@Srinath U Thank you, that really means a lot, especially coming from you. The labs and this community have genuinely helped connect the dots for me, so I appreciate you taking the time to look through what I shared. Thanks for answering all my questions and adding new concepts in the IAM, and as I said before, your course is easy to follow and well structured. Looking forward to the next lesson 🙌

Thanks@Srinath U , for explaining Identity, and I really appreciate you adding more IAM concepts. It's true that it's the foundation of everything in IAM. This connected well with the IGA concept, which you explained clearly with the diagrams and explanation under IAM core concepts. In the past, I have completed the SailPoint course on IGA and ISC, so it helped to connect the two together. Still learning, so please correct me: My answers on the check yourself: 1. Non-human identities: AI agents, API keys, Cloud IAM roles.I'm still building depth on the Cloud IAM roles side specifically. But I'd love the opportunity to work with these hands-on in a real IAM platform within an organization. I think this is where the field is heading, and I want my skills to grow with it. 2. Account admin vs identity governance: Account admin = who can create, edit, or disable an account. Identity governance = who should have access, and proving it during an audit. My thinking, but checking : Questions: a) If someone changes role or location, but stays in the same company, does their identity stay the same? I think yes, the identity stays the same, but their attributes change (role, location, department). In this situation, the Mover event is triggered in the JML process, and access is updated through provisioning. Please let me know if there's more to this. b) If a contractor user is rehired for the same project from a contract position to a permanent employment position, and all their old system access was already set up, do they get a new identity, or is the old one reused? I'm not sure what's best practice in this situation. Reusing the identity avoids duplicate records, but a new identity might be a clean process for audits, since old access might be outdated. What's the best practice for small companies vs big companies? Thanks in advance

Hi @Srinath, the difference is that OAuth 2.0 handles authorization it decides what an app is allowed to access, while OIDC handles authentication, meaning it tells you who the user actually is. OIDC is built on top of OAuth 2.0. The problem was that OAuth 2.0 only gives you an access token (to call APIs) and a refresh token (to get new access tokens) there's no token that identifies the user. So people started to access the tokens and call extra APIs just to check who the user was, which is not safe(security issue). That's why OIDC was created to add a proper identity for the user on top of OAuth.Please let me know if there are any other reasons.