Skip to content
Best IAM ToolsBest IAM Tools

LESSON 03 · THE FIVE JOBS

Identity governance explained: what IGA adds to an identity provider

Short answer

Identity governance and administration (IGA) decides who should have access and proves it. It runs joiner, mover and leaver changes from the HR system, routes access requests for approval, runs periodic access reviews, and keeps the evidence auditors ask for. An identity provider can create accounts; governance decides and records why.

By The Access Desk · Best IAM Tools

2 min read

What four things does governance do?

  1. Lifecycle: when HR records a hire, a role change or a departure, governance grants, changes or removes access. Microsoft describes lifecycle workflows that run before a start date, on status changes and at leave; Okta, Lumos and C1 describe HR-triggered workflows.
  2. Requests: a person asks for access, an owner approves, and the grant is recorded.
  3. Reviews: managers or application owners confirm at intervals that access is still needed. SailPoint documents Manager, Source Owner and Search campaigns.
  4. Evidence: who approved what, when access was removed and which reviews happened. SailPoint describes collecting audit evidence automatically.

Inside your identity provider or beside it?

Two governance products are tied to an identity provider: Okta Identity Governance requires Okta Workforce Identity, and Microsoft Entra ID Governance requires Entra ID P1 or P2. The others in our sources, SailPoint, Saviynt, Veza, C1 and Lumos, are separate platforms. A tied product means one vendor and one console. A separate one can be chosen on its own merits and kept if you change identity provider.

Why are movers the hard case?

Joiners get access because someone needs them productive. Leavers lose access because an audit tests it. Movers often keep old access, because nothing breaks when it stays. Veza describes role-change automation, and Lumos and C1 describe workflows triggered by HR changes. Access reviews are the backstop.

Where does governance stop?

Governance acts through connectors. An application without one is handled with a ticket or a CSV file. Microsoft's documentation for applications that do not support provisioning describes exactly that: export users to CSV, match them, run an access review, and optionally open a ServiceNow ticket for the removal. That is where the application coverage job starts.

What do auditors connect it to?

NIST SP 800-53 control AC-2 covers account management. DORA applies to EU financial entities from 17 January 2025. PCAOB AS 2201 tells auditors that the identification of risks and controls within IT is not a separate evaluation. Governance produces the records these frameworks ask about.

What should you ask a governance vendor?

  • Which of our HR system and top applications do you connect to today?
  • How are applications with no connector handled, and who does the work?
  • Which review types can run, and how are revoked items removed?
  • What evidence can we export, and in which format?

Sources

Next lesson · L04

Privileged access basics: standing access, just-in-time grants and secrets

What counts as privileged, why standing admin rights are the problem, and where machine secrets fit.