Identity governance and administration (IGA) is the cybersecurity discipline that manages regulatory compliance for digital identities and user access rights in a computer system. IGA helps organizations comply with security regulations and mandates by controlling who has access to what resources, why and for how long.
As organizations manage thousands of user accounts across on-premises systems, cloud services and software as a service (SaaS) apps, tracking who has access to what becomes increasingly complex.
Each digital identity—whether representing a user, device or application—is a potential gateway to critical systems and sensitive data. Without proper governance, this sprawling ecosystem creates significant security risks and compliance challenges.
According to the IBM® Cost of a Data Breach Report, stolen or compromised credentials are the most common initial breach vector, responsible for 16% of data breaches. When hackers get their hands on legitimate credentials, they can move freely through networks, accessing sensitive data and systems.
Identity governance and administration solutions help protect against identity-based attacks and prevent potential data breaches.
IGA tools can automate user provisioning, implement access policies and conduct regular access reviews throughout the entire identity lifecycle, from onboarding through deprovisioning at offboarding. These functions give organizations more oversight over user permissions and activity, which makes it easier to detect—and stop—privilege misuse and abuse.
IGA solutions also help ensure ongoing regulatory compliance with mandates such as the General Data Protection Regulation (GDPR), the Health Insurance Portability and Accountability Act (HIPAA) and the Sarbanes-Oxley (SOX) Act. IGA helps ensure that access to sensitive systems and data is correctly assigned and regularly reviewed, while generating audit trails to support both internal and external audits.
Industry newsletter
Stay up to date on the most important—and intriguing—industry trends on AI, automation, data and beyond with the Think newsletter. See the IBM Privacy Statement.
Your subscription will be delivered in English. You will find an unsubscribe link in every newsletter. You can manage your subscriptions or unsubscribe here. Refer to our IBM Privacy Statement for more information.
IGA and identity and access management (IAM) are related but distinct frameworks within identity security. IAM deals with how users access digital resources, while IGA helps ensure that people use their access appropriately.
IAM handles the operational aspects of identity security, such as password management, authentication, authorizing day-to-day access and managing accounts. IGA extends IAM by adding governance capabilities, including oversight, policy enforcement and compliance functions.
One can think of IAM and IGA as addressing a set of complementary questions:
In practice, organizations implement IAM and IGA tools together. For example, if a financial analyst transfers to marketing, IAM handles the technical aspects of changing access privileges, while IGA helps ensure that those changes align with company policies.
IGA solutions emerged to help organizations manage the growing complexity of enterprise IT environments, shifting cyberthreat landscapes and evolving compliance mandates.
Enterprise networks now span on-premises systems, private and public cloud providers, remote workstations and numerous SaaS applications. This complexity makes manual identity governance nearly impossible, and it increases security risks.
IGA solutions help address complex IT environments through centralized visibility, connectors that link disparate systems and automation of core workflows.
Many identity governance solutions provide unified dashboards and management consoles that enable centralized visibility and control across diverse environments.
For example, organizations frequently use IGA tools to view all user permissions across cloud services, on-premises systems and third-party applications from a single interface. This helps ensure that organizations can maintain consistent access policies regardless of where applications are hosted.
IGA solutions include connectors, prebuilt interfaces that link applications and platforms within an organization’s technology stack to help enable unified identity governance. Connectors help synchronize user data, convert access policies between systems and maintain consistent controls across previously siloed applications.
For example, a financial services company can use connectors to integrate its core banking system, customer relationship management (CRM) platform and HR database with a central IGA tool. This integration makes it easy to adjust access rights across all systems when an employee’s role changes.
IGA solutions use automation to streamline identity management workflows, eliminate time-consuming manual processes and reduce the number of help desk tickets that IT teams must field. IGA tools commonly support:
Without an IGA solution, IT staff must manually create user accounts in multiple systems when onboarding new employees. IGA tools can streamline this process by automatically provisioning accounts across all required systems in real time based on the user's role.
Cyberattacks have evolved, with threat actors increasingly targeting identities rather than network infrastructure. Traditional perimeter-based security is no longer sufficient when users can access corporate resources from anywhere, on any device.
