, but a password alone gives an attacker one target to defeat.
Multi-factor authentication combines evidence from different categories. A code generated by an authenticator app or a hardware token represents something the user has. SMS can provide an additional check, but organisations should assess its suitability for higher-risk scenarios because the phone channel can be attacked or diverted.
Biometrics represent something the user is. Fingerprints and facial recognition can make sign-in faster, but they need careful privacy design and secure device handling. Unlike a password, a biometric characteristic can't be changed after exposure.
Passwordless needs careful design
Passwordless authentication uses a device, cryptographic key or platform authenticator to prove possession without asking the user to type a reusable secret. FIDO2 security keys and passkeys can provide strong, phishing-resistant authentication when the surrounding enrolment, recovery and account-replacement processes are also controlled.
A practical programme usually progresses by risk:
- Low-friction services: Use single sign-on and a well-managed password process where the consequences of compromise are limited.
- Sensitive applications: Require MFA and apply conditional policies based on device health, location or unusual behaviour.
- Privileged operations: Prefer phishing-resistant methods, separate administrator accounts and strong session controls.
- Shared or unmanaged devices: Avoid embedding permanent secrets and use certificates or short-lived credentials where the platform supports them.
The best factor is not always the strongest factor in isolation. It must also work for the user population, device estate, recovery process and support team. For wireless access, a passwordless WiFi model can apply the same principle to network onboarding, replacing shared credentials with identity-linked access.
Real World Examples of Identity Management on Network and WiFi Access
A hotel guest, an employee and a building contractor may all connect to the same physical access point, but identity management should give them different digital destinations. The guest needs a simple route to the internet. The employee needs protected internal connectivity. The contractor may need a time-limited profile with access to selected services.
Guest and staff access should not share a secret
A captive portal can identify a guest through an email address, voucher or social sign-in, but the network still needs isolation and policy enforcement. A shared guest password makes attribution weak and creates an awkward operational question when the password spreads beyond the intended audience.
Staff access can use enterprise authentication, certificates or Passpoint. Passpoint allows a compatible device to discover and join a trusted network with less manual intervention, while encrypted onboarding can avoid the exposure created by a common wireless key. OpenRoaming extends the model across participating networks, so a user can rely on an established identity relationship rather than repeatedly accepting unfamiliar portals.
Legacy devices need a different route
Printers, sensors and older handheld devices may not support modern enterprise authentication. iPSK, or identity-based pre-shared keys, can give separate devices or groups their own credentials while preserving network segmentation. If one credential needs to be withdrawn, administrators can remove that credential without changing access for every other device.
The design still needs inventory, ownership and expiry. A separate key is not automatically a secure identity if nobody knows which device uses it or when it should be disabled.
Directory changes should reach the network
For staff, integrations with Microsoft Entra ID, Google Workspace or Okta can connect the employment directory to WiFi policy. A new starter receives the intended profile, while a directory change can trigger removal of access. Network platforms such as Meraki, Aruba, Ruckus, Mist and UniFi can then enforce the resulting policy through their supported integrations and authentication methods.
The same trust principle appears in corporate registration. Identity verification became a legal requirement for company officials on 18 November 2025 under the Economic Crime and Corporate Transparency Act 2023. In the first reported period ending 31 December 2025, Companies House recorded 823,771 verified appointments and a 6.27% compliance rate, as shown in its identity verification management information . The figures demonstrate how identity controls can become part of formal governance, not merely a technical convenience.
Best Practices Risks and Next Steps for Your Identity Strategy
Weak identity management usually fails through ordinary operational gaps rather than a single dramatic design error. A former worker retains an account, a contractor remains in a broad group, an application owner approves access without reviewing it, or a shared WiFi key continues circulating because changing it would inconvenience everyone.
A useful strategy starts by mapping identities to decisions. List the people, customers, devices, service accounts and business officials that need recognition. Then identify the systems that create authoritative records, the applications that consume identity information and the network controls that enforce access.
Turn common risks into controls
Credential reuse becomes less attractive when applications use federation, MFA and passwordless methods where appropriate.
Orphaned accounts become easier to find when every identity has an owner, an employment or service status and a defined offboarding process.
Privilege creep is reduced when role changes recalculate access rather than adding another group membership.
Invisible exceptions become manageable when temporary access has an expiry date and privileged actions produce reviewable logs.
Poor network attribution improves when staff, guests and devices receive identity-linked profiles instead of one universal wireless secret.
Governance should measure what matters operationally. Track provisioning and revocation time, overdue access reviews, accounts without owners, stale permissions and exceptions awaiting approval. These measures help leaders see whether the organisation can act when a person's status changes, not just whether a login succeeded.
Treat convergence as a design issue
Employee identity, customer identity and statutory identity verification are increasingly connected by the same question: can the organisation trust the entity making the request? They shouldn't be forced into one identical workflow, because a customer account, a staff administrator and a company official carry different risks. They do need consistent principles for proofing, authentication, authorisation, evidence and withdrawal.
The UK's digital identity sector generated about £2.03 billion in annual revenue in 2024/2025 and supported 9,624 full-time equivalent roles, according to the earlier cited government sector analysis. That scale indicates why identity strategy now deserves attention from security, compliance, networking, HR, product and customer-experience teams together.
Start with one high-value path, such as staff WiFi or joiner and leaver access. Document the authoritative source, define the policy, automate the routine decisions, review exceptions and test revocation. Then extend the pattern to applications, guests, devices and customer services without assuming that one tool or one authentication factor suits every identity.
Purple connects identity-based access to guest, staff and multi-tenant WiFi environments, including passwordless onboarding, Passpoint and directory integrations for organisations that want to replace shared network credentials with controlled access policies. Visit Purple to see how its platform can support practical identity management across hospitality, retail, healthcare, property and enterprise networks.
