Why is IAM not a purely technical topic, and what belongs to it beyond the technology?

Because the technology only executes what people and processes have defined: IAM also comprises the organisational processes (onboarding, changes, offboarding, support, governance) and the policies that say who may access what and why.

A directory server or a login protocol cannot decide whether a new employee should get access to the finance system, when a contractor's account expires, or who approves an exception. Those answers come from:

• Processes: registration and identification, mutation, revocation, operation, support, audit. Most IAM failures in practice are process failures, for instance an account that survives its owner's departure.
• Policies: the rules of access, least privilege, segregation of duties, retention, and the legal basis for processing personal data.
• Technologies: the systems that store identities, authenticate subjects and enforce rules.

In everyday life you meet all three at once: registering for SwissPass (process), agreeing to its terms (policy) and logging in with a password (technology).

Go deeper:

• eCH-0107 Gestaltungsprinzipien für IAM, v3.0 — the Swiss e-government design principles: IAM framed as governance, processes and technology in one standard (German).