IAM Discovery Checklist: What To Nail Before You Build

People & org

• Who owns identity end-to-end? Who approves risk changes?

Directories & lifecycle

• Source of truth, joiner/mover/leaver flows, contractor rules.

Policies

• Auth policies by persona, step-up triggers, break-glass process.

Applications

• Protocols (OIDC/SAML/API), session expectations, logout behavior.

Devices & posture

• Registered devices, passkeys, MDM signals in auth decisions.

Logging & metrics

• Where do logs go? Which KPIs decide go-live?

Bring this list to your first workshop and you’ll save weeks.