IGA implementation costs rise with connectors, data cleanup and AI scope

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Oak's blog post: IGA implementation cost is driven by connectors, data quality, role design and review scope, with machine and AI agent identities expanding the governance burden.

Why it matters: This matters because implementation planning, budget ownership and operating cost assumptions now need to account for non-human identities alongside workforce accounts, not just for licence procurement and rollout effort.

👉 Read Oak's guidance on what drives IGA implementation cost and timeline

Context

IGA implementation cost is rarely determined by the platform licence alone. The real budget pressure comes from the estate around it: how many systems must be connected, how clean the identity data already is, how roles are defined, and how much review work the programme creates once it goes live.

For identity governance teams, that means the cost model has to include people, process and integration debt, not just software spend. When machine identities and AI agents are in scope, the programme inherits more accounts, more owners to assign and more access to certify. NHI lifecycle management becomes part of the budget conversation, not a downstream cleanup exercise.

The starting point Oak describes is typical for organisations with mixed estates. Enterprises usually discover that the most expensive work is not the visible configuration, but the hidden remediation needed before governance controls can operate reliably.

Key questions

Q: How should teams budget for IGA implementation beyond the licence fee?

A: Budget for implementation services, connector builds, identity data cleansing, role engineering, workflow design, testing, training, and cutover support, not just the licence fee. The biggest hidden costs are usually system integration, exception handling, and ongoing administration for joiner-mover-leaver processes, access certifications, and entitlement catalogue upkeep. Include time for audit evidence and policy tuning.

Q: Why do custom connectors increase identity governance project cost?

A: Custom connectors increase project cost because they add design, build, testing, and support work that sits outside standard product configuration. Each connector usually needs field mapping, authentication setup, error handling, change management, and ongoing maintenance when source systems or APIs change, so the initial build and long-term support effort both rise.

Q: How do dirty identity records affect role modelling and access reviews?

A: Dirty identity records weaken role modelling and access reviews by giving governance tools incomplete or inconsistent facts about people, accounts, entitlements, and managers. Duplicate users, stale attributes, and missing owners make it harder to group access correctly, assign responsibilities, and certify who should keep what access, which leads to noisy reviews and unreliable roles.

Q: When should machine identities be included in an IGA rollout?

A: Machine identities should be included from the start if they hold access to business data, production systems, or privileged APIs, because they need ownership, scope, and lifecycle controls just like users. If the rollout begins with human accounts only, the inventory, certification model, and offboarding process usually need rework when service accounts, tokens, and certificates are added later.

Technical breakdown

Why connectors dominate IGA implementation effort

Connectors are where governance theory meets system reality. A standard SaaS integration can often be onboarded quickly, but on-prem, homegrown and custom systems usually require bespoke mapping, exception handling and testing against live account data. The work does not end at go-live, because connectors must keep pace with schema changes, API changes and authentication changes in the target system. That makes connector design a lifecycle problem, not a one-time project task.

Practical implication: Treat connector method as an operating-cost decision and require maintenance ownership in the implementation plan.

How dirty identity data stretches role modelling and review design

Identity data quality determines whether automation can make sensible decisions. If owners are missing, records are duplicated or authoritative sources disagree, the governance workflow simply scales the confusion. Role modelling has the same problem: workshop-built roles reflect assumptions, while roles mined from usage reflect evidence. Review design then compounds the issue, because reviewers need context such as last use, peer comparison and resource sensitivity to avoid rubber-stamping access. See the IAM and IGA Basics.

Practical implication: Do not start certifications until ownership, source-of-truth and role assumptions are explicit and testable.

Why machine and AI agent identities change the scope of IGA

Machine identities are not a side population anymore. They carry access, generate review rows and create ownership problems when no human is clearly accountable. AI agent identities add another layer because their access patterns can change with task context and runtime behaviour, which increases the volume and volatility of what governance has to observe. In practice, IGA stops being a workforce-only discipline and becomes a mixed identity programme with broader inventory, review and offboarding requirements. Read Top 10 NHI Issues.

Practical implication: Scope non-human identities at discovery so the programme is designed for the full identity estate, not widened mid-project.

NHI Mgmt Group analysis

Implementation cost is really governance debt made visible. A low licence price does not mean a low-cost programme when integration, data remediation and reviewer effort sit outside the quote. The budget challenge is that these hidden lines are often the work that determines whether the programme can actually govern access, so procurement should treat them as core scope rather than optional extras.

