Higher education IAM and IGA misunderstandings raise mission risk

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Fischer Identity's blog post: Higher education institutions confuse IAM with IGA, a misunderstanding that drives security, operational, and mission risk.

Why it matters: It matters because identity programmes in universities must govern lifecycle, access, and compliance together, or they will keep leaking effort and exposing institutional services.

Context

Higher education identity programmes often fail at the boundary between authentication and governance. IAM answers who can sign in and reach systems, while IGA governs the lifecycle that creates, changes, reviews, and removes those identities across the institution.

In this article, Fischer Identity argues that many universities still scope IAM as login convenience and under-scope IGA as administrative overhead. The result is a governance gap: duplicate accounts, incomplete deprovisioning, manual workarounds, and compliance exposure that directly affect teaching, research, healthcare, and finance.

That distinction matters because higher education environments are multi-role by design. Students, faculty, researchers, clinicians, alumni, contractors, and visiting scholars all need different access lifecycles, so a programme that stops at authentication cannot keep pace with institutional reality.

Key questions

Q: How should higher education institutions separate IAM from IGA work?

A: Treat IAM as the control layer for authentication and access delivery, and IGA as the control layer for lifecycle governance, provisioning, deprovisioning, and access review. Universities need both, but they should not be scoped or funded as the same problem. Clear separation improves accountability, budget accuracy, and programme outcomes.

Q: Why do universities struggle with duplicate accounts and stale access?

A: The problem usually starts upstream. HR, SIS, and credentialing systems often hold inconsistent identity data, so downstream tools create duplicate records or fail to remove access when affiliations change. In a multi-role environment, that becomes a governance issue because each stale account extends the period during which access can be misused or simply remain unnecessary.

Q: What breaks when identity governance is missing from an IAM programme?

A: The main failure is entitlement drift. Access gets granted correctly at the start, then role changes, project endings, and staff departures create stale permissions that remain active. That weakens segregation of duties, complicates audits, and makes revocation dependent on manual follow-up.

Q: Should higher education teams prioritise access convenience or governance first?

A: Governance first. Single sign-on and MFA improve user experience, but they do not control lifecycle drift on their own. If deprovisioning, access reviews, and role enforcement are weak, convenience only makes access easier to accumulate and harder to unwind. The right sequence is to stabilise lifecycle governance, then expand convenience features on top of it.

Technical breakdown

Why IAM and IGA solve different identity problems

IAM is the control plane for authentication and access to systems, including SSO, MFA, federation, and authorization at sign-in. IGA is the governance layer that manages identity lifecycle, role policy, provisioning, access reviews, and deprovisioning. In higher education, those disciplines are often blended in conversation but not in execution. When that happens, institutions buy login convenience and expect it to deliver lifecycle control, compliance evidence, and role enforcement. It cannot. The architecture works only when authentication and governance are designed as separate but connected controls.

Practical implication: Model IAM and IGA as distinct control layers so project scope, ownership, and evidence requirements stay aligned.

Why duplicate accounts and incomplete deprovisioning persist

Duplicate accounts often emerge when source data is fragmented across HR, SIS, credentialing, and departmental systems. If the upstream identity source is inconsistent, downstream access tooling will create parallel identities or leave stale ones active. In higher education, that is more than an efficiency problem because students, employees, and affiliates can move across roles quickly. Deprovisioning failures are especially dangerous because access may outlive the need for it. That creates unnecessary exposure in systems holding research, patient, or administrative data.

Practical implication: Treat identity data quality and deprovisioning as lifecycle controls, not help desk cleanup tasks.

How lifecycle governance supports mission resilience

Lifecycle governance is the practical mechanism that keeps identity aligned to institutional change. It covers joiner-mover-leaver events, entitlement reviews, role enforcement, and revocation when affiliations end. In a university, those transitions happen constantly across semesters, appointments, and sponsored projects. Without governance, each move creates access sprawl and manual exceptions that slow staff and frustrate users. The operational cost is visible, but the mission cost is larger because delayed access for faculty, researchers, or clinicians directly affects delivery of core services.

Practical implication: Anchor identity decisions to lifecycle events so access changes happen when affiliations change, not after drift accumulates.

Threat narrative

Attacker objective: The practical end state is unauthorised or unnecessary access that can be abused for data exposure, compliance failure, or operational disruption.

