Topic starter
24/06/2026 10:10 pm
TL;DR: Identity orchestration improves access administration across multi-cloud estates, but the governance risk is incomplete de-provisioning, which 1Kosmos says leaves revoke events unevenly consumed. Residual access after status change is the measure that matters across connected systems.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “What Is Identity Orchestration? (Next Evolution of IAM?)”.
Key questions
Q: Why do multi-cloud agent deployments create governance risk for IAM teams?
A: Because each cloud and business unit can introduce agents independently, the central IAM model no longer has a complete view of what exists.
Q: How do organisations know if identity orchestration is actually working?
A: Look for fewer manual tickets, faster provisioning, and, more importantly, successful revocation across all connected systems.
Q: What breaks when identity orchestration does not cover the full access lifecycle?
A: The usual failure is not provisioning, it is revocation.
Practitioner guidance
- Define lifecycle ownership for every connected system Map which team owns provisioning, de-provisioning and exception handling for each cloud, SaaS and on-premises target before orchestration is expanded.
- Validate revoke success at the application layer Test whether downstream applications actually remove access when an orchestration workflow completes, rather than assuming the workflow itself is evidence of offboarding.
- Normalise policy inputs before centralising enforcement Align role, attribute and risk signals so policy logic means the same thing across platforms, then document where local exceptions are permitted.
Bottom line: Identity orchestration improves how access is administered across multi-cloud estates, but it does not remove the need to prove lifecycle control.
Glossary terms: Identity Orchestration, Identity Fabric, De-provisioning, Context-Aware Policy
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 6:54 am
Identity orchestration is not the governance layer, it is the execution layer. Automating provisioning and de-provisioning reduces error, but governance still depends on whether every access grant, policy change and revoke event is provable across each connected system. In multi-cloud estates, the control problem is consistency of enforcement, not just speed of administration. Practitioners should separate workflow automation from lifecycle assurance.
A question worth separating out:
A: Identity orchestration is the active layer that connects identity systems, migrates users and credentials, and applies access logic across environments. Identity fabric is the broader abstraction layer that unifies different identity infrastructures, APIs, data models, and policy sets into one consistent control plane. In practice, orchestration does the work, while the fabric provides the architectural foundation.
👉 Read our full editorial: Lifecycle control is the real test for identity orchestration
This post was modified 1 day ago by NHI Mgmt Group