Omada and adesso extend identity governance partnership in DACH

At a glance

What this is: Omada Identity says identity governance and access control are central to digital sovereignty, and that its continued partnership with adesso is aimed at regulated DACH organisations that need stronger auditability, control, and delivery capacity.

Why it matters: For IAM, IGA, PAM, and NHI practitioners, this matters because sovereignty programmes fail when access governance cannot prove control, support lifecycle discipline, or keep pace with cloud and AI adoption.

Context

Digital sovereignty in identity management means keeping control over who or what can access systems, data, and applications, while preserving traceability and auditability. In regulated environments, that control surface increasingly includes human users, service accounts, and other non-human identities that can bypass traditional review processes if governance is weak.

This article is not about a new product launch so much as the delivery model around identity governance in the DACH region. Omada Identity frames the problem as one of operational resilience and compliance under rising regulatory and threat pressure, with adesso positioned as the implementation partner for complex transformation work.

The underlying message is that sovereignty is no longer a policy aspiration on top of IAM. It is now an operating requirement that depends on identity lifecycle discipline, access revocation, and demonstrable control over exceptions.

Key questions

Q: What breaks when identity governance is missing from an IAM programme?

A: The main failure is entitlement drift. Access gets granted correctly at the start, then role changes, project endings, and staff departures create stale permissions that remain active. That weakens segregation of duties, complicates audits, and makes revocation dependent on manual follow-up.

Q: Why does access revocation matter so much for regulated organisations?

A: Because revocation is the point where policy becomes control. If leavers, contractors, and vendors keep access after their business need ends, the organisation loses both security and audit credibility. In regulated environments, delayed removal is not a paperwork issue, it is a control failure that can expand attack surface.

Q: How can teams tell whether layered identity governance is actually working?

A: Look for evidence that identity state, access reviews, privileged sessions, and monitoring outputs are aligned. If alerts, certifications, and offboarding outcomes do not connect, the organisation has control presence but not control coherence.

Q: Should organisations manage human and non-human access with the same lifecycle discipline?

A: Yes. The governance logic is the same even though the identities differ. Humans, service accounts, tokens, and AI-linked access all need ownership, review, and revocation rules that follow the business lifecycle. Treating non-human access as exempt is how governance gaps become persistent risk.

Technical breakdown

Why identity governance becomes a sovereignty control plane

Identity governance is the layer that decides who gets access, when that access is removed, and how decisions are documented. In a sovereignty context, that function is not administrative overhead. It is the mechanism that preserves local control over business-critical systems and prevents access decisions from becoming opaque once cloud platforms, external service providers, and cross-border operations enter the picture. When governance is fragmented, organisations can still authenticate users but lose the ability to explain or prove why access exists. That is a resilience problem as much as a compliance problem.

Practical implication: Practitioners should treat access governance as a sovereignty control rather than a back-office workflow.

Why regulated DACH organisations need lifecycle discipline for access

The article points to day-one provisioning and last-day revocation as practical outcomes of mature identity management. That matters because orphaned and over-privileged accounts remain one of the most common ways control erodes in regulated environments. Lifecycle discipline ties joiner, mover, and leaver processes to real business events, not to manual follow-up. In sectors such as public administration and critical infrastructure, that discipline is what turns policy into audit-ready evidence. Without it, the organisation can claim governance but cannot prove it reliably across all access paths.

Practical implication: Security and IGA teams should align provisioning and deprovisioning to employment and vendor lifecycle events, not ticket closure.

How a sovereign identity foundation supports cloud and AI programmes

The article links identity governance to faster cloud and AI adoption because those initiatives multiply the number of identities, entitlements, and trust relationships that must be controlled. A sovereign identity foundation does not mean blocking those programmes. It means making access decisioning, auditability, and exception handling resilient enough that new platforms do not weaken control. For teams operating in hybrid environments, the governance question is whether identity policy can keep pace with dynamic infrastructure and third-party execution. If not, cloud and AI expansion simply increases unmanaged access surface.

Practical implication: Architect access governance so new cloud and AI workloads inherit lifecycle and audit controls before they go live.

