Identity and access management tools still leave governance gaps

At a glance

What this is: This is an analysis of 13 IAM tools that concludes the category often covers login and provisioning better than entitlement governance and offboarding depth.

Why it matters: IAM teams, IGA leads, and security architects need to distinguish front-door access control from lifecycle governance, because the residual risk sits in approvals, reviews, and deprovisioning across SaaS and non-SCIM systems.

Context

IAM tools are commonly introduced as the control layer for authentication, SSO, MFA, provisioning, and audit trails, but those capabilities do not by themselves guarantee governance over entitlement depth or lifecycle closure. The article’s central claim is that many organisations still rely on tools that manage access entry better than access ownership after authentication.

The practical issue is not whether users can sign in. It is whether teams can see what level of access exists, decide whether it should exist, and remove it cleanly when roles change or people leave. That is the governance gap the article argues many IAM programmes still carry.

Key questions

Q: What breaks when IAM tools only cover authentication and SSO?

A: The programme loses visibility into who should retain access after login, which approvals created that access, and whether offboarding actually removed it. That creates a gap between secure sign-in and governed entitlement lifecycle, especially in SaaS estates with admin roles, non-SCIM apps, and manual exceptions.

Q: Why do entitlement reviews matter more than app inventories?

A: App inventories tell you where access exists, but entitlement reviews tell you whether the level of access is appropriate. A user with standard access and a user with admin rights may look identical in a coarse inventory, yet their governance and risk profiles are very different. Granularity is what makes certification decisions meaningful.

Q: How do security teams know whether offboarding is actually working?

A: Security teams should measure completion, not process start. Confirm that accounts are disabled, tokens are revoked, privileged roles are removed, and recovery methods are no longer usable across every connected system. Sampling terminated identities is a practical way to prove whether revocation is real or only recorded.

Q: How should organisations choose between basic IAM and deeper governance coverage?

A: Choose based on whether the main problem is simple authentication for a small user base or lifecycle governance across many applications, approvals, and entitlement levels. If access reviews, offboarding, and non-SCIM systems are material risks, the selection criteria must extend beyond login and provisioning.

Technical breakdown

Why authentication control is not the same as governance

Authentication verifies that a user is who they claim to be. Governance goes further by determining what that identity may access, at what entitlement level, under which approval path, and for how long. The article’s distinction between front-door controls and post-authentication control is important because many IAM deployments stop at sign-in, provisioning, and audit logging. That leaves access reviews, entitlement visibility, and deprovisioning quality as separate problems rather than one governed lifecycle.

Practical implication: Measure IAM coverage by entitlement depth and lifecycle closure, not by whether login is centralised.

Why app-level entitlements expose the real control gap

App-level access is not enough when a team needs to know whether a user has a basic licence, elevated admin rights, or access through a non-SCIM application that cannot be fully governed through standard provisioning. Entitlement depth is the difference between knowing someone has Salesforce and knowing they have Salesforce admin with dormant access. That granularity is what determines whether access reviews are meaningful or just administrative theatre.

Practical implication: Inventory entitlement level, not just application presence, before treating an IAM tool as governance-capable.

How onboarding and offboarding become the lifecycle test

Onboarding is the easy case because access can be granted from a known role or workflow. Offboarding is harder because organisations must revoke all access paths, including shadow entitlements, old approvals, and apps outside the modern integration stack. The article treats this as the point where many IAM tools weaken: they can create accounts, but not always guarantee complete removal of access across a diverse estate.

Practical implication: Test offboarding against the full application estate, including legacy and non-SCIM systems.

NHI Mgmt Group analysis

Post-authentication governance is the real IAM boundary: The article reinforces a basic but often ignored truth, which is that identity security is no longer won or lost at authentication alone. Access reviews, entitlement depth, approval workflows, and offboarding determine whether IAM is actually governing access or merely authenticating it. For practitioners, the governing question is whether the programme can explain who should keep access after the login event has already succeeded.

Entitlement depth is a governance control, not a reporting nicety: Teams that can only see app presence are operating with a shallow control plane. Once admin rights, licence tier, and non-SCIM edge cases are in scope, the same user can represent multiple risk levels inside the same application. That means recertification quality depends on granular entitlement data, not on broad application inventories.

Lifecycle closure is the difference between access management and access containment: The strongest value in this article is its reminder that onboarding is not the governance problem, offboarding is. If deprovisioning does not reach every connected app, the IAM stack can create a false sense of closure while access remnants persist. That leaves the organisation with managed entry and unmanaged exit, which is not a complete identity programme.

Identity governance should be evaluated by coverage of the long tail: Modern SaaS estates are fragmented, and the operational risk lives in the systems that do not fit cleanly into the central workflow. The long tail includes non-SCIM applications, manual approvals, and exceptions that never make it into neat dashboard narratives. Practitioners should treat that long tail as the real test of programme maturity, because that is where policy breaks into manual workaround.

Governance tool selection is now a lifecycle architecture decision: The article shows that tool choice is no longer a simple question of sign-on convenience. The buyer is effectively deciding how much of the identity lifecycle will be governed systematically and how much will remain manual. That is why IAM, IGA, and offboarding depth belong in the same design conversation, not in separate purchasing tracks.

What this signals

Access governance is increasingly a lifecycle problem, not an authentication problem: Once organisations already have SSO and MFA in place, the remaining exposure shifts to approvals, entitlement reviews, and revocation quality across a fragmented application estate. That means programme maturity depends less on front-door control and more on whether governance reaches every access path.

One useful way to frame the gap is entitlement depth: Account visibility alone cannot show whether a user is a standard user, a licence holder, or an administrator. The practitioners who can model those distinctions are the ones most likely to avoid false confidence in IAM coverage.

For practitioners

• Map the full access lifecycle Document where your current IAM stack handles authentication, provisioning, access requests, access reviews, and offboarding separately, then identify the handoff points where governance becomes manual.
• Inventory entitlement depth by application Capture whether each critical app exposes only account-level access or also role, licence, and admin entitlement data, because governance breaks when reviews stop at app presence.
• Test deprovisioning across the long tail Validate that leaver workflows reach non-SCIM and legacy systems as well as the central identity provider, since leftover access often survives outside standard connectors.
• Separate authentication from governance requirements Score tools on how well they support approval workflows, entitlement reviews, and audit-ready offboarding, not just SSO and MFA.

Key takeaways

• Many IAM tools centralise login and provisioning, but the article argues that governance fails when entitlement decisions and offboarding are not equally controlled.
• The practical risk sits in the long tail of SaaS, non-SCIM, and manual access paths, where coarse reviews miss elevated rights and stale permissions.
• Programme decisions should now be judged by lifecycle coverage and entitlement granularity, not by SSO adoption alone.

Key terms

• Entitlement Depth: Entitlement depth is the level of detail an identity platform can report and govern beyond simple app access. It includes roles, privileges, delegated permissions and inherited access, which are the elements that determine real blast radius and audit quality.
• Post-Authentication Governance: Post-authentication governance is the control layer that manages access after an identity has already been verified. It covers entitlements, approvals, privilege changes and removal, and it is where many identity programmes fail because they stop at login assurance.
• Non-SCIM application: A non-SCIM application is any app that cannot use SCIM for standard lifecycle automation. These applications usually require custom integration, direct API handling, or manual administration, which makes them harder to govern consistently and more likely to retain access gaps.
• Lifecycle Closure: Lifecycle closure is the discipline of making sure access does not only get granted and adjusted, but also removed when the business need ends. In identity governance, it means provisioning, change, review, and revocation are treated as one control loop rather than separate tasks.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.