According to the IBM X-Force® Threat Intelligence Index, the abuse of valid accounts is one of the most common ways that hackers break into enterprise networks, accounting for 30% of cyberattacks.
IGA solutions can help reduce the attack surface and limit damage by enforcing the principle of least privilege. That is, users have only the access necessary to do their job functions—not more, not less.
IGA solutions can also help improve an organization’s security posture in other ways:
To further protect high-risk privileged accounts with elevated access rights, organizations frequently integrate IGA with privileged access management (PAM) tools, which focus specifically on securing privileged accounts, such as admin accounts.
Some IGA solutions also provide real-time threat detection and remediation capabilities to help prevent compliance violations and data breaches.
Compliance requirements such as GDPR, HIPAA, SOX and other mandates impose rules on how organizations handle data. Penalties for noncompliance can be significant. For instance, GDPR violations can result in fines up to USD 22 million or 4% of global annual revenue, whichever is higher.
IGA solutions provide controls and documentation that organizations can use to streamline compliance:
A healthcare provider, for example, can use IGA tools to enforce HIPAA compliance by restricting access to patient records based on job responsibilities and maintaining detailed logs of who accesses records.
IGA tools and practices focus on governing digital identities and access permissions throughout the user lifecycle, from onboarding to offboarding.
The two main components of IGA include identity lifecycle management and access governance.
Identity lifecycle management entails creating, modifying and deactivating user identities as employees join, move within and leave an organization. It can ensure that new users receive appropriate access from day one and that access is promptly removed during offboarding.
If an employee changes roles, IGA tools can automatically revoke outdated permissions and assign new ones based on their updated responsibilities.
Key identity lifecycle management processes include:
Access governance oversees who has access to what resources and helps ensure that access remains appropriate over time. It provides the oversight layer for identity management, focusing on policy enforcement, access reviews and compliance.
Key access governance functions include:
Role-based access control (RBAC) assigns permissions to users based on organizational roles rather than assigning individual permissions to each user. For example, a finance role might authorize a user to make purchases, while a human resources role might authorize a user to see personnel files.
Role management capabilities in IGA solutions help organizations define, manage and maintain roles over time.
With RBAC, IGA solutions can manage access for thousands of users without having to assign individual permissions one by one. When an employee joins, transfers departments or leaves, administrators can simply assign or remove standardized roles rather than reconfiguring dozens of separate system permissions.
Separation of duties (SoD), also called segregation of duties, is a security principle that prevents conflicts of interest by ensuring no single person has excessive access privileges.
IGA solutions help enforce SoD by identifying and preventing combinations of entitlements that can lead to fraud or misuse.
In a procurement process, for instance, the same person should not be able to both add a new vendor to the system and approve payments to that vendor. An IGA solution can flag this arrangement as a SoD violation and either block it entirely or require additional approvals.
Access certification involves periodically reviewing user access rights to ensure they remain appropriate over time. These reviews typically involve managers or resource owners confirming that team members still need their current access privileges.
IGA solutions can help streamline access reviews by automatically initiating reviews on a regular basis. High-risk access rights—such as access to financial systems—might be reviewed more frequently than lower-risk permissions.
Some IGA solutions can also make recommendations for access changes based on usage patterns, such as flagging unused permissions that a user might not need.
Entitlement management is the more granular component of access governance, focusing on the permissions that users have within systems. Put another way: Access governance oversees what users can access, while entitlement management oversees what users can do with that access.
For example, in an accounting system, entitlement management would deal with fine-grained controls such as which users can view financial records, which users can edit them and which users can delete them.
Additional entitlement management capabilities include:
Advances in artificial intelligence (AI) are bringing both new challenges and new opportunities to IGA.
Threat actors are using new generative AI tools to target IGA workflows and controls. For example, by using AI to generate deepfakes and convincing phishing messages, attackers can trick legitimate users into handing over their credentials. More sophisticated actors might even use machine learning (ML) tools to analyze permission structures and identify opportunities for policy evasion to get around IGA controls.
At the same time, vendors are using AI to transform their IGA solutions from static compliance checkpoints into adaptive risk management systems. Some examples of how IGA solutions are using AI include: