Notifications
Clear all
Topic starter
11/08/2026 3:24 pm
TL;DR: Traditional identity matching breaks down when organizations rely on single identifiers that do not survive role changes, recycled records, or multi-system ambiguity, according to Fischer Identity. Attribute-level matching changes the governance baseline because identity confidence, not workflow speed, determines whether joiner-mover-leaver and certification decisions are trustworthy.
NHIMG editorial — based on content published by Fischer Identity: Fischer Identity’s Attribute-Level Matching Transforms Identity Governance
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
Questions worth separating out
Q: How should IAM teams handle identity matching when people have multiple roles or affiliations?
A: They should use multiple validated attributes rather than a single identifier, because multi-role environments create ambiguity that one field cannot reliably resolve.
Q: Why does poor identity matching create governance risk?
A: Poor matching creates duplicate identities, orphaned accounts, and false confidence in joiner-mover-leaver controls.
Q: What do security teams get wrong about identity data in IGA?
A: They often treat identity data as a reporting issue instead of a control dependency.
Practitioner guidance
- Define authoritative attribute sets Map which attributes prove identity, which only support correlation, and which combinations require manual review before provisioning or certification proceeds.
- Test for duplicate and orphan failure modes Run sample identity sets through the matching engine to expose duplicate identities, orphaned accounts, and false joins created by recycled identifiers.
- Tie lifecycle controls to correlation quality Measure joiner-mover-leaver outcomes against identity resolution accuracy so that offboarding and recertification are not judged only by workflow completion.
What's in the full article
Fischer Identity's full blog covers the operational detail this post intentionally leaves for the source:
- The specific attribute combinations the vendor says it uses to correlate identities across systems.
- The configuration approach for weighting identity attributes without custom code.
- The practical examples from higher education, healthcare, and government identity estates.
- The vendor's explanation of how attribute-level matching supports zero-trust policy enforcement.
👉 Read Fischer Identity's analysis of attribute-level matching for identity governance →
Attribute-level matching: what it means for IAM and IGA teams?
Explore further
11/08/2026 3:33 pm
Identity ambiguity is a governance failure, not just a data-quality issue. When a programme cannot consistently determine whether two records belong to the same person, every downstream control inherits uncertainty. Access reviews, deprovisioning, and audit evidence all become weaker because governance is being applied to an approximation. The practical conclusion is that correlation quality belongs in the core identity risk model, not in a supporting data team.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- A separate finding from the same research shows that 97% of NHIs carry excessive privileges, which widens the attack surface when identity records are not accurately correlated.
A question worth separating out:
Q: How do you know if attribute-level matching is actually improving identity governance?
A: Look for fewer duplicate records, fewer orphaned accounts, lower manual exception volume, and cleaner certification outcomes. If reviewers spend less time reconciling identity conflicts and more time validating access decisions, the matching layer is doing real work. Governance improvement should be visible in reduced remediation effort and higher confidence in lifecycle actions.
👉 Read our full editorial: Attribute-level matching exposes the real cost of identity ambiguity
