--- title: "Identity management and access control (IAM)" slug: "identity-management-and-access-control-iam" status: "update" updated: 2025-08-21T12:07:57Z published: 2025-08-21T12:07:57Z canonical: "support.lusid.com/identity-management-and-access-control-iam" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.lusid.com/llms.txt > Use this file to discover all available pages before exploring further. # Identity management and access control (IAM) LUSID’s role-based access management system (RBAC) is designed to give you precise control over who can do what in your LUSID domain. It consists of two separate but interrelated systems: - The *identity management* system controls how users authenticate (that is, sign in) to LUSID - The *access control* system controls which LUSID datasets and features users are permitted to access once authenticated. The best place to start is with our white paper explaining [how these systems work together](/v1/docs/understanding-how-lusids-identity-management-and-access-control-systems-work). > **Note**: You can transition LUSID to a user-based access management system (UBAC) if you do not need to model professional responsibilities as roles. [More information](/v1/docs/rbac-vs-ubac-setting-up-user-based-access-control-for-lusid). Your ability to administer these systems is subject to access control permissions itself, but assuming you have sufficient privileges you can use the **Identity and Access** menu in the [LUSID web app](https://www.lusid.com/app/home): ![](https://cdn.document360.io/d575ad81-c0ed-4980-bbd1-d59ac5c3de82/Images/Documentation/image-1725811488110.png?sv=2026-02-06&spr=https&st=2026-10-27T07%3A47%3A23Z&se=2026-10-27T08%3A47%3A23Z&sr=c&sp=r&sig=h674YvAesv1jrcy2rro4W%2FN9qbOlUTC0vHySMZuz90c%3D) Alternatively, you can interact with these systems programmatically using a variety of [API and SDK resources](/v1/docs/what-api-and-sdk-resources-are-available-for-iam). **Explanation**: *Understand the big picture* - [Understanding how LUSID’s identity management and access control systems work](/v1/docs/understanding-how-lusids-identity-management-and-access-control-systems-work) - [RBAC vs UBAC: Setting up user-based access control for LUSID](/v1/docs/rbac-vs-ubac-setting-up-user-based-access-control-for-lusid) - [Understanding access metadata (AMD)](/v1/docs/understanding-access-metadata-amd) **Tutorials**: *Get started by doing something tangible* - [Onboarding users into LUSID](/v1/docs/onboarding-users-into-lusid) - [Setting up basic access control for different users](/v1/docs/setting-up-basic-access-control-for-different-lusid-users) - [Authorising an application or service to call the LUSID API](/v1/docs/authorising-an-application-or-service-to-call-the-lusid-api) - [Troubleshooting a failed access request](/v1/docs/troubleshooting-a-failed-request-using-the-insights-service) - [Setting up access controls for properties](/v1/docs/setting-up-access-controls-for-properties) **Reference**: *Understand concepts and implications* - [What are a personal user and a service user?](/v1/docs/what-are-a-personal-user-and-a-service-user) - [What is a user ID, and how do I discover it?](/v1/docs/what-is-a-user-id-and-how-do-i-discover-one) - [What is a role?](/v1/docs/what-is-a-role) - [What are a policy and a policy collection?](/v1/docs/what-are-a-policy-and-a-policy-collection) - [When do changes to a user's permissions take effect?](/v1/docs/when-do-changes-to-a-users-permissions-take-effect) - [What are an API access token and a client secret?](/v1/docs/what-are-an-api-access-token-and-a-client-secret) - [What is a personal access token?](/v1/docs/what-is-a-personal-access-token) - [What default roles and policies are provided with LUSID?](/v1/docs/what-default-roles-and-policies-are-provided-with-lusid) - [What API and SDK resources are available for IAM?](/v1/docs/what-api-and-sdk-resources-are-available-for-iam) - [Using SSO with LUSID](/v1/docs/using-sso-with-lusid) - [Provisioning LUSID using Okta and SCIM](/v1/docs/provisioning-lusid-using-okta-and-scim) - [Setting up a schedule, subscription or other activity on behalf of a service user](/v1/docs/setting-up-a-schedule-subscription-or-other-activity-on-behalf-of-a-service-user) **How-to guides**: *Get something done* - [How do I set up a personal user account?](/v1/docs/how-do-i-set-up-a-personal-user-account) - [How do I set up MFA?](/v1/docs/how-do-i-set-up-multi-factor-authentication-mfa) - [How do I reset my password if I've forgotten it?](/v1/docs/how-do-i-reset-my-password-if-ive-forgotten-it) - [How do I change passwords or MFA settings, or revoke access?](/v1/docs/how-do-i-change-passwords-or-mfa-settings-or-revoke-access) - [How do I set up a service user account?](/v1/docs/how-do-i-set-up-a-service-user-account) - [How do I generate and reveal a client secret?](/v1/docs/how-do-i-generate-and-reveal-a-client-secret) - [How do I obtain and use a short-lived API access token from Okta?](/v1/docs/how-do-i-obtain-and-use-a-short-lived-api-access-token-from-okta) - [How do I configure LUSID to use a different API access token issuer?](/v1/docs/how-do-i-configure-lusid-to-use-a-different-api-access-token-issuer) - [How do I create or revoke a long-lived personal access token?](/v1/docs/how-do-i-create-or-revoke-a-long-lived-personal-access-token) - [How do I use an API access token with the SDKs?](/v1/docs/how-do-i-use-an-api-access-token-with-the-lusid-sdk) - [How do I create a role?](/v1/docs/how-do-i-create-a-role) - [How do I create a feature policy?](/v1/docs/how-do-i-create-a-feature-policy) - [How do I create a data policy?](/v1/docs/how-do-i-create-a-data-policy) - [How do I create a data policy to control access to properties?](/v1/docs/how-do-i-create-a-data-policy-to-control-access-to-properties) - [How do I create a policy template?](/v1/docs/how-do-i-create-a-policy-template) - [How do I create a policy from a policy template?](/v1/docs/how-do-i-create-a-policy-from-a-policy-template) - [How do I create a policy from a JSON document?](/v1/docs/how-do-i-create-a-policy-from-a-json-document) - [How do I specify an expiry date or a rolling validity date for a policy?](/v1/docs/how-do-i-specify-an-expiry-date-or-a-rolling-validity-date-for-a-policy) - [How do I create a policy collection?](/v1/docs/how-do-i-create-a-policy-collection) - [How do I assign policies, roles and users to each other using the API?](/v1/docs/how-do-i-assign-policies-roles-and-users-to-each-other-using-the-api) - [How do I grant secure access to my LUSID domain for support?](/v1/docs/how-do-i-grant-secure-access-to-my-lusid-domain-for-support)