Identity Governance and Administration: Managing the Identity Lifecycle

Bottom Line Up Front

Identity governance and administration (IGA) is your systematic approach to managing who has access to what across your entire organization — from onboarding new employees to deprovisioning former contractors. Think of IGA as the control plane for your entire identity and access management ecosystem, ensuring access decisions follow documented policies, are properly approved, and leave an audit trail.

IGA directly addresses access control requirements across every major compliance framework. SOC 2 requires formal user access provisioning and review processes (CC6.2, CC6.3). ISO 27001 mandates identity lifecycle management through A.9.2.1-A.9.2.6. HIPAA demands access controls and workforce training for handling ePHI. NIST CSF and CMMC emphasize identity and access management as foundational security controls. PCI DSS requires strict access controls for cardholder data environments.

Without IGA, you’re managing access through spreadsheets, tribal knowledge, and manual processes that break down as you scale — creating both security risks and compliance gaps that auditors will flag immediately.

Technical Overview

Architecture and Data Flow

IGA operates as the authoritative source for access decisions, sitting between your HR systems (the source of truth for personnel changes) and your target systems (applications, infrastructure, databases). The typical data flow follows this pattern:

• Identity creation: HR system triggers user provisioning when someone joins
• Access request: User or manager requests access to specific resources
• Approval workflow: Automated routing based on access policies and risk levels
• Provisioning: Automated or manual account creation in target systems
• Ongoing governance: Regular access reviews, policy violations detection, segregation of duties monitoring
• Deprovisioning: Automated account suspension/deletion when employment ends

Your IGA platform maintains a digital identity catalog — a centralized view of every user, their roles, entitlements, and access patterns across all connected systems. This catalog feeds access analytics that identify risky access patterns, policy violations, and orphaned accounts.

Defense in Depth Integration

IGA sits at the policy layer of your identity stack:

• Above: Risk and compliance policies that define who should have access to what
• Below: IAM infrastructure (Active Directory, cloud identity providers, privileged access management)
• Horizontally: Integration with SIEM for access analytics, ticketing systems for workflow management, HRMS for authoritative identity data

Think of IAM as authentication and authorization enforcement, while IGA handles the governance decisions that determine what IAM should enforce.

Cloud vs. On-Premises Considerations

Cloud-native organizations can leverage identity providers like Okta, Azure AD, or AWS IAM Identity Center with built-in IGA capabilities. Your implementation focuses on policy configuration, workflow design, and integration with SaaS applications through SCIM provisioning.

Hybrid environments require IGA platforms that can span on-premises Active Directory, cloud identity providers, legacy applications, and infrastructure systems. Solutions like SailPoint, Saviynt, or Microsoft Identity Manager excel in these complex environments.

On-premises-heavy organizations often need IGA solutions that integrate deeply with existing directory services while providing modern workflow and analytics capabilities.

Key Components and Dependencies

Core IGA components include:

• Identity repository: Authoritative source linking HR records to digital identities
• Access request portal: Self-service interface for requesting access
• Workflow engine: Approval routing, escalation, and audit trail management
• Policy engine: Rules defining access entitlements based on roles, attributes, and risk
• Access review module: Periodic attestation and certification campaigns
• Analytics and reporting: Risk scoring, policy violation detection, compliance reporting
• Connectors: Integration with target systems for automated provisioning

Dependencies include reliable HRMS integration (the source of organizational truth), directory synchronization (maintaining consistent identity data), and application integration (often requiring custom connectors for legacy systems).

Compliance Requirements Addressed

Framework-Specific Controls

Framework	Key Controls	IGA Evidence Required
SOC 2	CC6.2 (logical access controls), CC6.3 (access removal)	Access review reports, provisioning workflows, termination procedures
ISO 27001	A.9.2.1-A.9.2.6 (user access management)	Access control policy, user access reviews, privilege management procedures
HIPAA Security Rule	§164.308(a)(3), §164.308(a)(4)	Workforce training records, access authorization procedures, information access management
NIST CSF	PR.AC-1 through PR.AC-7	Identity management processes, access control policies, account management procedures
CMMC	AC.L2-3.1.1, AC.L2-3.1.2	System access authorizations, access enforcement mechanisms
PCI DSS	Requirements 7, 8	Role-based access controls, user access reviews, authentication procedures

Compliant vs. Mature Implementation

Compliant means you have documented processes for access provisioning, regular access reviews, and evidence of policy enforcement. Your auditor sees approval workflows, quarterly access certifications, and termination procedures that actually get followed.

Mature means your IGA platform provides real-time risk analytics, automated policy enforcement, and predictive insights about access patterns. You’re detecting policy violations immediately, not discovering them months later during access reviews.

