Notifications
Clear all
Topic starter
24/07/2026 4:09 pm
TL;DR: More than 80% of enterprise applications remain ungoverned because onboarding into identity governance platforms is slow, costly, and inconsistent, according to Saviynt. The real shift is that onboarding backlog becomes a governance design problem, not a staffing problem, while its Terraform provider turns governance configuration into declarative code with versioning, review, and promotion.
NHIMG editorial — based on content published by Saviynt: Onboarding as Code: How Saviynt's Terraform Provider Solves Identity Governance's Hardest Problem
By the numbers:
- 80% of enterprise applications remain ungoverned because onboarding, onboarding them into governance platforms is painfully slow and prohibitively expensive.
- At 3 to 4 weeks per application and 500 applications to govern, the backlog becomes decades of work.
- Teams go from 2 to 3 applications per month to 30 to 50 when onboarding patterns are reused as modules.
Questions worth separating out
Q: How should teams scale application onboarding without turning identity governance into a backlog?
A: Use repeatable onboarding modules, version-controlled change flows, and standard control patterns for common application types.
Q: Why do manual IGA onboarding processes fail in large environments?
A: They fail because each application brings a different schema, entitlement model, and coordination path, which creates long discovery cycles and inconsistent configuration.
Q: What do identity teams get wrong about automation in access governance?
A: They often treat automation as a substitute for governance rather than a way to make governance scalable.
Practitioner guidance
- Standardise application onboarding patterns Define reusable modules for common application classes such as Active Directory, SQL databases, REST APIs, SCIM, and LDAP so that each new integration does not start from zero.
- Put governance changes under version control Require pull requests, approvals, and commit history for every onboarding change so that identity configuration becomes reviewable and traceable.
- Compare intended state with live state continuously Run scheduled plan comparisons against the production environment so drift is detected before audits or incidents expose it.
What's in the full article
Saviynt's full blog covers the operational detail this post intentionally leaves for the source:
- Terraform Registry implementation detail for defining governance state as code.
- Example module patterns for common application classes such as AD, SQL, REST, SCIM, and LDAP.
- How pull requests, approvals, and git history map to audit-ready identity change control.
- The before-and-after operating model for environment promotion and drift detection.
👉 Read Saviynt's post on onboarding as code for identity governance →
Onboarding as code: what it means for IAM teams?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
24/07/2026 4:13 pm
Onboarding backlog is now a governance failure, not an implementation delay. When more than four out of five applications remain outside governance, the issue is no longer integration speed. It is that the programme has accepted a long tail of uncontrolled access decisions as normal. That leaves auditors with partial evidence and security teams with a false sense of coverage. The practitioner conclusion is simple: backlog itself is a risk signal, not just an operations metric.
A few things that frame the scale:
- More than 80% of enterprise applications remain ungoverned because onboarding them into governance platforms is painfully slow and prohibitively expensive, according to The 2024 ESG Report: Managing Non-Human Identities.
- A separate finding in the same report says enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months.
A question worth separating out:
Q: How can organisations tell whether onboarding as code is actually improving governance?
A: Look for shorter onboarding cycles, fewer environment-specific differences, visible change history, and reliable drift detection. If the process is faster but still produces inconsistent access rules or unexplained exceptions, governance has not improved. The control should make evidence easier to produce, not just deployment easier to repeat.
👉 Read our full editorial: Onboarding as code changes the economics of IGA governance