1. Entry occurs when fragmented identity data or unmanaged onboarding creates duplicate or excessive accounts in university systems.
2. Credential or account scope persists because deprovisioning and lifecycle governance are incomplete, leaving access active after the relationship changes.
3. Impact follows when stale access, manual exceptions, and fragmented credentials create compliance exposure, operational drag, and mission disruption.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.
• Internet Archive breach 2024: An exposed GitLab token opened Internet Archive code and 31 million user records; unrotated Zendesk tokens let the attacker back in weeks later.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Higher education identity failures are usually governance failures, not authentication failures. Universities often buy login controls and then expect those controls to solve lifecycle, role, and compliance problems. That expectation breaks because authentication proves a user can enter a system, while IGA determines whether the right identity exists, still needs access, and should keep it. The practitioner conclusion is straightforward: identity strategy has to be organised around lifecycle governance, not sign-in convenience.

IAM and IGA should be treated as separate disciplines with a shared operating model. Conflating them creates scope confusion, weak accountability, and bad purchasing decisions. IAM manages authentication and access entry points, while IGA manages entitlement creation, review, and removal across changing roles. The practitioner conclusion is that higher education programmes need explicit design boundaries between access enablement and governance evidence.

Mission risk emerges when identity work is framed as back-office administration. In higher education, identity supports teaching, research, healthcare, and institutional continuity, so delays or errors ripple beyond IT. When access is delayed for a new student, a researcher, or a clinician, the institution absorbs both operational friction and reputational damage. The practitioner conclusion is that identity should be scoped as mission infrastructure, not a technical utility.

Duplicate identities are a governance symptom, not just a data-quality defect. Fragmented source systems create multiple identity records, but the deeper issue is that lifecycle decisions are not being enforced consistently across the institution. That leaves overlapping access paths and weak offboarding control. The practitioner conclusion is to evaluate how joiner-mover-leaver processes and source-of-truth design interact before assuming the problem is purely technical.

Lifecycle governance is the named control gap that keeps recurring in this sector. This article shows that incomplete provisioning, poor deprovisioning, and weak access reviews are not isolated mistakes but a repeated assumption that identity state will stay stable long enough to manage later. In higher education, that assumption fails because affiliations change constantly. The practitioner conclusion is to design governance around change, not around static accounts.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Access Reviews and Certification Guide

What this signals

Lifecycle governance is the control plane universities keep underestimating. Identity work in higher education cannot stop at authentication because the real exposure arrives when affiliations change faster than entitlement cleanup can keep pace. Programmes that govern joiner-mover-leaver events well will reduce both access sprawl and the operational drag that comes from constant exception handling.

Role complexity is now the normal state of higher education identity. Faculty, students, clinicians, researchers, alumni, and contractors all require different access lifecycles, so the programme has to be designed for fluid identity state rather than stable employee records. That is why governance and data quality belong in the same operating conversation, not separate project tracks.

For practitioners

• Define the IAM/IGA boundary explicitly Separate authentication, federation, and MFA requirements from provisioning, access review, and deprovisioning requirements before tool selection or project scoping.
• Fix identity data at the source Work with HR, SIS, and credentialing owners to correct upstream identity data so lifecycle workflows are not compensating for broken records.
• Prioritise lifecycle governance before convenience Sequence the programme so joiner-mover-leaver handling, deprovisioning, and access certification are stable before expanding single sign-on or self-service.
• Build controls for external identities Extend governance to alumni, contractors, volunteers, visiting scholars, and patients so non-employee access follows the same lifecycle discipline as staff access.
• Require identity specialists in complex programmes Use practitioners who understand higher education role complexity, because general IT delivery without identity expertise often underestimates governance, compliance, and deprovisioning risk.

Key takeaways

• Higher education identity risk often comes from confusing authentication with lifecycle governance, not from a single tool failure.
• Incomplete deprovisioning, duplicate accounts, and fragmented identity data turn routine access management into recurring security and mission risk.
• Universities need to sequence IAM and IGA deliberately so governance, source data, and role change are controlled before convenience features expand access further.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Identity And Access Management: Identity and Access Management is the discipline of controlling who or what can access systems, data, and services. It covers identity lifecycle, authentication, authorization, provisioning, deprovisioning, and policy enforcement across users, devices, applications, and non-human identities, so access is granted only to approved entities under defined conditions.
• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.