Identity governance and administration (IGA) is the set of processes and tools that decide who should have access to which systems, grant it, review it and remove it. Its core pieces are lifecycle workflows, access requests, periodic reviews and least privilege, so access matches job roles over time.
What problem does IGA solve?
Access builds up. A person joins, gets standard accounts and then more as projects come and go. Nobody removes the old ones. After two years, an analyst may have write access to systems they have not touched since the first quarter.
The risks are plain: an attacker who phishes that person gets everything they have, an auditor asks who can approve payments and nobody can answer, and a leaver keeps a forgotten account.
NIST's glossary defines least privilege as the principle that a system should restrict users, or processes acting for them, to the minimum access needed to do assigned tasks. IGA is how an organization keeps that principle true after day one.
What are the main parts?
Lifecycle management. Joiners, movers and leavers trigger access changes. A new hire in finance gets finance access. A move to sales removes it. A leaver loses everything on their last day. The HR record is usually the source of truth.
Access requests and approvals. People ask for access through one path, with a manager or system owner approving. A record shows who approved what and why.
Access reviews, sometimes called certifications. On a schedule, owners confirm that each person still needs each access. Reviewers revoke what is not needed. Reviews are where stale access surfaces.
Roles and policies. Group access into roles that match jobs, and write rules such as separation of duties, so one person cannot both create and approve a payment.
Reporting. Evidence of who had access when, for auditors and incident responders.
How is IGA different from access management?
Access management (single sign-on, multi-factor authentication) decides at login time whether a person may enter. IGA decides, ahead of time and continuously, what they should be allowed to enter. One is the door lock. The other is the list of who holds keys.
What does a failure look like?
A constructed example: a 400-person company runs an access review each year with a spreadsheet. Managers receive 80 rows each and approve all of them in ten minutes because rejecting something might break a colleague's work. Six months later, a contractor's account, never removed, is used in a breach.
The fix is practical. Shorter reviews, scoped to high-risk systems first. Defaults that remove access unless confirmed. Contractor accounts with an end date set at creation. Automation that removes access when an HR record changes.
How does this connect to compliance?
Many frameworks expect controls around account management, least privilege and periodic review. IGA records are often the evidence. A framework explains what must be true. IGA is one way to prove it, but a good process with clean records can meet the same need at a small scale.
How to check or apply this
- List your critical systems: finance, source control, production, customer data, identity provider.
- For each, export who has access and compare against HR records. Remove accounts for people who left.
- Name an owner per system who can approve and review access.
- Set one request path, for example a ticket form, and refuse access by chat message.
- Run a review of the top five systems this quarter. Default to removing access that no one confirms.
- Set end dates on all contractor and temporary accounts at creation.
- Define two or three separation of duties rules and check them every review.
Quick check
Do small companies need IGA software?
Not at first. A clear owner per system, an HR-driven leaver process and a regular review can work with spreadsheets. Software helps when volume makes manual work unreliable.
What is the difference between a mover and a leaver?
A mover changes roles inside the company and should lose access tied to the old role. A leaver departs and should lose all access.
Sources
Last reviewed: 18 October 2026.
