TL;DR: IGA platform selection is shifting beyond access reviews, provisioning, and SoD as enterprise identity risk spans SAP, Oracle, Workday, Salesforce, and other business applications, according to Pathlock’s webinar briefing. The practical question is no longer feature parity, but whether governance tooling can evaluate risk across business-critical applications and support a broader control model.
At a glance
What this is: This webinar frames modern IGA evaluation as a broader enterprise identity risk problem, arguing that access reviews, provisioning, and SoD alone no longer cover the full control surface.
Why it matters: It matters because IGA teams now have to assess whether governance controls extend across core business applications and support risk decisions that survive audit, business change, and application sprawl.
Context
Choosing an IGA platform has become a broader identity risk decision, not just a feature comparison. As SAP, Oracle, Workday, Salesforce, and other business applications expand the control surface, legacy evaluation criteria can miss where risk actually accumulates.
The webinar positions platform selection around enterprise-wide governance rather than isolated access review workflows. That is the right shift for organisations that need to align identity controls with business applications, segregation of duties, and evidence that the programme can scale beyond one system or one team.
Key questions
Q: How should teams evaluate an IGA platform when identity risk spans enterprise applications?
A: Teams should evaluate whether the platform can govern access, roles, SoD, and evidence consistently across the full application estate, not just in one system. The key test is whether it can support the organisation’s real risk surface across ERP, SaaS, and other business-critical applications without fragmenting governance into disconnected workflows.
Q: What breaks when IGA evaluation focuses only on access reviews and provisioning?
A: The evaluation misses where risk accumulates across applications, so governance looks complete on paper while entitlements, SoD conflicts, and audit evidence remain fragmented. That usually leads to weak comparisons between products, because the platform is judged on task completion instead of enterprise control coverage.
Q: When should organisations prioritise broader identity risk coverage over feature parity?
A: They should prioritise broader identity risk coverage once governance spans multiple business-critical applications and the organisation needs evidence that controls work across systems. At that point, feature parity matters less than whether the platform can support consistent policy enforcement and defensible oversight.
Q: What is the difference between classic IGA and modern enterprise identity risk governance?
A: Classic IGA focuses on access reviews, provisioning, and segregation of duties inside a narrower control model. Modern enterprise identity risk governance extends those controls across the application estate, so the platform must manage risk, evidence, and policy consistency where business systems intersect.
Background and context
Why access reviews are no longer a sufficient IGA test
Access reviews, provisioning, and segregation of duties remain necessary, but they are no longer a complete evaluation model when identity risk spans multiple enterprise applications. Modern IGA has to account for how entitlements, business roles, and approval paths interact across SAP, Oracle, Workday, Salesforce, and adjacent systems. The technical issue is not only whether a platform can move access data, but whether it can model risk consistently across heterogeneous application types and governance workflows.
Practical implication: assess whether the platform can express and enforce the same governance logic across all critical applications, not just one core system.
What a broader identity risk model adds to IGA architecture
A broader identity risk model connects entitlement governance to business context, application criticality, and control exceptions. That means the platform must support more than recertification cycles and provisioning flows. It needs visibility into where risky combinations of access appear, where SoD logic breaks down across systems, and how governance evidence is preserved when applications differ in data model, integration style, and approval chain.
Practical implication: validate that the platform can surface risk patterns across applications, rather than treating each application as a separate governance island.
How comparison frameworks change when enterprise applications drive risk
Once identity risk extends across enterprise applications, evaluation frameworks should focus on control coverage, policy consistency, and evidence quality rather than feature parity alone. This changes the architecture question from 'can it do access reviews?' to 'can it help govern the full entitlement lifecycle across business-critical systems?' The practical challenge is aligning platform capability with the organisation’s actual risk profile, not the minimum procurement checklist.
Practical implication: build your evaluation criteria around control outcomes, cross-application governance, and auditability instead of vendor feature lists.
NHI Mgmt Group analysis
IGA evaluation is now an enterprise identity risk exercise, not a workflow comparison. Once governance spans SAP, Oracle, Workday, Salesforce, and other business applications, the old question of who has an access review button is too narrow. The real question is whether the programme can express risk consistently across business-critical systems and preserve evidence when controls cross application boundaries.
