The specifically calling out "resources" here makes me lean towards understanding the reasoning behind the OAuth standard, the common grant types.

More on reddit.com

John savill does an excellent 2h youtube video for the SC-900 Microsoft Security, Compliance, and Identity Fundamentals. https://www.youtube.com/watch?v=Bz-8jM3jg-8&t=1s it is a nice starting point for understanding IAM in the AAD and M365 context. Really IAM is about understanding the shift to defining our boundaries at the Identity level rather than at a network level. We used to be secure knowing that inside our network boundaries, data was "safe". Now we need to treat the Identity as that boundary and make sure that the Identity and data access is safe no matter where it is accessed. This means features like MFA and how to enable it. Conditional access policies and how they can tie down resources unless conditions are met. just-in-time access, in PIM and PAM, how we no longer want standing access to resources, instead we want to have a process where access must be granted only when it is needed and for as long as it is needed. These are security topics, you may be expected to understand IAM from an external access perspective. Potentially they want to speak to you about guest access and external access. How a user can sign into access resources in your environment using a different identity provider like facebook or google. I think if you have a little look at some of these topics, you will be well on your way to being able to answer the questions. Understanding the difference between authentication or authorisation is a good start, as well as the CIA triangle. Good luck! More on reddit.com

Big 4 firms will hit you hard on IAM fundamentals, so expect deep dives into authentication protocols like SAML, OAuth 2.0, and OpenID Connect. They'll ask you to explain the differences between these protocols, when to use each one, and how they handle token flows. You'll also face questions about identity lifecycle management, privileged access management (PAM), role-based access control (RBAC) versus attribute-based access control (ABAC), and how you'd design identity governance frameworks for large enterprises. They love scenario-based questions too, like how you'd handle identity federation across multiple cloud providers or design zero-trust architecture implementations. Big 4 interviews are designed to test both your technical depth and your ability to think on your feet under pressure. They'll throw curveballs about compliance frameworks like SOX or PCI-DSS in relation to IAM, ask about directory services integration, and expect you to articulate complex concepts clearly since you'll be client-facing. I'm on the team that built a tool for AI interview questions , and it's particularly helpful for practicing these kinds of technical deep-dives where you need to explain complex IAM concepts clearly and handle follow-up questions that test your real understanding. More on reddit.com

You didn't mention if this is an operations or engineering position so here's various day to day tasks: Working with lines of business to onboard new applications integrate with a single sign-on system integrate with a provisioning system setting up the desired level of user authentication (user/pass, MFA, risk) Onboarding users - ideally this would be highly automated, but many companies require manual process. Architecting / engineering / integrating newer solutions - ex. FIDO2 Sample questions you may be asked: What cloud IAM resources have you worked with? Have you worked with docker / kubernetes? Tell me about the federated identity scenarios you've managed authentication flows federated identity protocols Talk about the most challenging provisioning workflow / integration you completed. Have you managed any governance campaigns? What is a JWT and how is it used? More on reddit.com