Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is Identity Assurance Level (IAL)?
Identity Assurance Level (IAL) is the level of confidence an organization has that a digital identity belongs to the real person claiming it. It focuses on identity proofing, not login strength. In simple terms, IAL answers: “How sure are we that this account is tied to the correct person?”
IAL is commonly discussed in the context of NIST digital identity guidance, where identity proofing, authentication, and federation are treated as related but separate assurance decisions.
How Identity Assurance Level (IAL) works
Identity Assurance Level (IAL) is assigned based on the evidence and checks used during enrollment. A low-risk service may only need a user-provided email address. A higher-risk service may require document verification, authoritative data checks, biometric comparison, or in-person proofing.
The key idea is proportionality. The more damage an impersonated identity could cause, the stronger the identity proofing process should be.
| Level | What it means |
|---|---|
| IAL1 | Attributes are self-asserted or treated as self-asserted. There is limited confidence in a real-world identity link. |
| IAL2 | Identity evidence is validated and connected to the applicant, often through remote or in-person proofing. |
| IAL3 | The strongest level, requiring more rigorous proofing and direct involvement by an authorized proofing representative. |
IAL vs AAL: what is the difference?
IAL measures confidence in identity proofing. Authentication Assurance Level (AAL) measures confidence that the returning user controls the right authenticator, such as a password, MFA app, passkey, or hardware security key.
For example, a user may be proofed at IAL2 during account creation but later sign in using an AAL2 authentication method. One process establishes who the person is; the other verifies that the same account holder is returning.
Why IAL matters for businesses
IAL helps organizations avoid both weak verification and unnecessary friction. Asking every user for high-assurance proofing can slow adoption and collect more personal data than needed. On the other hand, weak proofing for privileged access, regulated workflows, or sensitive records can increase fraud and account misuse risk.
Common business uses include:
- Verifying employees, contractors, or partners before access is granted.
- Protecting high-risk workflows such as device enrollment, admin access, or regulated data access.
- Aligning identity proofing decisions with compliance and risk management requirements.
For endpoint and access control programs, Hexnode can support the broader identity lifecycle by helping organizations enforce device posture, access policies, and authentication-related controls after users and devices are trusted.
How to choose the right IAL
Choose the lowest IAL that adequately protects the service. Start by asking what could go wrong if a false identity is accepted. Then consider the sensitivity of the data, the privileges granted, the legal or regulatory context, and the user experience impact.
IAL should not be selected in isolation. It should work alongside authentication strength, device trust, access policies, and monitoring.
FAQs
Not exactly. Identity verification is the process; IAL is the assurance level that describes how strong that process needs to be.
Yes. A public newsletter signup, a contractor account, and a privileged administrator account may each justify a different identity proofing level.
