TL;DR: Microsoft Entra provides strong enforcement for authentication, conditional access, PIM, and lifecycle provisioning, but OpenIAM’s analysis argues that enterprise governance still breaks across SaaS, ERP, legacy systems, and federated domains where access must be validated continuously. The real gap is not platform control, but governance scope.
At a glance
What this is: This is an OpenIAM analysis of why Entra can enforce identity decisions well while enterprise governance still fails across hybrid, federated, and multi-system environments.
Why it matters: It matters because IAM and IGA teams must govern access where it actually exists across SaaS, ERP, legacy, and federated systems, not just inside one platform.
Context
Microsoft Entra can enforce authentication, access policies, privileged elevation, and provisioning within its own scope. The problem starts when enterprises assume those controls equal complete governance across the rest of the estate.
Enterprise identity governance is a cross-system discipline. When entitlements, ownership, and review responsibility spread across SaaS, ERP, legacy applications, and federated domains, the control boundary becomes smaller than the risk boundary.
OpenIAM’s argument is that the governance model, not the platform, is where most organisations drift out of alignment. That is typical in hybrid enterprises, where the access model is broader than any single identity stack.
Key questions
Q: What breaks when identity governance is missing from an IAM programme?
A: The main failure is entitlement drift. Access gets granted correctly at the start, then role changes, project endings, and staff departures create stale permissions that remain active. That weakens segregation of duties, complicates audits, and makes revocation dependent on manual follow-up.
Q: When should organisations extend access governance beyond Entra?
A: They should extend it whenever access spans SaaS, ERP, legacy systems, or federated identity domains that hold entitlements outside Entra’s direct visibility. At that point, platform-local review no longer equals enterprise governance, and audit readiness depends on cross-system validation rather than directory-level checks alone.
Q: How can security teams tell whether privileged access reviews are actually working?
A: They are working when every privileged entitlement is inventoried, every decision is traceable, and revoked access is removed from all connected systems without delay. If the organisation can only show approvals but not downstream revocation, the review is administrative recordkeeping rather than governance. Proof of removal is the best maturity signal.
Q: What is the difference between IAM and identity governance?
A: IAM enforces access at runtime, while identity governance decides which access should exist in the first place and whether it remains appropriate. IAM handles authentication and permission checks. Governance handles policy, approvals, certifications, segregation of duties, and revocation. Both are needed, but governance is what makes access defensible to auditors and risk teams.
Technical breakdown
Why enforcement and governance are not the same control
Enforcement answers whether access is allowed at the moment of decision. Governance answers whether that access should still exist after roles, risk, and business context change. Entra is strong at the first problem because it applies access decisions inside a defined control plane. It is not a complete governance layer because governance requires continuous validation across systems that do not share the same entitlement model, lifecycle state, or audit context. Once access spans multiple platforms, the question is no longer permission at login but entitlement legitimacy over time.
Practical implication: separate access enforcement from governance coverage in your operating model and measure both independently.
How hybrid identity models fragment access review control
Access reviews work best when the reviewer can see the entitlement, the owning system, and the business reason for access in one place. In hybrid environments, those three pieces are often split across Entra, Active Directory, SaaS platforms, ERP systems, and legacy tools. The result is that reviews become snapshot exercises, not validation of actual risk. A role review may look complete while the underlying fine-grained entitlement persists elsewhere, which means the governance action is real only in the narrowest system boundary.
Practical implication: extend review scope to the systems that actually hold the entitlements, not just the directory that federates them.
Why governance scope must follow business risk, not platform boundaries
A platform boundary is an administrative convenience, not a risk boundary. Business risk follows data sensitivity, privilege level, cross-system dependency, and ownership ambiguity. That is why platform-aligned governance produces blind spots: the highest-risk access paths are often the ones that cross system and organisational boundaries. Identity governance becomes effective only when it is designed around business roles, entitlement relationships, and evidence requirements that survive outside the primary IAM platform.
Practical implication: build governance scopes around business-critical access paths and audit needs instead of mirroring the structure of a single vendor stack.
NHI Mgmt Group analysis
Governance fails between systems, not inside them: Entra can enforce decisions effectively within its own control plane, but enterprise governance is broken when access state, ownership, and validation live in different systems. That is a boundary problem, not a feature gap. The implication is that governance architecture has to be designed for cross-system truth, not platform-local certainty.
