Identity & Access Management (IAM) Interview Questions
Reviewed by Mark Dickie · Last updated
6 questions on this page you can answer and see marked on the spot. Go to the first one
Identity and Access Management (IAM) is the set of policies, technologies, and processes that control who can access resources in a system and what they can do with that access. For interview preparation, you should understand the distinction between authentication (verifying identity) and authorization (granting permissions), the major access control models (RBAC, ABAC, PBAC), and how SAML and OIDC enable federated single sign-on, and how OAuth 2.0, the authorization framework OIDC builds on, enables delegated access. You also need to be comfortable with zero trust principles, token-based authentication (JWT), and the tradeoffs between centralized and distributed identity stores.
What does an IAM interview typically test?
Interviews in this area probe both conceptual understanding and practical design ability. You may be asked to design an authorization system for a multi-tenant application, explain how OAuth 2.0 flows differ from SAML, or debug a broken SSO integration. Some interviews include scenario-based questions about privilege escalation, least-privilege enforcement, or compliance requirements such as SOX and HIPAA.
| IAM Concept | What It Covers | Common Interview Angle |
|---|---|---|
| Authentication | Verifying a user's identity | Compare methods (password, MFA, certificate, biometric) |
| Authorization | Deciding what an authenticated user can do | RBAC vs ABAC vs PBAC tradeoffs |
| Federation & delegation | Trust-based identity across organizations, and delegated authorization | SAML vs OIDC, and OAuth 2.0 grant flows |
| Zero Trust | Never trust, always verify | How to enforce per-request verification |
| Privilege Management | Granting and revoking access | Least-privilege design, just-in-time access |
Which IAM topics should you study most?
- Authentication vs authorization — know the difference cold and be able to explain it to a non-technical interviewer.
- Access control models — RBAC, ABAC, and relationship-based access control (ReBAC), with concrete examples of when each fits.
- Federation, SSO and delegation — SAML 2.0 and OIDC for sign-on, and OAuth 2.0 grant types for delegated access, including which flow to use for which client type.
- Token formats and lifecycle — JWT structure, refresh token rotation, token revocation strategies.
- Zero trust architecture — micro-segmentation, continuous verification, and identity-aware proxy design.
- Compliance and audit — how IAM systems support SOX, HIPAA, GDPR, and SOC 2 requirements.
Key facts
- Tarmac has 170 Identity & Access Management interview questions on this topic, 10 of them on this page, at difficulty 1–5 of 5.
- Tarmac tracked 863 job postings asking for Identity & Access Management in September 2026.
- Roles asking for Identity & Access Management advertise a median base salary of £65,000, across 124 job postings as of September 2026.
- Tarmac last reviewed these Identity & Access Management interview questions on 20 October 2026.
At a glance
| Questions | 10 shown · 170 in the bank |
|---|---|
| Difficulty | 1–5 of 5 |
| Formats | Multiple choice, True / false, Ordering, Design exercise, Short answer, Multiple answer, Fill in the blank, Flashcard |
What you'll review
- conditional access policies
- entra id tenant structure
- hybrid identity ad connect
- ldap queries and schema
Practice questions
Try one before you open the answer. Pick an option and press Check; it's marked on the spot.
In Microsoft Entra ID (Azure AD), what is the primary purpose of a Conditional Access policy?#
Options
Show answer
A Conditional Access policy in Entra ID enforces access controls — such as requiring multi-factor authentication or blocking access — when specified conditions are met during sign-in. It is an if-then rule: if conditions like user, location, or device state match, then the configured grant or block control applies.
Conditional Access policies are evaluated at sign-in time. If the configured conditions (e.g., user, location, device, risk) match, the policy applies access controls — most commonly requiring MFA or blocking access outright. They do not replace MFA, nor do they handle post-sign-in alerting or account provisioning.
Which two top-level sections make up the core logic of every Conditional Access policy in Entra ID?#
Options
Show answer
Every Conditional Access policy in Entra ID has two core sections: Assignments (the 'if' — users, cloud apps, and conditions) and Access controls (the 'then' — grant with requirements or block). Together they form the if-then logic that drives the policy decision at sign-in.
