IT teams’ biggest 2026 challenge is identity process sprawl

At a glance

What this is: Zluri argues that IT teams’ biggest 2026 challenge is identity process sprawl, where onboarding, access control, reporting, and asset oversight stay fragmented across manual and disconnected workflows.

Why it matters: This matters because IAM and IGA programmes fail when identity work is scattered across tools and teams, leaving access decisions slower, less auditable, and harder to govern across human and non-human estates.

Context

Identity process sprawl is the accumulation of manual handoffs, duplicated records, and disconnected approvals across onboarding, access changes, reviews, and reporting. In practice, that means identity governance is happening in fragments instead of as one controlled lifecycle.

The article ties that sprawl to IT operations, not just security tooling. When identity and access tasks are split across HR, IT, SaaS, and spreadsheet-driven follow-up, the result is delayed provisioning, weak evidence trails, and greater risk when permissions change or remain in place after need has ended.

Key questions

Q: What breaks when identity tasks stay manual in legacy or disconnected systems?

A: Manual identity tasks usually break consistency, speed, and accountability. Teams can miss revocation steps, apply different rules across systems, and lose traceability for who approved what and when. In practice, that increases access sprawl, delays offboarding, and makes it harder to prove control effectiveness during audits or investigations.

Q: Why do legacy systems make AI governance harder for IAM teams?

A: Legacy systems fragment identity, device, and application control, which makes it difficult to see who or what has access at any moment. AI governance depends on timely attribution, clean entitlements, and consistent policy enforcement. When those basics are split across tools and teams, automated access can expand faster than review processes can contain it.

Q: What are the biggest signs that identity process sprawl is hurting operations?

A: The strongest signs are repeated data entry, slow onboarding, frequent rework, inconsistent access records, and reports that do not match current system state. If teams need to reconcile identity information across multiple places before they can make a decision, the governance model has already become fragmented.

Q: How should organisations govern outsourced access and partner accounts?

A: Treat outsourced access as part of the identity lifecycle, not as a side arrangement. The account should have a named owner, a clear purpose, a review cadence, and a defined revocation trigger so access ends when the work ends or the relationship changes.

Technical breakdown

Why manual onboarding creates identity process sprawl

Manual onboarding turns identity governance into a sequence of copy, check, and rekey tasks. Each handoff between HR, IT, and application owners creates delay and a new chance for mismatch, which is why the article treats automation as the practical answer to repetitive onboarding work. The real technical problem is not simply speed. It is that identity state becomes distributed across systems that do not share a single authoritative lifecycle, so access can be granted, delayed, or corrected inconsistently.

Practical implication: integrate HR and IT systems so joiner data flows once and provisioning no longer depends on manual re-entry.

How legacy systems turn access management into a control gap

Legacy systems usually fail identity governance in two ways. First, they force manual work for tasks that should be policy-driven, such as granting access to new users or updating entitlements. Second, they make integration with cloud and SaaS tools harder, which means identity decisions are split between old platforms and newer controls. That creates a control gap: the organisation may have policies, but the execution path is fragmented enough that the policy no longer maps cleanly to the actual system state.

Practical implication: map which core identity workflows still depend on legacy handling and prioritise those for workflow automation or replacement.

Why outsourced access needs tighter lifecycle oversight

Outsourcing changes the identity model because external teams often need access to sensitive systems but do not sit inside the same employee lifecycle processes. If access is granted without clear ownership, review cadence, and revocation triggers, the organisation inherits third-party access risk even when the work itself is legitimate. The article highlights this through the risk of security incidents, legal exposure, and extra remediation effort when partners are weak on controls. That makes lifecycle oversight the boundary that matters most.

Practical implication: treat third-party access as a governed identity lifecycle with explicit grant, review, and revoke ownership.

NHI Mgmt Group analysis

Identity process sprawl is a governance failure before it is an efficiency problem. The article shows that IT teams lose control when onboarding, reporting, and access changes are split across manual steps and disconnected systems. That fragmentation weakens auditability, slows entitlement changes, and makes it harder to prove who approved what and when. For practitioners, the issue is not only labour cost but loss of control over the identity lifecycle.

Legacy system dependence creates the conditions for governance drift. When access management still relies on manual updates, identity state diverges from business state. New cloud and SaaS workflows then sit outside the old control model, which is why the article correctly links legacy systems to lost productivity and integration friction. The practitioner takeaway is that control quality degrades when execution is no longer anchored to one authoritative workflow.

Third-party access is where identity process sprawl becomes accountability sprawl. Outsourcing introduces another identity boundary, and that boundary needs its own ownership, review, and revocation logic. Without it, the organisation can neither clearly assign responsibility nor reliably remove access when the relationship changes. The important issue is not vendor volume but the lifecycle break between business need and access termination.

Identity process sprawl is the named concept organisations should use to describe this failure mode. It captures the fact that onboarding, access review, app inventory, and reporting are being handled as separate operational chores rather than as one governed system. That framing matters because it shifts the discussion from isolated fixes to lifecycle design, which is the level at which IAM and IGA programmes actually succeed or fail.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: NHI Lifecycle Management Guide

What this signals

Identity process sprawl: this is the point at which onboarding, access administration, reporting, and review stop behaving like one governed lifecycle. When each step lives in a different system or team, the programme loses the ability to prove continuity, which is exactly where IAM and IGA controls start to fail.

The practical response is to redesign identity work around authoritative sources and automated handoffs, not around manual exception handling. That is as relevant for employee access as it is for outsourced users and service accounts, because the governance problem is the same: access has to be issued, reviewed, and revoked through one accountable path.

For practitioners

• Automate joiner workflows end to end Replace manual onboarding re-entry with system-to-system workflows that pull authoritative employee data from HR and push it into access provisioning without duplicate handling.
• Centralise access review evidence Stop treating reporting as a separate task and generate entitlement, application, and audit evidence from the same governed workflow used to manage access.
• Inventory the legacy workflows that still need manual updates Identify which identity tasks still depend on spreadsheets, email approvals, or hand-edited records, then rank them by business and security impact.
• Put third-party access under explicit lifecycle ownership Assign grant, review, and revoke responsibility for outsourced users or partners so their access is offboarded when the relationship or task ends.

Key takeaways

• The article frames IT teams’ challenge as identity process sprawl, where manual work and disconnected workflows weaken governance across onboarding, access changes, and reporting.
• Legacy systems and outsourcing increase operational drag because they separate identity decisions from a single accountable lifecycle.
• The most effective response is to centralise identity workflows, automate handoffs, and make access review and revocation part of the same governed process.

Key terms

• Identity Process Sprawl: Identity process sprawl is the condition where provisioning, review, reporting, and revocation are spread across disconnected tools and teams. It creates inconsistent control points, more exceptions, and weaker accountability because no single workflow governs the full access lifecycle.
• Identity Lifecycle Event: A business event that changes a person’s access, obligations, or record status, such as hiring, role change, or offboarding. In HR programmes, these events often drive entitlement changes and evidence requirements, so they need to be governed as part of the identity lifecycle rather than handled as isolated paperwork.
• Third-Party Access Governance: Third-party access governance is the control set that tracks, approves, reviews, and revokes access granted to external vendors and partners. It becomes an identity problem when suppliers operate through shared credentials, delegated workflows, or persistent machine access that outlives the business need.
• Entitlement review: A governance process that checks whether users, service accounts or systems still need their access. For modern identity programmes, the limitation is timing: if reviews happen too late or too rarely, access may already have been misused before the review occurs.

Deepen your knowledge

NHI governance, identity lifecycle management, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.