Topic starter
25/06/2026 3:03 pm
TL;DR: Access creep, orphaned accounts, and untracked admin rights show why identity governance and administration has become essential for enforcing least privilege, proving access decisions, and reducing audit and breach risk, according to SecurEnds. The core issue is that access reviews and offboarding still lag the speed and scale of modern identity sprawl, leaving control gaps that matter across IAM, NHI, and lifecycle governance.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why Identity Governance and Administration (IGA) is Important”.
Key questions
Q: What breaks when organisations cannot prove who had access during an incident?
A: Containment slows, reporting becomes uncertain, and investigators lose the ability to reconstruct how an event moved through the environment.
Q: Why does access sprawl increase security and compliance risk in modern environments?
A: Access sprawl increases risk because every extra app, identity, and permission widens the attack surface and weakens oversight.
Q: How can teams tell if recertification is actually working?
A: Look for fewer stale entitlements after review cycles, faster correction of role changes, and fewer repeated approvals for the same access.
Practitioner guidance
- Define a single entitlement inventory Create one authoritative view of who has access to which applications, roles, and privileged functions so reviewers can compare current access against policy and business need.
- Connect mover and leaver events to access removal Trigger entitlement updates when employees change jobs, teams, or status so permissions do not persist beyond the justification that created them.
- Shorten certification cycles for high-risk access Prioritise admin rights, shared accounts, and access to sensitive systems so reviews happen before excess privilege becomes normalised.
Bottom line: Access governance fails when organisations cannot keep entitlement records current across changing roles, systems, and administrators.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 4:20 pm
Access sprawl is the governance failure IGA exists to absorb. The article correctly centres the problem on visibility, because organisations cannot govern what they cannot enumerate. Once access is spread across apps, directories, and delegated admin paths, policy becomes descriptive instead of enforceable. That is why IGA is less a reporting layer than a control layer, and practitioners should treat entitlement inventory as a prerequisite for every downstream access decision.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations do first to keep offboarding from leaving stale access behind?
A: Organisations should deactivate the user in the identity provider first, then confirm that the deactivation syncs into downstream access systems. That sequence suspends the user and their devices in the connected environment. Before deleting the identity entirely, reauthenticate any devices that must remain, so legitimate services are not unintentionally cut off during the offboarding process.
👉 Read our full editorial: Identity governance and administration is closing access sprawl