IAM Engineer Interview Questions UK: 8 Real Questions and What Interviewers Want

Most IAM Engineer interviews in the UK follow a pattern, and knowing it beats guessing. Below are eight questions from our bank of 12, each with a note on what the interviewer is really after.

Eight IAM Engineer interview questions, and what the interviewer is thinking

1. How would you design a joiner, mover, leaver process that is automated from the HR system through to application access?

Why they ask: To test practical identity lifecycle design and automation skills.

2. Can you explain how SAML, OAuth 2.0 and OpenID Connect differ, and when you would use each for single sign-on?

Why they ask: To check your understanding of federation protocols central to identity engineering.

3. How would you design Conditional Access policies for a Microsoft 365 tenant, and what pitfalls would you avoid?

Why they ask: To test hands-on knowledge of a very common UK enterprise identity platform.

4. What is the difference between RBAC and ABAC, and how would you implement role-based access at scale without creating role explosion?

Why they ask: To see whether you can structure access models that stay manageable.

5. How do you secure service accounts and machine identities?

Why they ask: To test awareness of non-human identity risk, a growing source of breaches.

6. You get an alert that a user signed in from the UK and then from another continent within minutes, and MFA was approved both times. What do you do?

Why they ask: To test your investigation approach to identity-based attacks, including MFA fatigue and token theft.

7. Tell me about a time you automated an identity process and what difference it made.

Why they ask: To check you can deliver measurable improvements through automation.

8. Why do you want to work as an IAM engineer, and what does a typical week involve?

Why they ask: To gauge motivation and realistic understanding of the role.

A sample answer to question 1

How would you design a joiner, mover, leaver process that is automated from the HR system through to application access?

I would make the HR system, such as Workday or SAP SuccessFactors, the authoritative source and drive everything from events there. A joiner record triggers account creation in Entra ID or Active Directory through an identity governance tool such as SailPoint, Saviynt or Microsoft Entra ID Governance, with birthright access assigned by role, department and location. Additional access is requested through a catalogue with manager and application-owner approval. For movers, a change in job or department triggers recalculation: new role access is added and old access removed, rather than accumulating. For leavers, the end date in HR disables the account on the day, revokes sessions and tokens, removes licences and triggers manager actions for mailbox and data. I would handle contractors through a sponsor-led process with enforced end dates, and include periodic access certifications and reconciliation reports to find orphaned accounts. Connectors to downstream apps use SCIM where available and APIs or ticketing for others. I would monitor failures and measure time-to-provision and time-to-disable.

Common mistake to avoid: Relying on manual tickets for leavers; ignoring movers, which cause privilege creep

Want the rest?

Full model answers, key points and common mistakes for all 12 questions are on the IAM Engineer interview questions page. The first five are free, no sign-up needed.