Evidence Requirements

Auditors expect to see:

• Access control policies defining roles, responsibilities, and approval authorities
• Provisioning workflows showing approval chains and automated enforcement
• Access review reports with certification dates, reviewers, and remediation actions
• Termination logs proving timely deprovisioning of departing personnel
• Exception reports identifying policy violations and their resolution
• Training records showing security awareness for personnel with elevated access

Implementation Guide

Step 1: Identity Data Foundation

Start by establishing your authoritative identity source. For most organizations, this means integrating with your HRMS:

“`bash

Example: Azure AD Connect configuration for HR-driven provisioning

Configure attribute mapping from HR system to Azure AD

Set-ADSyncScheduler -SyncCycleEnabled $true -PolicyType Delta
“`

Map critical HR attributes to identity attributes:

• Employee ID → User Principal Name
• Department → Security Groups
• Job Title → Role-based Access Control groups
• Manager → Approval workflow routing
• Termination Date → Account expiration

Step 2: Application Discovery and Integration

Catalog your target systems and prioritize based on risk and compliance scope:

• High-priority systems: Those containing sensitive data (customer records, financial data, PHI)
• Medium-priority systems: Business-critical applications with moderate access controls
• Low-priority systems: General productivity tools with limited sensitive data

Configure SCIM provisioning for SaaS applications:

“`json
{
“schemas”: [“urn:ietf:params:scim:schemas:core:2.0:User”],
“userName”: “john.doe@company.com”,
“active”: true,
“emails”: [{“value”: “john.doe@company.com”, “primary”: true}],
“roles”: [{“value”: “standard-user”}, {“value”: “department-finance”}]
}
“`

Step 3: Policy Engine Configuration

Define access policies that translate business rules into technical controls:

Role-based policies:
“`yaml
policy:
name: “Finance Department Access”
conditions:
department: “Finance”
employment_status: “Active”
entitlements:
– financial_systems_read
– expense_management_full
approval_required: false
review_frequency: quarterly
“`

Risk-based policies:
“`yaml
policy:
name: “High-Risk Access Request”
conditions:
access_level: “Administrative”
data_classification: “Confidential”
approval_workflow:
– direct_manager
– data_owner
– security_team
approval_timeout: 72_hours
“`

Step 4: Workflow Design

Configure approval workflows that balance security with operational efficiency:

“`python

Example workflow configuration

workflow_config = {
‘standard_access’: {
‘approvers’: [‘direct_manager’],
‘auto_approve’: True,
‘conditions’: [‘same_department’, ‘standard_role’]
},
‘elevated_access’: {
‘approvers’: [‘direct_manager’, ‘resource_owner’],
‘auto_approve’: False,
‘additional_controls’: [‘justification_required’, ‘time_limited’]
},
’emergency_access’: {
‘approvers’: [‘security_team’],
‘post_approval’: [‘access_review_48h’, ‘usage_monitoring’]
}
}
“`

Step 5: Integration with Security Tooling

Connect your IGA platform to your broader security ecosystem:

SIEM integration for access analytics:
“`json
{
“event_type”: “access_granted”,
“user_id”: “jdoe”,
“resource”: “financial_database”,
“risk_score”: 75,
“approval_chain”: [“manager.approved”, “security.approved”],
“timestamp”: “2024-01-15T14:30:00Z”
}
“`

Ticketing system integration for access requests:
“`python

ServiceNow integration example

def create_access_request_ticket(user, resource, justification):
ticket = {
‘category’: ‘Access Request’,
‘priority’: calculate_priority(resource.risk_level),
‘assignee’: get_resource_owner(resource),
‘description’: f”Access request for {user} to {resource}: {justification}”
}
return servicenow_api.create_incident(ticket)
“`

Step 6: Access Review Automation

Configure periodic access certifications that scale with your organization:

“`yaml
access_review_campaign:
name: “Quarterly Privileged Access Review”
scope:
– administrative_accounts
– sensitive_data_access
– contractor_accounts
reviewers:
– resource_owners
– direct_managers
schedule: quarterly
auto_remediation:
no_response_timeout: 14_days
action: remove_access
evidence_retention: 7_years
“`

Operational Management

Daily Monitoring and Alerting

Set up real-time monitoring for IGA policy violations:

• Orphaned accounts: Accounts without corresponding HR records
• Dormant access: Users with privileged access but no recent activity
• Policy violations: Access grants that bypass approval workflows
• Segregation of duties conflicts: Users with incompatible role combinations

Configure alerting thresholds based on your risk tolerance:
“`yaml
alerts:
orphaned_accounts:
threshold: 24_hours
escalation: security_team
policy_violations:
threshold: immediate
escalation: compliance_officer
failed_provisioning:
threshold: 4_hours
escalation: identity_team
“`

Weekly Log Review

Establish weekly review cadences for access patterns:

• New high-risk access grants requiring additional scrutiny
• Emergency access usage and post-incident reviews
• Bulk provisioning events that might indicate automation errors
• Cross-department access requests that could signal role creep

