How do you manage IAM user adoption and training?

Like most IT driven concepts, IAM can be a very technical area. To have a good user adoption, translating the needs into non technical requirements will be a good approach. This can be achieved by: - using steering committee involving business representatives, from the time IAM projects are defined, scoped and implemented. - Once implemented, invest in regular awareness campaigns to end users, explaining them the “why’s” and “how’s” they fits in the organization IAM journey have proven to facilitate adoption. - having dedicated type of trainings depending on the community you’re targeting. Many users play in the IAM journey and designing contents for each type of users can deliver rapid results

Define different learning groups based on the role in the organization and previous experience. Tailor the materials for each group. Select the most efficient channels for communication based on earlier transformation projects or communications department of the company. After training, follow-up and check if additional trainings are needed and how the materials could be enhanced. Get the proper stakeholder support for your message, for example in Townhalls or similar events. People need to have a feeling that this is important for them.

Remember the users are the most import part of the cog, too many approach the issue from the technical mindset and think the "tail wags the dog", to get User adoption you need to explain the benefits to them, if its not going to make their life easier explain how it will make things safer for them/ company. Get them to understand the issues that are created if they don't adopt the system, then once they have brought in build the training around the different user workflows

Clear Communication Channels: Ensure that your team understands the purpose of IAM. Tailored Training Programs: Not all users are the same. Customize training programs based on roles and responsibilities. Hands-On Learning: IAM is not a spectator sport. Encourage hands-on learning experiences. Feedback Mechanisms: Regularly seek input from users to understand their experiences with IAM tools. Continuous Learning Initiatives: IAM is a dynamic field. Leadership Involvement: Leaders set the tone. Gamification Elements: Make learning engaging by incorporating gamification elements. Documentation Hub: Establish a centralized hub for documentation. Celebrate Success Stories: Highlight success stories within your organization.

One thing many IAM programmes seem to skip is the explanation to the users around *why* they're being asked to change the way they do things, before bombarding them with the *what* of the training itself. The users are often the forgotten stakeholder group. Doing Identity 'with and for' the users, rather than *to* them is absolutely crucial when it comes to overcoming resistance and getting some velocity into the adoption of new systems and processes. A little bit of internal marketing can make such a difference.

In my experience, defining clear and measurable learning objectives is the cornerstone of developing effective IAM training programs. These objectives serve as the roadmap for your training content, ensuring that it is focused, relevant, and aligned with the specific needs of your target audience. Effective learning objectives should be SMART: Specific, Measurable, Achievable, Relevant, and Time-bound

Creating effective IAM training goals involves ensuring they are relevant to real-world tasks, not just easy to measure, to avoid a checkbox mentality. It’s important to include soft skills like communication and problem-solving, and to motivate users by aligning goals with their career aspirations. Training objectives should be tailored to different roles, updated regularly to address evolving cyber threats, and focused on long-term retention and practical application. Goals must be realistic within resource constraints and include strategies to overcome resistance to change. This approach ensures IAM training is impactful, relevant, and adaptable.

I cannot stress enough the part about "measurable" -- I know this is discussed in #4, but part of the objectives for your IAM training has to identify up front what metrics will be used, because the ability to record those indicators may need to be built along with the learning platform.

In my experience,After defining your learning objectives, the next crucial step in developing effective IAM training is to create engaging and impactful training content. This involves selecting relevant topics, crafting clear explanations, and using a variety of learning activities to keep learners engaged and actively participating. developing effective IAM training content is a crucial step in ensuring that your organization's workforce understands and adheres to IAM principles and best practices. By crafting engaging and informative training materials, you can empower your employees to make informed decisions about access control, reduce security risks, and protect sensitive data.

Monitor user adoption of the IAM system to ensure that users are using it correctly and following the established policies and procedures. Measure the success by tracking key metrics, such as user adoption rates, access request processing times, and the number of security incidents. Use the data collected to continuously improve the IAM system, This may involve updating policies and procedures, refining training materials, or making changes to the IAM system itself.

The following has work for me in the past: 1. Clear and Simple: Keep the information clear and easy to understand so people don’t get confused. 2. Use Different Formats: Mix it up with text, pictures, videos, sounds, quizzes, and activities to keep things interesting and help different types of learners. 3. Real-Life Examples: Show how IAM works in real-life situations so people can see how it’s useful for them and their work. 4. Extra Resources: Give people extra stuff they can read or watch later if they want to learn more. 5. Interactive Learning: Include fun activities and quizzes to keep people engaged and help them remember what they’ve learned.

Choose the best delivery method for your training—online, in-person, or hybrid—based on your users groups. Have a clear target and agenda for every training session.

Use surveys and feedback sessions to gather data. Compare this data with your objectives to find gaps and areas for improvement. Use this data to from your users and stakeholders to refine your training.

1. Develop a Comprehensive Training Program 2. Communicate the Importance of IAM 3. Provide Hands-On Training 4. Offer Different Learning Formats 5. Segment Training by User Roles 6. Provide Ongoing Support and Resources 7. Encourage Engagement and Feedback 8. Highlight Success Stories 9. Incorporate Security Awareness Training Monitor Adoption and Progress

In this data driven era, most of the users are becoming well aware of protecting their both onprem and cloud identities. However, being aware is only a half measure. Hence we need to engage them in an interactive continuous training which would make them keep evaluating the need to keep their identity safe.

Focus on the access request process first. Have the IAM create tickets for the service desk. Much faster to release functionality to users and uncover usability requirements. Once you get users requesting in a central place use automation. Also focus on Role based access. Also know the Product sales people are full of crap. Best case scenario you automate 10% of your access. Accept that and understand how much value would still be derived from that 10%. Remember the 80/20 rule does not mean you automate 80%. It means if you target the 20% of most requested roles you will reduce your workload 80%z

There are many great points in this article and the comments. Here are some additional points to consider, Self-service portals for common IAM requests should be a key consideration in your overall IAM strategy. Apart from explicit training, make these portals as intuitive as possible, with clear instructions and on-screen guides. Where appropriate, utilize AI/ML to guide users on access requests (based on peer group analysis), access approvals/re-certifications (based on appropriateness for the role). Use 'business language' as much as possible. Leverage your internal broadcast channels (Slack, Teams, email etc.) to frequently send appropriate identity security tips and tricks to engage with the user base.