How does ICAM work?

Follow how an access request moves between the application and enterprise identity services.

IdP and IGA overview

For component definitions and their distinct responsibilities, see Understanding IdP and IGA. The workflow below shows how they cooperate.

IdP & IGA overview video (3:01) — coming soon

From request to access

  1. The user requests application access through the SAAR workflow, where required.
  2. Designated approvers review the request; approved access is provisioned through the application's configured integration.
  3. When the user signs in, the application redirects to the IdP and receives the assertion or token for its integration.
  4. The application uses the supplied claims and its authorization rules to decide what the user can do.
  5. Access is reviewed and changed through governance as the user's responsibilities change.

See technical capabilities for protocol and connector details, security concepts for the policy rationale, and the Enablement Center to connect an application.

Content last reviewed 29 October 2026. Next review due 27 January 2027.