This question usually comes from a pretty specific place.
You have one or two people running IT. The company is growing. New tools keep showing up. Access requests are happening in Slack. Someone leaves and you’re not entirely sure what they had access to.
And then you go look at IAM solutions and think:
This feels like way more than we need.
That instinct is usually right.
If you look at how small IT teams actually handle IAM, they are not implementing a full “identity platform.” They are putting just enough structure in place to keep things from getting out of control.
Not perfect. Not complete. Just controlled enough.
The first thing experienced teams will tell you is simple:
Pick one place that represents your users and stick to it.
For most companies, that’s already:
That becomes:
You don’t need a second identity layer just to feel “more enterprise.”
A lot of teams add complexity too early here. Two identity systems. Partial sync. Confusion about which one is the source of truth.
Small teams that stay sane avoid that.
They keep one system clean and use it as the anchor.
This is the part people miss.
Small teams are not struggling because login is broken.
They are struggling because:
If you read through IT threads, this comes up constantly. Someone asks about IAM, and the real issue underneath is onboarding/offboarding pain.
So the teams that get ahead of it focus here first.
They build:
It’s not elegant. But it works.
SSO is helpful, but small teams don’t try to connect everything.
They usually:
Yes, tools like Okta exist to centralize this.
But if you’re a small team, the honest answer from practitioners is:
You don’t need 100% SSO coverage to be functional.
Trying to force every app through SAML early is one of the fastest ways to burn time.
This is where things get real.
Even if you do everything right, you will still have:
This is not a failure. This is normal.
Small teams that stay effective don’t try to eliminate this completely.
They just try to:
The teams that struggle are the ones trying to force a perfect model onto a messy system.
This shows up in almost every real environment.
Tools like:
get used for:
No one loves this setup. But people use it because they have to.
The difference between teams that stay in control and teams that don’t is how intentional they are.
Good teams treat shared credentials as exceptions.
Messy teams let them become the default.
In small companies, access requests usually look like this:
“Hey can you add me to X?”
That works until:
So teams introduce just enough process:
Not because they want bureaucracy, but because they need a record.
This is one of those changes that feels small but has a big impact.
If you want to understand how mature a small IT team is, look at offboarding.
That’s where gaps show up:
The teams that handle this well don’t have perfect systems.
They have:
It’s not fancy. It’s disciplined.
A lot of teams start by asking:
“What tool should we buy?”
Experienced operators tend to answer differently:
“What part of this is actually breaking?”
Sometimes the answer is:
That’s when tools like SaaS management platforms or lightweight IAM layers start to make sense.
But adding tools before you understand the problem usually just creates more work.
There is a point where this approach stops holding up.
You’ll feel it when:
That’s when teams start looking for something more structured.
But the key is that they earn that complexity. They don’t start with it.
If you strip it down, small IT teams are doing a few things consistently:
They keep one identity system clean.
They focus on lifecycle first.
They use SSO where it’s worth it.
They accept that some access lives outside the system.
They use password managers carefully.
They add just enough process to track decisions.
They stay disciplined on offboarding.
That’s it.
No one is building a perfect IAM architecture at 100 people.
They are trying to stay ahead of chaos.
Lightweight IAM isn’t about having fewer tools.
It’s about not solving problems you don’t actually have yet.
If you can:
You’re in a good place.
If you can’t do those three things, adding a bigger identity platform won’t fix it.
It will just give you a more complicated version of the same problem.
