SSOGEN / Learn / CIAM vs IAM: How Customer Identity Differs From Workforce Identity
Learn
CIAM vs IAM: How Customer Identity Differs From Workforce Identity
CIAM vs IAM comes down to whose people they are: workforce IAM manages the people an organization employs, while CIAM (customer identity and access management) manages the people it serves, such as customers, suppliers and partners.
Updated
CIAM vs IAM in short: workforce IAM signs in employees and contractors, and the employer controls every account. CIAM signs in outside people, and each person largely controls their own account. Both use the same protocols, SAML and OpenID Connect.
What differs is who creates the account, who can close it, how many accounts there are, and what the sign-in page must look like. An employee account starts with an HR record. A customer account starts when a stranger types an email address.
Twelve differences between CIAM and workforce IAM
| Workforce IAM | CIAM | |
|---|---|---|
| Users | Employees, contractors, interns | Customers, suppliers, partners, citizens |
| Account created by | Provisioning from the HR system or directory | The person (self sign-up) or an administrator’s invitation |
| Account controlled by | The employer | The person, within your terms |
| Known before sign-up | Name, role, manager, verified at hiring | Usually only a mailbox the person proved |
| Scale | Bounded by headcount | Open-ended, with spikes after a campaign or launch |
| Account ends when | HR records a departure | The person closes it, a contract ends, or it goes unused |
| Sign-in page | One corporate look | Your brand, often per portal or application |
| MFA | Mandated by policy: authenticator app, security key, passkey | Offered or risk-based, chosen for low friction |
| Privacy | Employment terms and internal policy | Consent records, data minimization, closing an account on request |
| Federation | One corporate identity provider | Each business customer’s own provider, or none |
| Main abuse | Phishing, insider misuse | Fake sign-ups, credential stuffing, account takeover |
| Support model | Help desk resets the password | Self-service recovery; no help desk can know every customer |
The last row drives much of CIAM design. A help desk cannot verify a stranger by phone, so recovery, sign-up and MFA must work without one.
Who owns the account, and what you know about the person
A workforce account belongs to the employer. The person proved who they are at hiring, and HR vouches for every attribute.
NIST describes the general case in SP 800-63A-4: an applicant is identity-proofed, then enrolled as a subscriber with the service. Most CIAM sign-ups skip proofing and verify only a contact address.
That address check has a short life. Section 3.8 caps a confirmation code sent to a validated email address at 24 hours. Treat an email-only customer as “owns this mailbox”, nothing more.
How people get in: sign-up and invitation versus HR provisioning
Workforce accounts arrive by provisioning. The HR system creates the record, and a protocol such as SCIM or a directory sync pushes it to every application.
Outside people have no HR record at your company. They arrive by one of three routes:
- Invitation. An administrator creates the account for a known contact, such as a supplier’s buyer.
- Self-registration. The person signs up on a public page, proves the mailbox and, where required, waits for approval.
- Federation. A business customer signs in with its own identity provider, as described in federated identity vs SSO.
Invitation vs self-registration compares the first two routes in detail.
One identity system or two?
Some vendors keep the two apart on purpose. Microsoft Entra offers a workforce configuration and an external configuration: employees and invited business guests in one, consumers and business customers in the other. Customers who sign up to an external tenant get limited default permissions.
The right split depends on who the outside users are and what they reach.
| Situation | Usual fit | Why |
|---|---|---|
| Employees and contractors only | Workforce IAM | HR drives the lifecycle |
| Consumers at web scale, social sign-in, marketing consent | A dedicated CIAM service | Volume, consent and branding dominate |
| Suppliers and partners on an ERP portal | One system, separate groups and policies | Outside users reach the same applications as staff |
| Business customers with their own identity provider | Either, with federation per customer | Each customer controls its own users |
The ERP portal case is common. An Oracle E-Business Suite supplier portal serves internal buyers and external suppliers in one application, so two identity systems would mean two sign-in paths into one place.
When one system serves both: the controls that keep them apart
A shared identity system is safe when outside people can never drift into workforce access. Check these five points:
- Separate groups. New outside users land in a group that grants only their portal, never a default group that opens the intranet.
- Separate policies. Employees and customers get different MFA and session rules.
- No administrative power by sign-up. A self-registered person reaches applications only.
- Visible reach. Before opening sign-up, list every application a new person would reach.
- Own branding. The customer sees your portal’s name and look, not the employee sign-in page.
Mistakes when customers and employees share a directory
- The catch-all group. A rule such as “everyone gets the wiki” quietly includes every customer.
- Email as the identifier. Customers change addresses often. Use a stable identifier, as described in what an identity provider does.
- One MFA rule for all. A mandate written for staff turns away customers; a rule written for customers is too weak for staff.
- No end date. Supplier contacts leave their own companies, and nobody tells you. Review inactive outside accounts on a schedule.
Questions people ask
What does CIAM stand for in the context of cybersecurity?
CIAM stands for customer identity and access management. It covers how outside people, such as customers, suppliers and partners, create an account, sign in, recover access and manage their consent. It uses the same standards as workforce identity, SAML and OpenID Connect, but is built for self-service, open-ended scale and your own branding.
What is IAM in AWS?
AWS Identity and Access Management (IAM) is the AWS web service that controls who can sign in to an AWS account and which AWS resources they may use. It is a permission system for one cloud provider. Workforce IAM in this page’s sense is broader: the identity provider that signs employees in to all their applications.
What is the difference between MFA and IAM?
IAM is the whole discipline: accounts, sign-in, permissions and lifecycle. MFA is one control inside it, requiring a second factor such as an authenticator app code or a passkey at sign-in. Workforce IAM usually mandates MFA; CIAM often offers it or applies it by risk. See types of MFA for the methods.
What is the difference between an IAM policy and an IAM role?
In AWS, a policy is a document that lists permissions: which actions on which resources are allowed or denied. A role is an identity with no password of its own that carries policies. A trusted user, service or application assumes the role and receives temporary credentials. Policies say what is allowed; roles say who may use those permissions.
How SSOGEN serves customers and suppliers
SSOGEN gives outside people their own way in. An administrator invites a known contact, and the account exists at once with a one-use link to set the first password. Strangers use Create an account on the sign-in page, off by default, with administrator approval on by default. Each sign-up entry shows every application a new person would reach, and people who sign up themselves never get administrative power. See customer identity with SSOGEN.
Where to go next
- Getting outside users in. Invitation vs self-registration covers approval, link lifetimes and access.
- Keeping bots out of sign-up. CAPTCHA alternatives covers rate limits, proof-of-work puzzles and disposable addresses.
- More explainers. The Learn hub lists related pages.
Sources, all read 2026-11-15:
- NIST SP 800-63A-4, Identity Proofing and Enrollment, sections 1.1, 2.1 and 3.8.
- Microsoft Entra External ID: tenant configurations (Microsoft Learn).
- What is IAM? (AWS IAM User Guide).