Topic starter
25/06/2026 12:51 am
TL;DR: Governance coverage can stall when IGA cannot reach core applications through rigid VPN paths and delayed network approvals, according to Omada Identity. Identity teams need auditable reach to every in-scope system, or reviews and entitlement actions stay incomplete.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “Securing and Scaling Identity Governance with the Cloud Application Gateway”.
Key questions
Q: Why do VPN-based connectivity patterns create governance risk for IGA?
A: VPNs restore reach by extending network trust, not by narrowing it.
Q: How should security teams evaluate whether gateway-based connectivity is working?
A: They should test whether the gateway can bring critical systems under governance without firewall exceptions, manual routing changes, or standing network access.
Q: What breaks when IGA platforms cannot connect to core applications?
A: Governance breaks at the point of coverage.
Practitioner guidance
- Define connectivity as a governance prerequisite List the applications, databases, and operational systems that must be reachable before access reviews, certifications, or provisioning workflows can operate at scale.
- Replace network-centric access paths with application-scoped paths For governed systems, avoid relying on broad VPN or subnet-level access where an application-level gateway can preserve tighter scope.
- Validate who owns the encryption keys Confirm that the connectivity layer preserves customer-controlled key ownership and that the enterprise can defend the trust boundary during audit.
Bottom line: Identity governance cannot deliver full oversight when connectivity to core systems depends on delayed network approvals and rigid VPN paths.
Glossary terms: Identity Governance, Application-scoped policy, Outbound-only connectivity, Customer-controlled encryption
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:53 am
Connectivity is now part of the governance control surface: identity governance fails when the systems in scope cannot be connected on time, under control, and with defensible evidence. That is why network approval cycles, tunnel dependencies, and exception-driven access paths should be treated as governance blockers, not just infrastructure friction. The practitioner lesson is to define connectivity as a formal IGA prerequisite, not a downstream implementation task.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What governance decision should teams make before adopting a cloud application gateway?
A: Teams should decide whether connectivity will be measured as an architecture choice or as a governance control. If the answer is both, the design must preserve least-privilege access, customer-controlled keys, and auditable reach to every in-scope application.
👉 Read our full editorial: Cloud application gateways make IGA connectivity a governance issue