Machine identities turn IGA from a workforce control into an estate control. Once service accounts, bots and AI agents are inside the governance boundary, the programme has to account for ownership, lifecycle and review scope across more than people. That widens the operating model and raises the cost of incomplete inventory, which means the implementation plan must reflect the whole identity estate from the outset.

Role models built from assumptions create avoidable delay. Workshop-only role design often consumes time before it creates value because it asks the business to approve a model that has not yet been proven against actual use. Governance programmes that start from observed behaviour get to defensible certification faster, because they reduce the amount of rework needed when real access patterns appear.

First answer timing is a governance outcome, not just a delivery milestone. The value of an implementation is not only when the platform is installed, but when the first reliable governance answer is available. That shifts the question from 'how fast can deployment finish' to 'how soon can the programme produce decisions the business can trust', which is the standard practitioners should use when judging proposals.

Connector maintenance is part of identity governance maturity. Systems change after go-live, and so do the connections that feed reviews, role models and ownership data. A programme that does not price ongoing connector upkeep is not fully budgeting for governance, only for installation. Practitioners should treat run cost as a standing control requirement, not an afterthought.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: NHI Lifecycle Management Guide

What this signals

Budgeting for IGA is becoming a lifecycle question. The most common planning error is to treat implementation as a one-time deployment instead of a continuing governance service. Once service accounts, bots and AI agents are inside scope, the programme has to price ownership, review operations and connector upkeep as part of steady-state control.

Connector sprawl is now a governance risk, not just an integration inconvenience. Every non-standard system adds maintenance, exception handling and testing overhead, which means the implementation estate becomes a control surface in its own right. Practitioners should expect the programme design to shift from project delivery to long-term operational resilience.

Role quality matters more than role volume. A large role catalogue built from workshop assumptions will usually age badly, while a smaller evidence-based model is easier to maintain and certify. The practical signal is simple: if the role model cannot survive contact with real usage, it will also fail under sustained review pressure.

For practitioners

• Demand a written quote by cost line Ask for separate pricing on services, connectors, role modelling, data cleanup, internal staffing and run cost so hidden scope does not disappear into the licence line.
• Define ownership before automation starts Require a named owner for every application, account and review row before connector onboarding, especially where service accounts or AI agents expand the estate.
• Test connector method against real systems Insist that each integration is described by method, build owner, test owner and maintenance owner, not just by the target application name.
• Baseline identity data quality early Reconcile authoritative sources, duplicates and orphaned accounts before you commit to certification campaigns or role mining.
• Separate first answer from full rollout Write both milestones into the contract so the programme can deliver useful governance decisions before every connector, role and policy phase is complete.

Key takeaways

• IGA implementation cost is driven by integration work, data remediation and operating effort as much as by the software licence.
• Non-human identities expand IGA scope because they add inventory, ownership and review obligations that many programmes do not budget for upfront.
• A defensible implementation plan separates first-answer timing from full rollout, with written assumptions for connector ownership, cleanup and run cost.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · IAM and IGA Basics · Identity Data Quality and Identity Fabric Guide · Top 10 NHI Issues

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Connector: A connector is the integration path an agent uses to reach an external service, such as GitHub, Salesforce, or a custom API. Connectors matter because they expand the agent’s effective access scope and often determine the highest-risk permissions in the environment.
• Role Modelling: Role modelling is the process of defining, validating, and maintaining access patterns so identities receive only the permissions needed for a job or function. In mature IAM programmes, it becomes a lifecycle discipline, not a one-time design task, because organisational change quickly turns static roles into privilege drift.
• Review Campaign: A review campaign is a scheduled access review exercise where managers or entitlement owners confirm whether users, groups, or other identities still need their current access. It is used in identity governance to collect approvals, removals, and exceptions across a defined population or system set.

What's in the full article

Oak's full blog post covers the operational detail this post intentionally leaves for the source:

• Line-by-line quote structure for services, connectors, data cleanup, staffing and run cost
• Practical examples of how connector method changes implementation effort across different system types
• Vendor-facing question set for validating first-answer timing and full rollout assumptions
• Implementation framing for organisations choosing between augmentation and replacement paths

👉 The full Oak post breaks down quote assumptions, connector effort and rollout phases.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.