The hidden cost of IGA is manual governance at scale

At a glance

What this is: This analysis argues that many IGA programmes stall because the real operating model depends on manual discovery, harmonisation, approvals, and maintenance rather than durable automation.

Why it matters: It matters because IAM and IGA teams cannot assess governance tooling correctly if they focus on capabilities alone and ignore the service load that determines whether the model scales.

By the numbers:

• $400k can be added on Day 1 just to make claimed out-of-the-box connectors production-ready.
• Market Research Future reported 69.9% professional services revenue in 2022.
• Mordor Intelligence reported 57% professional services revenue in 2024.

Context

Identity governance only scales when the operating model can keep pace with changes in applications, roles, and access data without repeated manual rework. In this analysis, the problem is not whether organisations need IGA, but whether the implementation model can handle SaaS, cloud, automation systems, and machine identities without becoming a consulting exercise.

The article argues that many IGA deployments look complete on paper but rely on manual data discovery, harmonisation, review administration, and ongoing maintenance. That creates long implementation cycles, hidden service costs, and governance gaps that become more visible as identity estates expand.

Key questions

Q: What breaks in IGA programmes when identity data discovery is manual?

A: Manual discovery breaks the foundation of IGA because the control plane starts with incomplete inventories, inconsistent schemas, and missing ownership data. That creates blind spots before any certification or approval workflow begins, so the programme can look operational while still missing critical identities and entitlements.

Q: Why do access reviews become rubber-stamping exercises in many IGA deployments?

A: Access reviews degrade when reviewers lack current manager mappings, accurate HR data, and clear entitlement context. In that situation, people approve what they cannot confidently evaluate, so the process becomes a compliance ritual instead of a meaningful governance decision.

Q: How can security teams judge whether an IGA platform will scale without heavy services work?

A: Look at whether new applications, schema changes, and integrations can be absorbed without repeated connector fixes or reimplementation. If every environmental change triggers manual repair, the platform is not scaling governance so much as scaling dependency.

Q: What should organisations include in IGA total cost of ownership calculations?

A: They should include licensing, professional services, integrator cost, internal FTE time, and ongoing maintenance. A narrow software-only view hides the real delivery burden and makes deployments look cheaper and faster than they actually are.

Technical breakdown

Why manual identity data discovery becomes the first scaling bottleneck

Identity governance depends on assembling accurate inventories of accounts, entitlements, roles, and ownership across fragmented systems. When discovery is manual, teams must identify every source, model the data, and keep repeating that work as new applications arrive. That turns governance into a moving target because the control plane is never fully synchronised with the environment it is supposed to govern. The practical failure is not simply slow onboarding. It is that hidden identity stores and inconsistent schemas create blind spots before any review or approval workflow can even start.

Practical implication: treat discovery as a lifecycle control problem, not a one-time onboarding task.

Why access review workflows degrade when context is missing

Access reviews only work when reviewers have reliable manager mappings, current HR data, and enough entitlement context to judge whether access is still justified. If those inputs are patched together manually, reviews become quarterly compliance rituals rather than timely governance decisions. The result is predictable rubber-stamping, especially when reviewers lack the operational context to challenge access that looks legitimate on paper. In practice, manual approval chains create latency, reduce decision quality, and make governance less responsive to privilege drift across both human and non-human identities.

Practical implication: if the review input data is stale, the certification outcome will be weak even when the workflow is formally complete.

Why automation claims fail when maintenance still needs constant human repair

A platform can claim automation while still depending on manual connector fixes, schema updates, and API patchwork as the environment changes. That matters because governance systems are only as adaptive as their ability to absorb change without reimplementation. When each new application or integration introduces service work, the operating cost moves outside the software license and into ongoing human dependency. For IAM and IGA teams, the technical issue is architectural. A control that cannot ingest change reliably does not stay current enough to govern modern identity sprawl.

Practical implication: evaluate whether the control plane updates itself as the estate changes or whether every change restarts a services project.

