The control breaks at speed and completeness. HR and directory feeds are useful inputs, but they do not reflect direct app grants, SaaS-side changes, or non-human access in real time. That creates stale entitlements, delayed revocation, and weak certification evidence, especially where access changes faster than batch sync cycles can keep up.
Why access truth breaks when HR or directory sync is treated as the source of record
HR and directory feeds are valuable for onboarding and coarse lifecycle state, but they are not the same as authoritative access truth. IGA only stays accurate when it can reconcile what the business says should exist with what applications, SaaS platforms, and non-human principals actually have. When the sync layer is treated as truth, the model inherits whatever those feeds fail to see.
That matters because access is often granted, changed, or extended outside the HR event path. App admins, SaaS consoles, delegated owners, scripts, integrations, and service identities can create real access that never appears in the directory at the moment it changes. In practice, the “truth” becomes a lagging approximation rather than a current entitlement view.
A stronger operating model is to treat HR as a lifecycle trigger and the directory as one input, not the complete decision surface. The access record needs to reconcile direct grants, entitlement drift, and non-human access paths across systems, or the governance layer will certify stale state with confidence.
Where stale entitlements and delayed revocation come from
The main failure mode is timing. Batch syncs are good at eventual consistency, but access governance needs near-real-time accuracy for high-risk changes such as terminations, role moves, emergency access, and privileged app grants. If revocation waits on the next feed, the window between business change and enforcement becomes the exposure.
That window widens when access is controlled in more than one place. An employee can leave in HR, lose directory status, and still retain direct SaaS entitlement, token-based access, or app-local permission until the next reconciliation run. The same pattern applies to contractors, shared operational accounts, and machine credentials that never map cleanly to human lifecycle events.
For the underlying access lifecycle, the practical question is whether the control can see and remove the actual privilege, not just the upstream personnel record. Joiner-Mover-Leaver (JML) Guide is useful here because it frames lifecycle handling around revocation, role change, and non-employee access rather than HR events alone.
Why certification evidence weakens when the access graph is incomplete
Access certification is only as good as the population it reviews. If the IGA tool builds its review list primarily from HR or directory joins, then anything granted directly inside an application, inherited through SaaS administration, or held by a non-human identity can fall outside the review scope. The result is a report that looks complete but is only complete for the systems that were synchronized.
That creates two problems at once. First, stale entitlements survive because reviewers never see them. Second, the evidence used to prove control effectiveness becomes brittle, because the certification output reflects the sync model rather than the real entitlement state. Auditors and security teams then have to decide whether the evidence demonstrates actual review coverage or simply clean connector hygiene.
Good governance depends on review scope that follows the entitlement, not just the employee record. Access Reviews and Certification Guide is directly relevant because it focuses on closing the loop on reviews, including non-human access and remediation discipline. IAM and IGA Basics also helps distinguish provisioning sources from authorization truth so reviewers do not confuse lifecycle inputs with effective access.
Risk and Threat Considerations
When HR and directory feeds are treated as access truth, the main risk is silent privilege persistence. Attackers and insiders benefit from any delay between an access change and its removal, because stale entitlements, orphaned app grants, and unrevoked non-human access can remain usable after the business believes they are gone.
Failure mechanism: The control fails when reconciliation only checks upstream identity records, while the real grant lives in an application, SaaS admin plane, token, or machine credential that is not updated on the same cycle.
Impact: Revocation is delayed, certifications miss live access, and excessive privilege can survive long enough to enable misuse, lateral movement, or abuse of trusted integrations.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 sets the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Sync lag often leaves credentials and tokens valid after lifecycle change. |
| AC-2 — Account Management | IGA depends on complete account inventories and timely disablement across systems. | |
| AU-6 — Audit Review, Analysis, and Reporting | Certification needs evidence from actual entitlement sources, not only synced HR records. | |
| Recommendation — Track and revoke authenticators when effective access changes, not only when HR status changes. Maintain authoritative account state across apps and remove inactive or orphaned access promptly. Review audit and entitlement evidence from the systems that enforce access before certifying. | ||
| ISO/IEC 27001:2022 | A.5.16 — Identity management | Identity records must align with effective access across joined and non-joined systems. |
| A.5.18 — Access rights | Stale entitlements and delayed revocation are direct access-right failures. | |
| Recommendation — Keep identity records aligned to actual account and entitlement state across all platforms. Review, revoke, and validate access rights across applications rather than relying on HR feeds alone. | ||
Practitioner Guidance
What to verify: Verify that every critical application has a path to surface effective access, direct grants, and delegated admin changes, not just directory-linked memberships. If the system cannot expose its own entitlement state, treat its access data as incomplete for certification and recertification.
Decision rule: If a revocation or role change can be applied outside the HR feed, it must be governed by a reconciliation mechanism that is faster than the business risk. For privileged or sensitive access, do not wait for the next batch sync when the app itself can remove access immediately.
Practitioner takeaway: HR and directory data are lifecycle signals, but access truth comes from the systems that actually enforce privilege. The control is only trustworthy when it can reconcile and revoke the real entitlement, including non-human access, before the next sync cycle.
Related resources from NHI Mgmt Group
- Why do HR, directory, IGA, and PAM controls often miss dormant access after offboarding in hybrid environments?
- How should security teams run access reviews for non-human identities?
- How should security teams govern non-human identities that have persistent access?
- When do NHI access reviews create more value than a one-time cleanup?