Topic starter
12/06/2026 10:05 pm
TL;DR: Identity governance and administration still breaks down where organisations rely on ad hoc processes, spreadsheets, partial automation, and weak provisioning oversight, leaving access reviews, revocation, and compliance tracking inconsistent, according to Axiad. Manual governance assumes identities stay visible and stable long enough to manage, but that assumption fails in modern enterprise environments.
Editorial analysis by NHI Mgmt Group, based on content published by Axiad: “5 Current Challenges of Identity Governance and Administration”.
Key questions
Q: What breaks when identity governance relies on spreadsheets and email approvals?
A: Access decisions lose traceability, version control, and reliable ownership.
Q: Why do stale accounts and copy-based provisioning increase access risk?
A: Because they preserve access that no longer matches business need.
Q: How can teams tell whether layered identity governance is actually working?
A: Look for evidence that identity state, access reviews, privileged sessions, and monitoring outputs are aligned.
Practitioner guidance
- Establish a single identity inventory Create a current inventory of people, applications, and accounts so access decisions are based on one governed source of identity truth, not local spreadsheets.
- Tighten provisioning approval logic Require approvers to see the full entitlement set before granting access, and block copy-based provisioning from carrying forward unnecessary privileges.
- Automate revocation triggers Connect offboarding, contract end, and role-change events to removal workflows so stale accounts do not remain active after their business purpose ends.
Bottom line: Manual identity governance fails because it cannot keep identity evidence current across distributed systems.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
13/06/2026 12:37 am
Manual identity governance is a control failure, not a process preference: once access decisions depend on spreadsheets, email chains, and local workarounds, the programme stops being governable at scale. The issue is not whether teams are trying hard enough, but whether the identity model still produces reliable evidence. For IAM and IGA leaders, the real question is whether access can be reviewed, corrected, and revoked without human reconstruction of the truth.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should IAM and IGA teams do when access decisions are still manual?
A: They should move the programme toward a single governed identity inventory, event-driven revocation, and approval processes that expose the full entitlement set before access is granted. Without that shift, the organisation is certifying incomplete data and allowing privilege drift to accumulate.
👉 Read our full editorial: Identity governance still breaks on manual access decisions
This post was modified 5 days ago by NHI Mgmt Group