Lumos peer insights ranking points to IGA demand for faster access

At a glance

What this is: This is a vendor commentary on Gartner Peer Insights feedback showing that IGA buyers are rewarding faster access workflows, lower manual effort, and stronger deployment and support experiences.

Why it matters: It matters because IGA programmes now have to win on usability and operating speed, not just policy coverage, if they want reviews completed, access granted, and controls accepted across the business.

By the numbers:

• Lumos says customers gave it a 4.7 out of 5.0 overall rating in Gartner Peer Insights' Voice of the Customer for IGA.
• Lumos says 96% of reviewers said they would recommend the platform to a colleague.
• Lumos says the report was based on 51 verified reviews.
• Lumos says its customers gave it a 4.7 out of 5 on Support Experience.

Context

Lumos is drawing attention to a familiar IGA problem: organisations can buy policy coverage and still fail to get people through access requests and reviews quickly enough for the programme to matter. In practice, slow approvals, heavy admin work, and poor user experience turn governance into a queue instead of a control.

The article frames Gartner Peer Insights feedback as evidence that buyers are now judging IGA by operational outcomes as much as policy intent. That is especially relevant for teams trying to improve access review completion, reduce manual overhead, and make access governance workable for both admins and requesters.

The company also links the feedback to its own autonomous identity positioning, but the underlying issue is broader than any single vendor. Modern IGA has to be usable enough that the business will actually participate, otherwise governance exists on paper rather than in routine behaviour.

Key questions

Q: What breaks when IGA access workflows are too slow to use?

A: When access workflows are too slow, users bypass them, approvers delay decisions, and governance turns into an exception process. The result is weaker control over entitlement changes, lower completion rates for reviews, and more manual overhead for IAM teams. A control that people avoid stops behaving like a control, even if the policy design is sound.

Q: Why do deployment and support experience matter in IGA programmes?

A: Because IGA is operational, not just policy-driven. If integrations are brittle or support is weak, teams spend more time fixing workflows than governing access. That slows rollout, limits coverage, and makes review and request processes unreliable at scale. In practice, deployment quality determines whether the governance model survives production use.

Q: How can teams tell whether an access model is actually working?

A: Look for reduced password-related help desk calls, fewer repeated logins, and user demand to add more applications into the approved access environment. Those signals show that the control model is both secure and practical. If none of those improve, the programme may be compliant on paper but brittle in use.

Q: Should IAM teams prioritise user experience or policy depth in IGA?

A: Policy depth only matters if people can execute the process. IAM teams should prioritise user experience enough to ensure requests, approvals, and reviews are completed consistently, then layer policy controls on top. A richly designed control that users cannot finish will usually deliver less governance than a simpler one that actually gets used.

Technical breakdown

Why IGA adoption depends on request-path latency

Identity governance only works when the access request path is short enough for users and approvers to complete it without workarounds. Latency here is not just system response time. It includes policy lookups, approvals, ticket handoffs, manual validation, and the friction that makes people bypass the process entirely. When access workflows are slow, organisations see shadow approvals, delayed onboarding, and incomplete certification cycles. That turns IGA into a compliance artefact instead of an operational control.

Practical implication: measure end-to-end request completion time, not just system uptime, and treat workflow delay as a governance defect.

How access reviews fail when the reviewer experience is too heavy

Access reviews are meant to be a control over entitlement validity, but their effectiveness depends on reviewer participation and completion quality. When the interface is cluttered, the data is hard to interpret, or the workflow demands too much manual effort, reviewers approve by default or ignore the task. That weakens recertification and leaves privilege creep untouched. The technical problem is not the review policy itself, but the human effort needed to execute it reliably at scale.

Practical implication: reduce review burden with cleaner entitlement context, better grouping, and fewer decisions per screen.

What deployment and support scores reveal about IGA operationalisation

Deployment and support matter because IGA is not a static product choice. It is an operating model that has to fit directories, SaaS apps, entitlement sources, and business processes. High deployment and support ratings usually indicate fewer implementation dead ends, faster integration to access sources, and less post-launch manual tuning. That affects whether the programme can move from pilot to business-wide execution. For IAM teams, support quality is part of control durability, not just service satisfaction.

