Topic starter
05/07/2026 10:43 pm
TL;DR: Lumos is strong for SaaS access requests and lightweight reviews, but its IdP-level data model leaves deep entitlements, out-of-band changes, and non-human identity governance outside its view, according to Linx Security. That ceiling matters because identity risk increasingly lives below the IdP, where review-only remediation cannot keep pace.
Editorial analysis by NHI Mgmt Group, based on content published by Linx Security: “Best Lumos Alternatives: 7 Identity Security and Governance Platforms to Consider in 2026”.
Key questions
Q: What breaks when identity governance stops at the IdP layer?
A: When governance stops at the IdP, the platform can certify only what the directory already knows.
Q: Why do out-of-band access changes create governance risk?
A: They create risk because the change bypasses the system that is supposed to define and review access.
Q: How should teams govern non-human identities in AI-heavy environments?
A: Teams should govern non-human identities the same way they govern other privileged assets: assign ownership, minimise scope, rotate credentials regularly, and monitor for abnormal use.
Practitioner guidance
- Audit where your governance data stops Map whether your current IGA stack sees only IdP attributes or also ingests app-native entitlements, direct grants, and local admin changes.
- Separate detection from certification Ensure high-risk changes can be remediated by direct revocation or entitlement adjustment instead of forcing every issue through a review cycle.
- Classify non-human identities by type Track service accounts, API keys, tokens, and AI agents separately so lifecycle ownership and offboarding rules match the identity class.
Bottom line: IdP-only governance leaves effective access partially invisible, especially when privileges are created inside applications or by automation outside the directory.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 10:47 pm
IdP-level governance is a reporting boundary, not an identity boundary: once the governance model stops at what the IdP knows, the organisation is no longer governing effective access. The article shows that app-level permissions, direct grants, and non-human identities all live below that line. The practitioner implication is that review quality cannot exceed the quality of the entitlement data feeding it.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations look for in a replacement for SaaS-only IGA?
A: They should look for deep entitlement ingestion, direct remediation, and coverage that extends beyond SaaS into custom apps, legacy systems, and non-human identities. The key test is whether the platform governs the actual authorisation layer rather than only summarising identity-provider data.
👉 Read our full editorial: Lumos alternatives expose the limits of IdP-level identity governance