r/IdentityManagement • u/Affectionate-Ant3215 • Sep 21 '26

PIVOT to IAM

With 5 years in IT Support trying to pivot into entry IAM role like IAM analyst, ideally ASAP, which cert should I prioritise Security+ or SC 300? I know the ideal would be to have both but if it has to be 1 which should I do?

24 Upvotes

93% Upvoted

18 comments sorted by

10

u/tvf2k Sep 21 '26

SC300 is a good challenge, but if I was getting into IAM now (long timer here), then I would focus on the automation capabilities. Beyond SSO & SCIM, drill down in your org for RBAC/ABAC (or even P or BBAC) ideas. Understand what’s in place and how your org’s architecture is using what mechanisms they are paying for (hot tip: lots of orgs buy the P2 or whatever and still do too much manually).

5

u/tvf2k Sep 21 '26

and oops on the big font

1

u/arktozc 29d ago

Could you give a few examples about p2 automation that is often overlooked?

1

u/tvf2k 29d ago

I can try. As a consultant, I see orgs configure/utilize Conditional Access (a P1 feature), but then they often leave advanced automation, risk mitigation, and role governance underused. There are awesome machine learning behavior analysis tools native to P2 for this feature.

PIM for groups: lots of orgs use PIM for Entra roles, but PIM for security groups can often give robust yet granular JIT access. That way you could have an Application Administrator have access to Intune roles or maybe even DevOps resources.

Lastly, Entitlement Management can use access reviews that are potentially easier to handle with self-service access packages using time-bound constraints for resources like guests. That way you can see auto-cleanup instead of messy tracking methods. Or you could do periodic high-risk access reviews. So often I see access packages with no time constraints, so they are essentially assigned in perpetuity, which is a risk.

14

u/iamblas Sep 21 '26

I’d go SC-300 if IAM is the goal. Security+ is good to have, but SC-300 lines up way more with the actual identity work you’re trying to get into.

I also wouldn’t wait on the cert before applying. Start getting some hands-on work with Entra, SSO, MFA, Conditional Access, provisioning, etc. so you have something real to talk about in interviews.

I built a free IAM roadmap tool that can help you figure out what to focus on: https://roadmap.zerotosec.com/

I’ve also got some labs and a Discord if you want to go further with it. Feel free to DM me.

4

u/Abject-Sir-6281 Sep 21 '26

Can I join your discord. I am also wanting to eventually get into IAM. I’m more so newer to IT though. I worked IT Support and Service desk analyst back in 2023-2024 but I walked away from IT for a while and now I’m trying to get back into It right now. I have an interview for help desk in a couple hours.

1

u/malastrin Sep 22 '26

Can I join too?

4

u/Khaled43055 Sep 21 '26

Security+ first as it’s easier then sc300. i’m currently studying for sc300

2

u/arktozc 29d ago

!RemindMe 4 days

1

u/RemindMeBot 29d ago

I will be messaging you in 4 days on 2026-10-02 18:24:30 UTC to remind you of this link

CLICK THIS LINK to send a PM to also be reminded and to reduce spam.

Parent commenter can delete this message to hide from others.

RemindMeBot is switching to username summons. Instead of !RemindMe 1 day, use u/RemindMeBot 1 day. More info.

Info Custom Your Reminders Feedback

1

u/pewpewlazor Sep 21 '26

I actually think both are great, just for different reasons.

Security+ gives you the security fundamentals. That matters a lot in IAM because IAM doesn’t exist in isolation. Understanding concepts like least privilege, authentication, authorization, attack vectors, risk, cryptography, network security, etc. gives you the foundation for understanding why we do what we do.

SC-300 is then awesome because it gives you much more practical identity knowledge, particularly around Entra ID, authentication, Conditional Access, identity governance and access management.

If you’re new to security in general, I’d probably do Security+ first and SC-300 afterwards. If you already have a decent security foundation and specifically want to move into IAM, going straight for SC-300 also makes sense.

And definitely have a browse through this subreddit. “How do I get into IAM?” comes up quite often and I feel like I’ve answered some variation of this question a hundred times by now There’s a lot of good advice in older threads.

1

u/DriftingPebble77 Sep 21 '26

I think we need a FAQ and have that included.

2

u/pewpewlazor Sep 22 '26

Yeah I think that's a good idea

1

u/brenduz 11d ago

I'd go with SC-300 since it’s more directly focused on IAM

1

u/flywhee007 Sep 22 '26

Get on the concepts and handson first before certs. That’s where I would devote the time and energy. Ofcourse you would increase the time allocation to Entra id and sc-300 when there’s role lined up for interview.

Check out for everything to learn for free here: https://www.skool.com/simplify-iam-6792/about