An IAM Health Check should give leadership a clear view of where identity and access management is working, where risk is accumulating, and what should happen next. The strongest assessments look beyond tool configuration and review the processes, ownership, controls, and operating model behind the platform.

Use this checklist when IAM feels manual, audit-visible, platform-heavy, or hard to prioritize.

1. IAM Ownership and Governance

  • Is there a clear owner for IAM strategy, roadmap, and risk decisions?
  • Are IT, security, HR, compliance, and business application owners aligned on responsibilities?
  • Are IAM policies current, practical, and reflected in daily operations?
  • Does leadership receive useful reporting on IAM risk and progress?

2. Identity Lifecycle Controls

  • Are joiner, mover, and leaver processes documented and consistently followed?
  • Is HR data reliable enough to drive provisioning and deprovisioning?
  • Are terminations processed quickly across core systems and SaaS applications?
  • Do role changes trigger access review or removal?

3. Authentication and Access Controls

  • Is MFA enforced for all users who should have it?
  • Are Conditional Access or authentication policies easy to explain and maintain?
  • Are SSO gaps documented and prioritized?
  • Are guest users, external access, and remote access governed consistently?

4. Access Governance

  • Are access requests routed to the right approvers?
  • Are access reviews meaningful, or are they rubber-stamped?
  • Do business owners understand the access they are approving?
  • Can the team produce audit evidence without heroic manual effort?

5. Privileged Access

  • Are admin accounts separate from standard user accounts?
  • Is standing privileged access limited and reviewed?
  • Are break-glass accounts documented, monitored, and tested?
  • Are service accounts owned, reviewed, and protected?

6. Roadmap and Prioritization

The output should not be a long list of findings with no order. A useful IAM Health Check should separate quick wins, risk reduction items, foundational improvements, and larger roadmap initiatives.

StratIAM's IAM Health Check turns assessment findings into a practical roadmap with prioritized next steps.