The modern IGA platform must be judged on control coverage, not feature parity. Access reviews, provisioning, and SoD are still core, but they do not by themselves prove that governance can keep pace with enterprise application sprawl. The stronger test is whether the platform can unify policy, exceptions, and audit evidence across heterogeneous systems without fragmenting the control model.
Enterprise identity risk exposes the limits of application-by-application governance. Identity teams that evaluate each platform in isolation often miss how entitlement risk compounds across the business application estate. That creates blind spots in role design, approval flows, and segregation-of-duties enforcement, which is why platform selection has become an architecture decision.
Pathlock’s framework reflects a broader market shift toward governance that can survive business complexity. The category is moving away from simple access administration and toward evidence-rich control models that can support ERP, SaaS, and business application governance together. Practitioners should treat that as a signal to re-check whether their current IGA programme is structurally able to scale.
Modern IGA programmes need a named concept: enterprise identity risk. This is the accumulation of entitlement, workflow, and SoD exposure across the full business application estate, not just a single identity domain. The implication is that evaluation criteria must follow the risk surface, or governance remains partial and fragile.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: IGA Buyer's Guide
What this signals
Enterprise identity risk changes the buying question for IGA teams. The useful comparison is no longer which product has the longest feature list, but which platform can govern risk across the systems that matter to the business. That shifts programme design toward coverage, policy consistency, and audit-ready evidence.
IGA programmes built around individual workflows will struggle to scale cleanly. When entitlement decisions, SoD logic, and recertification evidence sit in separate application silos, the control model becomes harder to defend. Teams should expect evaluation criteria to move toward cross-application governance and away from single-system task automation.
For practitioners
- Define the enterprise application scope first List the systems that actually carry business identity risk, including ERP and SaaS platforms, before scoring any IGA product. Use that scope to prevent a narrow evaluation that only measures classic access review functions.
- Test cross-application SoD enforcement Validate whether SoD rules and exception handling remain consistent when the same entitlement logic spans SAP, Oracle, Workday, Salesforce, and related platforms.
- Measure governance evidence quality Check whether the platform can produce defensible audit evidence for approvals, recertifications, and entitlement changes across all in-scope applications.
- Compare control outcomes, not feature counts Score candidates on how well they reduce risk across the full application estate, rather than on the number of workflows or connectors they expose.
Key takeaways
- Modern IGA evaluation has moved beyond access reviews, provisioning, and SoD because enterprise identity risk now spans the core business application estate.
- The practical buying question is whether a platform can govern entitlement risk and preserve evidence across SAP, Oracle, Workday, Salesforce, and related systems.
- Teams should compare platforms on control coverage and cross-application governance outcomes, not on workflow counts or feature parity alone.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8, NIST SP 800-53 Rev 5 and OWASP SAMM set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is about evaluating control coverage across enterprise entitlement governance. |
| Recommendation — Use PR.AA-05 to assess whether entitlement controls stay consistent across all in-scope business applications. | ||
| CIS Controls v8 | CIS-5 — Account Management | IGA platform evaluation here centres on account and entitlement governance across business systems. |
| Recommendation — Apply CIS-5 to check whether the platform governs account lifecycle and access changes across the application estate. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Broader IGA evaluation still depends on whether the platform can enforce least privilege consistently. |
| Recommendation — Map platform capabilities to AC-6 and verify that least privilege holds across ERP and SaaS applications. | ||
| OWASP SAMM | Governance — Governance | The article is fundamentally about governance maturity in software and business application control models. |
| Recommendation — Use governance criteria to test whether the IGA programme can evidence control outcomes across systems. | ||
Key terms
- Enterprise Identity Risk: Enterprise identity risk is the combined exposure created when access, privilege, and ownership are spread across many systems without a unified governance model. It includes excessive permissions, weak accountability, and hidden cross-application entitlements that make control decisions harder to trust.
- Cross-Application Access Governance: Cross-application access governance is the practice of managing entitlements across multiple systems from a unified control view. It helps teams see how access accumulates across applications, identify excessive permissions, and apply policies consistently when identities, roles, and business processes span a large enterprise environment.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- IGA Platform Evaluation: IGA platform evaluation is the process of comparing identity governance products against real organisational control needs. The useful test is not feature counts, but whether the platform can support entitlement governance, audit evidence, and risk management across the full application landscape.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 4, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org