What Is Identity Governance and Administration?

Identity governance and administration (IGA) is a policy-based approach to identity management and access control. As the name implies, IGA systems merge identity governance and identity administration to provide additional functionality beyond traditional identity and access management (IAM) tools. Particularly, they offer valuable support in auditing and meeting compliance requirements. 

IGA systems can also help automate workflows for provisioning and deprovisioning users. This is especially important given the growing need for users to log on from any place and device, which makes identity and access management difficult to manage.

Before we explore how IGA can support you and whether it makes sense for your organisation, let’s define its components:

• Identity governance: Processes and policies that cover the segregation of duties, role management, logging, access reviews, analytics, and reporting.
• Identity administration: Account and credential administration, user and device provisioning and deprovisioning, and entitlement management.

While an IGA solution will make a lot of sense for most organisations, implementing it can be difficult and time-intensive. As such, it’s important to fully understand what identity governance and administration is before getting started. So, let’s get started.

The history and evolution of identity governance and administration

The need for identity governance and administration solutions emerged alongside stringent data regulations such as the Sarbanes-Oxley Act (SOX) and the Health Insurance Portability and Accountability Act (HIPAA), which required improved transparency and data management. Supporting organisations in these efforts, IGA systems were designed to give organisations better visibility into identity and access privileges and provide better controls with which to detect and prevent inappropriate access to their resources.

The importance of IGA security was recognised when, in 2012, Gartner named it the fastest-growing sector of the identity management market. Then, in 2013, the analyst house launched its first Magic Quadrant for Identity Governance and Administration, which merged its two existing Identity Governance and Identity Administration categories, further solidifying it as an area of priority for organisations. 

The parts that make up an IGA solution

Identity governance and administration solutions help businesses with the lifecycle management of their user identities. Specifically, an identity governance and administration solution works with IAM tools to:

• Manage passwords: Tools like password managers and single sign-on prevent your users from using the same weak passwords across applications, protecting your organisation from a potential breach.
• Automate workflows: You can create automated workflows for processes like onboarding and offboarding users, providing certain roles with different levels of access, and approving user access to applications and systems.
• Manage permissions: Businesses can streamline the review and verification of user access to various apps and resources and automatically provision and deprovision access permissions at the user and application level. Furthermore, they can also specify and verify the actions that users are able to carry out in various applications and define and manage access through user roles.
• Ensure compliance through comprehensive reporting: With logging, reporting, and analytics functionalities, companies can remain compliant with industry-specific and general data-focused regulations. These tools can also help identify potential optimisation opportunities or risks.
• Scale your organisation: Centralised policies for identity management help to streamline processes across various applications—whether they’re on-premises or on the cloud. This allows your own developers to focus on the work they do best, enhancing your custom application and organically growing your customer audience. 

Together, these components work together to enhance how you manage identity.

Common misconceptions about identity governance

While identity governance and administration is a key part of a robust IAM solution, there are many misconceptions around what it looks like in practice: 

#1 IGA is the same as identity management

Wrong. While IGA and IAM go hand in hand—they’re not the same thing. IGA goes beyond standard IAM systems by helping businesses to administer identities, meet compliance requirements, and audit processes for compliance reporting. 

#2 IGA solutions are only available on-premises 

Incorrect. Like many technologies, early identity governance solutions did live on-prem, but have since moved largely to the cloud. For example, access certifications, access requests, password management, and provisioning are all available as cloud-based services.

#3 IGA can’t manage cloud applications

Not true. Leading identity governance and administration solutions offer rich connectivity options for businesses to unify cloud and on-premises resources. All identity governance capabilities are cross-domain, which means they can be used to manage both cloud and on-prem applications.

#4 Businesses that don’t have to comply with regulatory compliances don’t need IGA

False. Identity governance is critical to any security strategy. Hackers are constantly on the lookout for user credentials to steal, which makes it crucial for businesses to keep malicious actors out of their corporate systems. Regardless of whether a business needs to comply with regulations, it is imperative that they protect their user accounts and privileges and ensure they have effective access controls.

#5 IGA is only relevant to big businesses

That’s inaccurate. Managing access controls and having a robust process for managing access to your systems is important regardless of your size. For small businesses that are looking to scale and grow their customer base, implementing IGA processes can ensure that they are proactively compliant with regulations that might target larger companies. 

Does an IGA solution make sense for your organisation?

There are several benefits to implementing an IGA solution: 

• Your users have timely access to the resources they need
• You have the ability to manage access requests and oversee risk
• You can meet service level requirements without compromising security, using automated policy enforcement
• You can verify that the right controls are in place to meet security and privacy requirements stipulated by ever-stringent data regulations

But does your organisation need an IGA solution? While your instinct might be to make this decision based on the size of your workforce—it should really come down to your IT team. How many requests are they receiving for certification, provisioning, and deprovisioning? Are they able to process all those requests in a timely manner while still focusing on other aspects of their job? Would it be beneficial to automate these processes?

An IGA solution eases the pressure on the IT team, enabling the business to automate workflows that provision access requests by role and carry out bulk approvals. Regardless of organisation size, it’s important to consider how important security is and be aware of the risk of breaches created by gaps between incorrect access and security concerns. 

Strengthen your business with IGA

An identity governance and administration solution can help businesses to overhaul their security approach by reducing risk, strengthening their identity access management, and improving their compliance and audit performance. It can also help them become more efficient and productive, and reduce their costs by minimising the time spent on administrative and automating labor-intensive tasks.

To learn more about identity governance and administration, check out our Identity 101 page.