TL;DR: Teams comparing Lumos alternatives are usually solving two different problems at once: SaaS management for app discovery and licensing, or identity governance for SoD, hybrid coverage, and audit evidence, according to Netwrix. The real decision is whether your programme needs lightweight access workflows or enforceable governance that stands up to regulated audits.
At a glance
What this is: This is an analysis of why Lumos alternatives are being evaluated through two different lenses, with SaaS management and IGA answering different governance needs.
Why it matters: IAM, IGA, and PAM teams need to avoid mis-scoping the purchase, because app discovery and licence optimisation do not replace hybrid access governance, SoD enforcement, or audit-ready evidence.
Context
Lumos alternatives are being compared against two different control problems, not one. SaaS management focuses on app discovery, licence optimisation, and lightweight access workflows, while identity governance focuses on joiner-mover-leaver control, certification, segregation of duties, and evidence that stands up in audit.
The distinction matters because regulated programmes need coverage that reaches beyond the identity provider’s view. When entitlements, data access, and admin rights span Active Directory, Entra ID, on-premises systems, and cloud applications, a SaaS-first layer can leave the governance model incomplete.
Key questions
Q: What is the difference between SaaS management and IGA in practice?
A: SaaS management focuses on discovering applications, tracking usage, and optimising spend. IGA focuses on access requests, reviews, lifecycle actions, and audit evidence. In modern environments the two overlap, because you cannot govern SaaS access well if you cannot first identify which applications exist and who is connected to them.
Q: What should teams do when a SaaS-first access tool does not cover regulated systems?
A: They should split the evaluation into two tracks: SaaS operations and governed identity controls. If regulated data or access decisions live in Active Directory, Entra ID, file servers, databases, or privileged accounts, the platform must prove it can govern those systems natively. Otherwise, the organisation still needs a separate IGA or PAM control plane.
Q: What are the signs that an access platform is not true IGA?
A: The usual signs are weak SoD enforcement, limited hybrid reach, no native privileged access coverage, and audit outputs that look like activity logs rather than control evidence. If the platform can approve access but cannot prove why access was appropriate, it is operating as access workflow tooling rather than governance.
Q: Should organisations treat PAM as part of the Lumos alternatives decision?
A: Yes. If a candidate platform does not govern privileged accounts, then the organisation is still assembling its elevated-access control model elsewhere. That means the evaluation is incomplete unless PAM ownership, admin-account scope, and evidence integration are reviewed at the same time as lifecycle and certification.
Technical breakdown
SaaS management and IGA solve different access problems
SaaS management platforms are designed to discover applications, automate basic onboarding and offboarding, and optimise licences. IGA platforms are built to govern entitlements, approvals, certifications, role structure, and segregation of duties across the lifecycle. The architectural difference is that SaaS management usually works from the identity provider or app inventory, while IGA must evaluate who can do what across heterogeneous systems and produce evidence that an auditor can test. In practice, that means the buying question is not which tool is broader, but which control objective the programme is trying to satisfy.
Practical implication: classify the problem first, then choose between app lifecycle management and governed identity controls.
Hybrid coverage changes the governance standard
Hybrid environments complicate any platform that assumes the identity provider contains the whole truth. Regulated data and access often live in Active Directory, Entra ID, file servers, databases, and legacy applications, not just in SaaS tenants. That means entitlement risk can sit outside a SaaS-first control plane even when the dashboard looks complete. For IAM and IGA teams, the technical issue is not connector count alone, but whether the platform can model and certify access across the systems where regulated data actually resides.
Practical implication: validate native coverage for on-premises and cloud identity stores before treating a tool as governance-ready.
Audit evidence depends on governed lifecycle, not activity views
Access reviews only help when they produce defensible evidence tied to control objectives. Lightweight review flows can show activity, but formal compliance programmes need recurring certifications, SoD checks, and records that map to SOX, HIPAA, PCI DSS, or CMMC requirements. The gap is not visibility, but proof. If the platform cannot demonstrate why access was approved, whether conflicts were detected, and how exceptions were handled, it may support operations without satisfying governance.
Practical implication: test whether certification output and SoD records are audit evidence, not just workflow logs.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
The Lumos decision is really a boundary-setting exercise, not a product comparison. Buyers are deciding whether they need SaaS workflow automation or identity governance with enforceable controls. That distinction becomes sharper in regulated environments where control objectives, not app convenience, determine success. The practitioner lesson is to scope the programme by governance requirement before shortlisting tools.