Identity governance scope is the real control variable: Many enterprises mistake directory-centred visibility for enterprise-wide coverage. Once SaaS, ERP, legacy, and federated domains enter the model, the organisation must treat governance scope as a first-class design choice. Practitioners should read this as a reminder that the unit of governance is the access relationship, not the product that issued it.
Entra-first does not mean Entra-only: The article correctly distinguishes enforcement from oversight. That distinction matters because lifecycle provisioning, JIT elevation, and access reviews only create governance value when the underlying entitlement fabric is visible and continuously validated. The practical conclusion is that control effectiveness depends on where validation occurs, not which platform initiated the access decision.
Cross-system entitlement drift is a governance debt problem: When role definitions diverge, ownership fragments, and review processes split across hybrid environments, organisations accumulate identity governance debt. Over time, that debt shows up as incomplete recertification, weak remediation proof, and audit evidence that reflects the directory instead of the enterprise. Teams should expect governance maturity to lag unless they deliberately unify entitlement visibility.
Enterprise identity governance requires a broader operating model than IAM alone: IAM can grant and deny access, but IGA has to prove the continuing legitimacy of that access across business systems. That is why mature programmes align with NIST-CSF PR.AA-05 for entitlement governance and use lifecycle controls only as one part of a wider validation model. The conclusion is simple: govern access where risk lives, not only where authentication occurs.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
What this signals
Identity governance debt: hybrid environments accumulate unresolved access relationships when entitlement visibility, ownership, and review responsibility are split across systems. The longer that fragmentation persists, the harder it becomes to prove that access decisions remain correct across the enterprise.
Most programmes still overestimate directory coverage and underestimate cross-system entitlement drift. That is why governance maturity depends less on adding another enforcement layer and more on building a validation model that survives outside the primary platform.
NIST SP 800-63 Digital Identity Guidelines is useful context here because the article’s core issue is not authentication weakness but the difference between identity assurance and access governance across changing environments.
For practitioners
- Define the governance boundary beyond the directory Map every system that holds authoritative entitlements, including SaaS, ERP, legacy, and federated applications, and assign governance ownership to each path.
- Rebuild access reviews around fine-grained entitlements Stop treating role review as a proxy for enterprise coverage. Include the applications and integration points where access is actually enforced or inherited.
- Separate enforcement reports from governance evidence Track whether access was granted correctly and whether it remained justified over time as two different control outcomes with different evidence sources.
- Align remediation to cross-system access removal Verify that deprovisioning, entitlement revocation, and exception closure all complete across every connected system, not only in Entra.
Key takeaways
- Entra can enforce access well, but enterprise governance fails when entitlement validation stops at the platform boundary.
- Hybrid environments introduce fragmented ownership, inconsistent role models, and review processes that can miss access still active elsewhere.
- The practical fix is to align governance scope with business risk and cross-system entitlements, not with the structure of one IAM product.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article's boundary problem applies to non-human entitlements whose scope exceeds one platform. |
| Recommendation — Map cross-system entitlement drift to NHI-05 and verify access scope outside the primary IAM boundary. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article focuses on validating whether access remains appropriate across changing systems and roles. |
| Recommendation — Use PR.AA-05 to govern entitlements across the full enterprise access landscape, not a single platform. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The governance gap emerges when least privilege is enforced locally but not sustained across systems. |
| Recommendation — Apply AC-6 to review whether access remains minimally necessary after it crosses platform boundaries. | ||
| CIS Controls v8 | CIS-5 — Account Management | Hybrid identity governance depends on account ownership and timely removal across all connected systems. |
| Recommendation — Use CIS-5 to track account ownership and remove stale access across every integrated application. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- Policy Enforcement Layer: The control plane that decides whether a tool call, request, or action is allowed. It is distinct from model reasoning because it produces deterministic allow or deny decisions, which is essential when an AI system can act faster than a human reviewer.
- Enterprise-Wide Access Validation: The process of confirming that access remains appropriate across all systems where it exists, including SaaS, ERP, legacy, and federated domains. It is stronger than a local review because it checks the actual access state, not only the control that issued it.
- Cross-domain entitlement drift: A mismatch between what one system says a person can access and what another system still allows. In mixed physical and digital environments, it appears when badge systems, IAM platforms, and approval workflows update at different speeds or under different ownership.
Deepen your knowledge
NHI governance, identity lifecycle management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM or IGA programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org