NHI Mgmt Group analysis

Manual governance is the hidden scaling tax in many IGA programmes: the control promise looks standard, but the operating model is still built on human assembly of data, workflows, and exceptions. That makes implementation time and service dependency part of the security architecture, not just a delivery inconvenience. The field should stop treating manual effort as an acceptable trade-off for coverage and start treating it as a sign that governance has not really been operationalised.

Access review quality collapses when the evidence layer is fragmented: certifications depend on current ownership, accurate entitlements, and clear business context. When those inputs are stitched together by security, GRC, and IT teams, the process becomes slower and less authoritative, which is why rubber-stamped approvals persist. The implication is that review outcomes are only as trustworthy as the data plane underneath them.

Service-heavy IGA creates a misleading economics model: if the vendor earns a large share of revenue from professional services, the customer is not buying self-sustaining governance. The market signal is that many deployments are still sold as products but consumed as dependency stacks. Practitioners should evaluate whether the commercial model aligns with the governance goal of reducing ongoing manual intervention.

Identity governance must now absorb machine identities and agentic AI without reverting to quarterly control cycles: access decisions for these actors move too fast for review processes designed around human-paced change. The question is no longer whether IGA can produce reports, but whether it can govern dynamic access at operational speed. The practical conclusion is that governance architectures need continuous context, not periodic after-the-fact certification.

Adaptive identity governance is becoming the baseline expectation: organisations that cannot synchronise new apps, roles, and entitlements automatically will keep paying for the same data cleanup in every deployment cycle. That does not just slow rollout. It weakens the governance signal because teams spend their time reconciling the estate instead of governing access. The implication for the market is clear: implementations that rely on permanent services support are not mature enough to be treated as low-friction control systems.

From our research library:

• Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.

What this signals

Manual governance becomes the real product cost when implementation work never disappears: organisations that depend on constant data reconciliation, review babysitting, and connector repair are not buying lower operating effort. They are shifting that effort into a different budget line and losing visibility into how much control is actually being delivered.

Identity governance now has to handle human, machine, and agentic access in one operating model: quarterly review cycles and brittle integrations cannot keep pace with identities that appear, change, and disappear across modern environments. The programme signal is clear: if the control plane cannot adapt continuously, governance will lag the estate it is meant to secure.

For practitioners

• Audit the hidden service load Break total cost of ownership into licensing, professional services, integrators, internal FTEs, and maintenance so the real governance cost is visible before procurement.
• Map every identity data source before purchase Identify where account, entitlement, role, and ownership data lives across SaaS, cloud, and on-prem systems, then test whether the platform can ingest those sources without bespoke rebuilds.
• Validate review context quality Check whether manager mappings, HR records, and entitlement descriptions are complete enough for reviewers to make informed decisions without default approvals.
• Test maintenance dependency under change Simulate a new application, schema change, or API update and confirm whether the governance model adapts without a support engagement.

Key takeaways

• Many IGA deployments stall because manual data discovery, review administration, and maintenance remain embedded in the operating model.
• The article cites multi-year implementation drift, a $400k Day 1 connector burden, and high professional services revenue as evidence of hidden cost.
• Teams should evaluate governance platforms by how much manual dependency they remove, not by how complete the feature list looks.

Key terms

• Identity Governance: Identity governance is the set of controls that defines who approves access, who owns it, how it is reviewed, and when it is removed. In practice, it turns identity management from a deployment task into a durable control system that can withstand audits, organisational change, and operational growth.
• Access Review: A formal process for confirming whether access is still needed and justified. In IAM programs, the review becomes an evidence-bearing control when decisions are recorded, scoped correctly, and traceable to the right reviewer, application owner, or auditor.
• Entitlement Rationalization: Entitlement rationalization is the work of translating different application-specific permissions into a common language that governance systems can evaluate. It is often the hidden effort in IGA deployments, because inconsistent schemas and role models must be normalised before decisions can be trusted.
• Total Cost Of Ownership: Total cost of ownership is the full cost of acquiring, operating, supporting, and retiring a tool across its life. In identity programmes, it includes onboarding, integration, training, troubleshooting, and audit effort, not just licence fees. It is the clearest way to compare tools that look cheap but create ongoing operational drag.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.