NHI Mgmt Group analysis

Identity governance is now a sovereignty control, not just an IAM discipline. The article is strongest when read as a governance statement: organisations cannot claim digital sovereignty if they cannot demonstrate control over access decisions, revocation, and auditability. That elevates identity governance from operational support to a strategic control plane for regulated environments. Practitioners should therefore judge sovereignty readiness by access traceability, not by policy language alone.

Day-one access and last-day revocation are the practical tests that matter. The article’s reference to timely provisioning and revocation highlights the lifecycle edge where most governance programmes fail in practice. If access is not granted at the right time or removed on exit, the organisation accumulates orphaned and over-privileged identities. In NHI terms, that same lifecycle pressure applies to service accounts and tokens, not just employees. The implication is that lifecycle enforcement must be measurable, not assumed.

Digital sovereignty breaks when auditability is treated as a reporting feature instead of a control outcome. Traceability and documentation only matter if they are tied to actual decision records and entitlement changes. Otherwise, audit logs become after-the-fact evidence without operational force. That is why regulated organisations need governance workflows that can survive cloud complexity, outsourced delivery, and cross-border operating models. The practitioner lesson is simple: if you cannot explain access, you do not control it.

Expansion into cloud and AI will widen identity sprawl unless governance is in place first. The article connects faster time-to-value with a sovereign identity foundation, which is the right ordering. Cloud and AI programmes multiply identities and access paths faster than manual governance can track. That means the real differentiator is not adoption speed, but whether identity governance can scale with the programme without losing control. Teams should treat governance as prerequisite architecture, not a follow-on clean-up task.

Sovereign access control depends on the same lifecycle logic across human and non-human identities. The article focuses on people access, but the governance principle is broader: access is only sovereign if ownership, review, and removal are enforced across every identity type. That is where many programmes fragment, because human IAM and NHI governance are still run as separate disciplines. Practitioners should collapse that divide where possible and govern access as one lifecycle across the estate.

From our research library:

• 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
• Read next: Ultimate Guide to NHIs — Regulatory and Audit Perspectives

What this signals

Digital sovereignty creates a governance test that IAM teams cannot outsource: if the organisation cannot explain access decisions end to end, sovereignty claims will not survive audit or incident review. The practical shift is toward evidence-rich lifecycle control, where provisioning, review, and removal are all tied to business events rather than manual follow-up.

Identity governance will increasingly be evaluated as programme infrastructure: cloud adoption, regulated outsourcing, and AI rollout all depend on the same access control foundation. Teams that separate human IAM from NHI governance will keep re-creating the same visibility and revocation gaps in different forms.

Access traceability becomes the named concept to watch: it is the difference between having identity records and having operational control over them. In sovereignty-led programmes, traceability is only useful when it shows who approved access, why it exists, and when it will be removed.

For practitioners

• Map sovereignty requirements to identity governance controls Translate digital sovereignty goals into measurable identity outcomes such as entitlement traceability, access decision ownership, and documented revocation paths for regulated systems.
• Tighten joiner, mover, and leaver enforcement Bind provisioning and deprovisioning to employment, contractor, and vendor lifecycle events so access is granted from day one and removed no later than the last working day.
• Review orphaned and over-privileged accounts Use entitlement recertification to identify accounts that no longer map to a current business relationship, then remove or reduce access before they become a governance exception.
• Design cloud and AI onboarding around governance first Require new cloud services and AI-related workflows to inherit identity decisioning, logging, and exception handling before production use, rather than retrofitting controls later.

Key takeaways

• Digital sovereignty depends on identity governance that can prove access control, not just describe it.
• Orphaned and over-privileged access remain the clearest sign that lifecycle discipline is breaking down.
• The most durable response is to make provisioning, revocation, and auditability part of the sovereignty architecture from the start.

Key terms

• Digital sovereignty: An operating model in which an organisation retains meaningful control over where data lives, who administers the service, and how policy is enforced. For identity teams, sovereignty is only real when access, logs, and recovery remain under the organisation's governance boundary.
• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Session Auditability: Session auditability is the ability to reconstruct user actions after access has been granted. It usually relies on logs or recordings that show what commands were run, when they occurred, and which identity performed them. This supports investigation, compliance, and accountability for privileged access.
• Identity lifecycle automation: The orchestration of joiner, mover, and leaver events so access is granted, adjusted, and removed without manual gaps. For mixed identity estates, it matters because revocation and review must keep pace with identities that do not follow human employment timelines.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.