Change Management Integration

Your IGA platform should integrate with change management processes:

• Policy changes require approval and impact analysis
• Connector updates need testing in non-production environments
• Workflow modifications require stakeholder review and documentation
• Role definition changes trigger automatic access reviews

Document all changes with:
“`markdown

Change Request: Finance Role Update

• Requestor: Finance Director
• Business Justification: New compliance requirement for expense approvals
• Technical Changes: Add expense_approval entitlement to senior_finance role
• Impact Analysis: Affects 12 users in finance department
• Rollback Plan: Remove entitlement, revert to manual approval process
• Testing Evidence: Validated in development environment

“`

Incident Response Integration

When security incidents involve compromised accounts, your IGA platform should enable rapid response:

• Emergency deprovisioning of compromised accounts across all systems
• Forensic access tracking showing what the compromised account accessed
• Related account analysis identifying accounts with similar access patterns
• Re-certification triggers for accounts with similar access profiles

Annual Review and Recertification

Schedule comprehensive annual reviews:

• Policy effectiveness analysis: Are current policies preventing unauthorized access?
• Role definition review: Do roles still align with business functions?
• Connector health assessment: Are all integrations functioning properly?
• Compliance gap analysis: Where are audit findings pointing to IGA improvements?
• Metrics and KPI review: Access request processing times, approval rates, policy violation trends

Common Pitfalls

Implementation Mistakes That Create Compliance Gaps

Over-relying on manual processes: Even with an IGA platform, many organizations fall back to email approvals and spreadsheet tracking for “exceptional” cases. These exceptions quickly become the norm, creating audit gaps.

Insufficient HR integration: Your IGA platform is only as good as your HR data. Delayed termination notifications, missing organizational changes, and inaccurate job titles all create compliance risks.

Generic role definitions: Roles that are too broad (“Developer”) or too narrow (“Database Administrator – Finance – Read Only – Quarterly Reports”) both create management overhead and security gaps.

Performance and Usability Trade-offs

Approval fatigue: Over-engineered approval workflows that require multiple approvals for low-risk access lead to rubber-stamping and delayed productivity.

Integration complexity: Connecting every application in your environment sounds comprehensive but creates maintenance overhead. Focus on business-critical and compliance-scoped systems first.

Real-time vs. batch processing: Real-time provisioning improves user experience but can overwhelm target systems. Design with appropriate delays and retry logic.

Misconfiguration Risks

Privileged account exemptions: Creating “emergency” or “service” accounts that bypass IGA controls defeats the purpose. These accounts need enhanced monitoring, not exemptions.

Incomplete deprovisioning: Disabling accounts in some systems but not others leaves security gaps. Your termination workflow must be comprehensive and verified.

Role explosion: Starting with fine-grained roles seems precise but quickly becomes unmanageable. Begin with broader roles and refine based on actual usage patterns.

The Checkbox Compliance Trap

Documented processes without enforcement: Having written policies that aren’t technically enforced won’t protect you during an incident, even if it satisfies auditors.

Quarterly access reviews without remediation: Running certification campaigns that identify problems but don’t fix them creates liability without improving security.

Metrics without context: Tracking access request processing times without considering approval quality or policy violation rates misses the security value.

Focus on business outcomes: reduced security incidents, faster employee onboarding, and improved audit efficiency — not just compliance checkbox completion.

FAQ

Q: Can we implement IGA with our existing Active Directory and avoid purchasing additional tools?

A: Basic IGA functions like group-based access control and manual access reviews can work with Active Directory alone, but you’ll lack automated workflows, comprehensive reporting, and integration with cloud applications. This approach works for smaller organizations but creates manual overhead that doesn’t scale. For SOC 2 or ISO 27001 compliance, you’ll need more robust audit trails and automated policy enforcement than AD Groups provide natively.

Q: How do we handle contractors and temporary workers in our IGA implementation?

A: Create separate identity lifecycle processes for non-employees with shorter review cycles and automatic expiration dates. Configure your IGA platform to require sponsor attestation every 90 days for contractor access, implement time-limited access grants that require renewal, and ensure contractor accounts are clearly tagged for enhanced monitoring. Many organizations create “contractor” organizational units with stricter policies and shorter access review cycles.

Q: What’s the difference between IGA and PAM, and do we need both?

A: IGA manages the broader identity lifecycle and access governance across all systems, while PAM specifically secures privileged accounts with features like password vaulting, session recording, and just-in-time access. IGA determines who should have privileged access; PAM controls how that access gets used. Most mature security programs need both — IGA for governance and policy enforcement, PAM for privileged account security and monitoring.

Q: How do we measure IGA program effectiveness beyond compliance requirements?

A: Track operational metrics like mean time to provision access (should decrease), access review completion rates (should increase), and policy violation detection speed (should be real-time). Security metrics include reduced orphaned accounts, faster incident response for compromised accounts, and fewer access-related