Every Conditional Access policy is structured around two core sections: Assignments (which define the users, cloud apps/workloads, and conditions like location or device state) and Access controls (which specify whether to grant access, with what requirements, or block it). Session controls are optional, not a mandatory core section.
In Microsoft Entra ID, a single tenant is dedicated to one organization and serves as the boundary for identity, directory objects, and subscription-based cloud services.#
Options
Show answer
True. A Microsoft Entra ID tenant is a dedicated directory instance tied to one organization, and it serves as the boundary for all identity, directory objects, and cloud service subscriptions belonging to that organization.
A Microsoft Entra ID (formerly Azure AD) tenant is a specific, dedicated instance of Entra ID that is created when an organization signs up for a Microsoft cloud service. The tenant represents the organization and is the container for all users, groups, apps, and directory objects. It also serves as the administrative boundary for identity and access management within that organization.
A single Microsoft Entra ID tenant can simultaneously belong to two different organizations and manage directory objects for both within the same tenant.#
Options
Show answer
False. A Microsoft Entra ID tenant is dedicated to exactly one organization. Each tenant is a private directory boundary, so two separate organizations require two separate tenants rather than sharing one.
A Microsoft Entra ID tenant is dedicated to a single organization. It is the organization's private directory and the boundary for its users, groups, apps, and resources. One tenant cannot represent or belong to two separate organizations; if an organization needs separate directory boundaries, each one gets its own tenant.
Azure AD Connect's synchronization engine processes objects through three high-level stages during a sync cycle. Order these stages from first to last, as they occur within one sync cycle.#
Put these in order
Show answer
The Azure AD Connect sync cycle runs in three fixed stages: Import → Synchronization → Export. Import reads changes from connected data sources into the connector space; Synchronization applies sync rules (projection, join, attribute flow) in the metaverse; Export writes the pending results out to the connected data sources. Each stage depends on the output of the previous one.
Every Azure AD Connect sync cycle follows the same three-stage pipeline. First, the Import stage reads changes from each connected data source into the corresponding connector space. Next, the Synchronization stage processes those staged objects through inbound/outbound sync rules—projecting new objects into the metaverse, joining related objects, and flowing attributes. Finally, the Export stage writes the resulting pending changes from the connector space back out to the connected data sources. This order is fixed by the sync engine's architecture; export cannot precede sync, and sync cannot precede import.
You are designing an LDAP directory for a small company with 200 employees. Each employee has a unique username, full name, email, department, and manager. Design the directory information tree (DIT) structure and the LDAP object classes / attributes you would use to represent users and departments. Explain where users and departments would be placed in the tree and why.#
Show answer
I would use a base DN of dc=example,dc=com. Under it I would create two organizational units: ou=people,dc=example,dc=com for user entries and ou=departments,dc=example,dc=com for department entries. Each user would be modeled with the inetOrgPerson object class and stored at uid=<username>,ou=people,dc=example,dc=com. Key attributes would include uid (login name), cn (full name), mail (email address), departmentNumber (department code), and manager (the DN of the user's manager entry). Each department would be an organizationalUnit entry under ou=departments with ou (department name) and description attributes. This layout makes it easy to run a subtree search on ou=people to list all employees, and to resolve a manager by following the DN stored in the manager attribute. Separating people from departments keeps the tree readable and lets searches be scoped narrowly.
This is a junior-level design exercise testing basic knowledge of LDAP directory tree structure, standard object classes like inetOrgPerson and organizationalUnit, and how attribute choices affect query patterns. The rubric rewards a concrete DIT, appropriate object classes/attributes, and a rationale for placement.
In Microsoft Entra ID, what is the relationship between an Azure subscription and a tenant? Specifically, can a single Azure subscription trust more than one Entra ID tenant for identity purposes, and what directory is a subscription associated with at creation time?#
Show answer
An Azure subscription has a trust relationship with exactly one Entra ID tenant. When a subscription is created, it is associated with a single Entra ID directory, and that directory is used for authentication and authorization of users and groups accessing resources in that subscription. While you can change which tenant a subscription trusts (by transferring the subscription to a different tenant directory), at any given time a subscription trusts only one tenant. Multiple subscriptions can trust the same tenant, but one subscription cannot simultaneously trust multiple tenants.
