Identity resilience glossary
Customer identity and access management (CIAM)
Customer identity and access management (CIAM) is the set of practices and technologies used to register customers, authenticate them, and control their access to digital services. It includes the identity lifecycle behind customer-facing websites, applications, and portals. CIAM is a branch of identity management focused on customer access, not the name of a single product.
How CIAM differs from workforce IAM
Workforce identity management supports people accessing systems as employees or other members of an organization's workforce. CIAM supports people using a business's products or services, including consumers and business customers. The underlying authentication concepts can overlap, but registration, account management, and application ownership differ. One person can have both an employee identity and a separate customer identity.
Why customer identity configuration matters
Customers rely on the sign-in journey to use the service they came for. That journey can depend on application settings, external identity connections, and custom registration or login logic. Teams need to know who owns those dependencies and how changes are reviewed. Auth0 and Microsoft Entra External ID are examples of products used for CIAM; the category is broader than either product.
An illustrative customer access problem
Suppose a software company lets business customers sign in to its portal through their own identity providers. A configuration change breaks that connection for one customer while other customers continue signing in. The response should isolate the affected relationship, compare its settings with the approved configuration, and validate the correction with that customer's sign-in path. Resetting every customer account would not address the underlying configuration problem.
CIAM and identity resilience
A CIAM recovery plan should distinguish customer profiles from application configuration and from data stored in the application itself. Decide which sign-in journeys must be restored first and how successful recovery will be tested. A list of customer accounts is not, by itself, a complete recovery plan. Product coverage, external dependencies, and the ability to regain administrative access all need separate checks.