Hybrid identity coverage is where SaaS-first models start to lose governance integrity. The identity provider knows only part of the access story when data and entitlements also live in Active Directory, Entra ID, and legacy systems. That leaves a visibility gap between granted access and governed access. The implication is that programmes should measure coverage by the systems auditors will inspect, not by the connectors a sales demo can show.
Audit-readiness depends on evidence quality, not just access automation. A platform can automate requests and reviews yet still fail to produce defensible certification trails or SoD proof. In regulated identity governance, the control has to survive challenge, not merely completion. Practitioners should treat evidence production as a first-class design requirement, not a reporting afterthought.
Privileged access is the clearest signal that the market split is real. If a platform does not govern admin accounts, it is not replacing a full identity governance and privilege model. That gap forces teams to assemble adjacent controls for elevated access, which changes procurement, operating model, and ownership. The practitioner conclusion is that access governance, PAM, and audit evidence should be evaluated together, not as separate checkboxes.
Service-account visibility exposes the broader governance problem behind SaaS-first evaluations. Only 5.7% of organisations have full visibility into their service accounts, which shows how often machine identities sit outside normal governance processes. That matters here because a SaaS-centric access layer can miss the non-human side of the entitlement estate. The practitioner takeaway is to treat non-human identity coverage as part of the same governance decision, not an adjacent project.
From our research library:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Read next: Access Reviews and Certification Guide
What this signals
Governance scoping now matters more than feature count. Teams should treat SaaS management, IGA, and PAM as separate control layers with different outcomes. If the buying process starts with a vendor category instead of the control objective, the programme can end up with good workflow tooling and weak auditability.
Hybrid access evidence is the key differentiator in this category. A platform that cannot certify access across Active Directory, Entra ID, and on-premises systems will struggle in regulated environments, even if it handles SaaS neatly. Practitioners should expect the governance layer to follow the data and entitlement footprint, not the marketing narrative.
Identity visibility is still poor outside core user accounts. Only 5.7% of organisations have full visibility into their service accounts, which is a warning that machine identities remain under-governed. The search for Lumos alternatives should therefore include non-human identity scope, not just user access workflows.
For practitioners
- Separate SaaS management from IGA requirements Map your actual control objective before comparing vendors: app discovery and licence optimisation belong in SaaS management, while certifications, SoD, and audit evidence belong in IGA.
- Validate hybrid coverage against audit scope Test native coverage for Active Directory, Entra ID, file servers, and on-premises databases, because that is where regulated entitlements often sit.
- Demand audit-ready certification evidence Ask for sample access certification outputs, exception handling records, and SoD violation evidence that map to the control framework your auditors will test.
- Check privileged access governance separately Confirm whether admin and elevated accounts are governed natively or whether PAM remains a separate control plane that must be integrated.
- Include service accounts in the scope Inventory non-human identities alongside user accounts so the programme does not stop at the identity provider’s visible entitlements.
Key takeaways
- The article argues that the Lumos market conversation often mixes SaaS management with true identity governance, which leads to mis-scoped evaluations.
- Hybrid estates and regulated data locations drive the real gap, because access evidence has to cover systems beyond the identity provider’s own view.
- Practitioners should evaluate certification quality, SoD coverage, hybrid reach, and privileged access governance as one operating model rather than separate buying criteria.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | The article flags under-governed non-human and admin access as part of the gap between SaaS and IGA. |
| Recommendation — Review NHI permissions for excess privilege and remove standing access that exceeds task scope. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Entitlement governance and certification are the article's core identity control concerns. |
| Recommendation — Apply PR.AA-05 to govern permissions, entitlements, and authorisations across hybrid identity estates. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege underpins the SoD and admin-access controls discussed throughout the article. |
| Recommendation — Use AC-6 to constrain access scope and separate elevated rights from routine user entitlements. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The article ties identity exposure to compromised identities and misconfigured permissions. |
| Recommendation — Map entitlement weaknesses to TA0006 and TA0008 to prioritise controls that reduce credential abuse and spread. | ||
Key terms
- Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
- SaaS Management Platform: A SaaS management platform is a visibility and optimisation layer for cloud software use. It helps teams discover applications, track utilisation, and understand spend patterns, but it does not by itself enforce access policy, revoke permissions, or manage identity lifecycle state.
- Segregation of Duties: Segregation of Duties is a control principle that prevents one person or role from combining incompatible permissions that could create fraud, error, or undetected change. In ERP environments, it must account for roles, transactions, approvals, and compensating controls across business processes.
- Audit-Ready Evidence: Audit-ready evidence is access proof that can be retrieved directly from the control system without manual reconstruction. It should show who approved access, what policy they used, when the decision occurred, and whether any exceptions or compensating controls were applied.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 9, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org