This is a foundational Entra ID concept: each Azure subscription is bound to exactly one Entra ID tenant at any point in time. The subscription-to-tenant relationship is one-to-one (with the ability to transfer), while tenant-to-subscription is one-to-many.
In Microsoft Entra ID, when multiple Conditional Access policies apply to the same user's sign-in attempt, which of the following statements are correct?#
Options
Pick every one that applies.
Show answer
All applicable policies are evaluated (not first-match-wins), any policy with "Block access" blocks the sign-in, and multiple policies requiring MFA result in a single MFA prompt. A report-only policy never enforces, so it cannot block access even when its conditions are met.
Entra ID Conditional Access evaluates every policy whose conditions (users, cloud apps, conditions) match the sign-in — it is not first-match-wins. If any matching policy has a grant control of "Block access," the sign-in is blocked outright because block takes precedence over all other grant controls. When multiple matching policies each require MFA, the controls are logically AND-ed, but MFA is a single challenge; satisfying it once satisfies every policy that requires it. Report-only mode logs the result but never enforces — it cannot block access.
When Azure AD Connect performs the initial synchronization of an on-premises AD user object, it attempts to match it to an existing cloud-only object in Azure AD. It first performs a _____ by comparing the on-premises proxyAddresses (the primary SMTP address) and userPrincipalName against the corresponding Azure AD attributes. If no match is found — or if the match is ambiguous — it falls back to a _____, which directly compares the on-premises sourceAnchor value (derived from mS-DS-ConsistencyGuid) against the Azure AD immutableId.#
Show answer
When Azure AD Connect performs the initial synchronization of an on-premises AD user object, it attempts to match it to an existing cloud-only object in Azure AD. It first performs a soft match by comparing the on-premises proxyAddresses (the primary SMTP address) and userPrincipalName against the corresponding Azure AD attributes. If no match is found — or if the match is ambiguous — it falls back to a hard match, which directly compares the on-premises sourceAnchor value (derived from mS-DS-ConsistencyGuid) against the Azure AD immutableId.
During initial sync, Azure AD Connect first tries a soft match: it inspects the on-premises proxyAddresses (specifically the primary SMTP, the entry with the uppercase SMTP: prefix) and userPrincipalName to find a corresponding cloud-only object. This allows pre-existing cloud users (e.g., Exchange Online mailboxes created before directory sync) to be linked to their on-premises counterparts. If the soft match finds no candidate or multiple ambiguous candidates, the engine falls back to a hard match, which compares the on-premises sourceAnchor (the base64-encoded mS-DS-ConsistencyGuid) to the Azure AD immutableId. A hard match is a definitive, one-to-one join that supersedes soft-match ambiguity.
In Microsoft Entra ID, what is the precise relationship between an Entra ID tenant and an Azure subscription, and why does this matter for tenant-structure design in multi-organization environments?#
Show answer
Each Entra ID tenant is an independent Azure AD directory with its own identity namespace, users, groups, app registrations, and administrative units — it is the hard security boundary in Microsoft cloud. An Azure subscription trusts exactly one Entra ID tenant at a time (the directory tenant), and that trust association can be moved to a different tenant, but a single tenant can be trusted by any number of subscriptions. Cross-tenant access requires B2B collaboration (guest identities) or cross-tenant sync — there is no implicit trust or shared directory between tenants.
A tenant is the directory boundary; a subscription is a billing/management boundary that delegates authentication and RBAC to exactly one tenant. Because tenants are fully isolated, organizations with multiple legal entities or compliance regimes often model each as a separate tenant and use B2B guest access for collaboration. The one-to-many relationship (one tenant → many subscriptions; one subscription → one tenant at a time) is the structural foundation for designing Entra ID architectures.
Related interview questions
Job market
See identity-access-management salaries and hiring demand from live job postings.
The other 160 questions
This page shows 10 and marks what you pick. That's as far as a page can go. A free account opens the other 160 and keeps every answer. What you miss comes back until it's right: after a day, then at longer gaps.
Free · the whole bank · 100 marked answers per 30 days · written feedback on the paid plan