Notifications
Clear all
Topic starter
24/06/2026 10:10 pm
TL;DR: Identity orchestration centralises provisioning, de-provisioning, authentication, authorisation, and policy enforcement across multi-cloud estates to reduce manual error and improve auditability, according to 1Kosmos. The governance test is no longer whether identity tasks can be automated, but whether the organisation can prove consistent lifecycle control, context-aware policy, and reliable offboarding across every connected system.
NHIMG editorial — based on content published by 1Kosmos: What Is Identity Orchestration?
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: How should organisations implement identity orchestration without creating new access gaps?
A: Start by defining which system is authoritative for each identity lifecycle event, then connect only the systems that can actually enforce provisioning and revocation.
Q: Why does identity orchestration matter in multi-cloud environments?
A: Multi-cloud environments create more entitlement states than manual IAM teams can reliably track.
Q: What do security teams get wrong about identity orchestration?
A: Teams often treat orchestration as a fix for governance when it is really an execution layer.
Practitioner guidance
- Map authoritative identity sources before automating workflows Define which system owns joiner, mover, and leaver truth for each identity type, then confirm that provisioning and de-provisioning events flow from that source to every downstream application.
- Test revocation across every connected system Run offboarding tests that verify access removal in cloud services, SaaS applications, databases, and directories, because orchestration is only effective if revocation reaches the full estate.
- Separate policy design from workflow automation Document the policy logic for role, attribute, and risk-based access decisions before building automation, then compare the intended policy to the actual enforcement path in each target system.
What's in the full article
1Kosmos's full article covers the operational detail this post intentionally leaves for the source:
- Specific integration points for HR systems, directories, SaaS applications, and cloud platforms
- Examples of policy settings tied to role, behaviour, attributes, device posture, and risk level
- Selection criteria for orchestration platforms, including automation depth, auditing, and support requirements
- The product framing around identity-based authentication, proofing, and cloud-native access workflows
👉 Read 1Kosmos's article on identity orchestration in multi-cloud IAM →
Identity orchestration in multi-cloud environments: what teams miss?
Explore further
25/06/2026 6:54 am
Identity orchestration is a governance layer, not a governance substitute. Automation can reduce manual error, but it does not remove the need to define who owns identity state, who approves exceptions, and who certifies access when systems disagree. The discipline still depends on authoritative lifecycle processes and policy enforcement across human identities, service accounts, and connected applications. Practitioners should treat orchestration as the execution layer beneath governance, not as the governance answer itself.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
A question worth separating out:
Q: How do organisations know if identity orchestration is actually working?
A: Look for fewer manual tickets, faster provisioning, and, more importantly, successful revocation across all connected systems. If access removal fails in even one major application, the orchestration programme is incomplete. Strong performance shows up as consistent entitlement state, clean audit evidence, and fewer exceptions outside workflow.
👉 Read our full editorial: Identity orchestration and the governance gap in multi-cloud IAM