Practical implication: evaluate IGA tools on integration effort, entitlement coverage, and post-deployment support, not on feature lists alone.

NHI Mgmt Group analysis

IGA buying criteria are shifting from coverage to operability: The strongest signal in this article is not the rating itself but the customer emphasis on speed, effort reduction, and day-to-day usability. That means IGA is being evaluated as a lived control, not a policy catalogue. For governance teams, the practical conclusion is that adoption metrics now matter as much as control design.

Low-friction access governance is becoming the real differentiator: If users and reviewers cannot complete access tasks quickly, the programme will accumulate exceptions, manual bypasses, and informal approvals. That weakens the authority of access reviews and slows remediation of excess access. The field should treat workflow design as part of governance architecture, not a downstream service issue.

Deployment and support quality now sit inside the identity control surface: The article’s strongest operational message is that implementation quality determines whether IGA actually reaches the business. If integrations are brittle or support is slow, access governance degrades into partial coverage. Practitioners should read platform experience as a control durability signal, because durable controls are the ones teams continue to use.

Autonomous identity language is expanding the market, but the IGA problem remains human-centred today: The article gestures toward agents entering the workforce, yet the evidence presented is about current access workflows and review behaviour. That shows the market is still solving classic adoption and completion problems before autonomous identity governance becomes the dominant issue. The implication is to harden the basics first, then extend the model.

Peer-review data is becoming a governance input, not just a marketing input: When verified customers repeatedly call out operational ease, the market is telling practitioners what actually survives contact with production. That makes user experience evidence relevant to IAM programme design, especially where completion rates and support burden shape control effectiveness. Teams should treat peer feedback as an external indicator of control operability.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
• Read next: Access Reviews and Certification Guide

What this signals

Governance programmes are now judged by whether they disappear into daily work: When access request and review experiences are clumsy, adoption drops and the control surface leaks into email, chat, and manual exception handling. IAM leaders should treat workflow friction as a measurable control weakness, not a UX complaint.

Access review completion is becoming a stronger indicator than policy completeness: A programme can have the right approval matrix and still fail if reviewers cannot move quickly through decisions. The better signal is whether the business actually finishes the certification cycle without constant intervention from IT.

Peer feedback is now an input to identity architecture decisions: Verified customer experience is one of the few external checks on whether an IGA model works beyond the lab. Teams should use that signal to pressure-test whether their own controls are operable at the scale and pace the business expects.

For practitioners

• Measure end-to-end access task completion Track how long users and reviewers take from request creation to final decision, including manual steps and escalations, because access governance fails when the workflow is too slow to finish consistently.
• Reduce reviewer workload per certification Group related entitlements, pre-populate context, and remove low-value decisions so reviewers can complete certification without default approvals or abandonment.
• Treat deployment friction as a control risk Evaluate whether the platform can connect cleanly to your directories, SaaS apps, and entitlement sources without heavy manual cleanup after go-live.
• Test operational support before rollout Validate escalation handling, integration support, and issue resolution paths during pilot so the programme does not stall once access reviews and requests scale.

Key takeaways

• IGA buying decisions are increasingly shaped by whether users can complete access tasks quickly and consistently.
• The article points to verified customer feedback that emphasises lower manual effort, faster workflows, and better deployment experience.
• For practitioners, the lesson is to treat operability, support, and review completion as core governance criteria, not afterthoughts.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Deployment Experience: Deployment experience is the practical effort required to integrate a governance platform into real systems and business workflows. Strong deployment experience reduces manual cleanup, shortens time to value, and helps the control survive beyond pilot conditions.
• Control Operability: Control operability is the practical ability to run, monitor, and maintain a security control consistently over time. A control may be well designed on paper but still fail if it needs more staff, more integration, or more process discipline than the organisation can provide.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.