Topic starter
25/06/2026 3:03 pm
TL;DR: Stale entitlements can survive role changes, system growth, and administrator churn long enough to become audit evidence or breach exposure, according to SecurEnds. Identity governance only works when provisioning, review, and offboarding move in lockstep to remove rights before they harden into standing privilege.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why Identity Governance and Administration (IGA) is Important”.
Key questions
Q: Why does access sprawl increase security and compliance risk in modern environments?
A: Access sprawl increases risk because every extra app, identity, and permission widens the attack surface and weakens oversight.
Q: How can teams tell if recertification is actually working?
A: Look for fewer stale entitlements after review cycles, faster correction of role changes, and fewer repeated approvals for the same access.
Q: What breaks when organisations cannot prove who had access during an incident?
A: Containment slows, reporting becomes uncertain, and investigators lose the ability to reconstruct how an event moved through the environment.
Practitioner guidance
- Define a single entitlement inventory Create one authoritative view of who has access to which applications, roles, and privileged functions so reviewers can compare current access against policy and business need.
- Connect mover and leaver events to access removal Trigger entitlement updates when employees change jobs, teams, or status so permissions do not persist beyond the justification that created them.
- Shorten certification cycles for high-risk access Prioritise admin rights, shared accounts, and access to sensitive systems so reviews happen before excess privilege becomes normalised.
Bottom line: Access governance fails when organisations cannot keep entitlement records current across changing roles, systems, and administrators.
Glossary terms: Identity Governance and Administration (IGA), Access Sprawl, Access Certification, Joiner-mover-leaver governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
25/06/2026 4:20 pm
Access sprawl is the governance failure IGA exists to absorb. The article correctly centres the problem on visibility, because organisations cannot govern what they cannot enumerate. Once access is spread across apps, directories, and delegated admin paths, policy becomes descriptive instead of enforceable. That is why IGA is less a reporting layer than a control layer, and practitioners should treat entitlement inventory as a prerequisite for every downstream access decision.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should organisations do first to keep offboarding from leaving stale access behind?
A: Organisations should deactivate the user in the identity provider first, then confirm that the deactivation syncs into downstream access systems. That sequence suspends the user and their devices in the connected environment. Before deleting the identity entirely, reauthenticate any devices that must remain, so legitimate services are not unintentionally cut off during the offboarding process.
👉 Read our full editorial: Identity governance and administration must keep access records current
This post was modified 19 hours ago by NHI Mgmt Group