Topic starter
06/11/2026 6:40 pm
TL;DR: Many identity integrations called “connected” only surface account data, while true governance requires provisioning, deprovisioning, entitlement changes, and verification that updates actually landed, according to READI. Read-only links produce reports, not control, so access can remain in place long after a review closes.
Editorial analysis by NHI Mgmt Group, based on content published by READI: “What “connected” actually means in identity governance (and why most integrations fall short)”.
Key questions
Q: How do I tell whether an identity integration is actually governing access?
A: An integration is actually governing access when it can read the entitlement model, detect who has what, and write changes back to the target system.
Q: Why do read-only connectors create risk in identity governance?
A: Read-only connectors create risk because identity governance tools can see entitlements but cannot change them, so reviewers may approve access that stays in place after remediation.
Q: How should teams measure identity governance coverage beyond connector count?
A: Teams should measure coverage by the share of in-scope identities, applications, entitlements, and privileged roles that can be governed end to end.
Practitioner guidance
- Define connected coverage by capability Classify each integration as read-only, write-enabled, or lifecycle-enforcing, then remove read-only systems from any metric that implies governance coverage.
- Test deprovisioning as a real outcome Run a joiner-mover-leaver scenario against each critical connector and confirm the target system actually removed or changed the entitlement, not just that the task closed.
- Separate reporting from enforcement Use certification and dashboard feeds for discovery only, and require a different control path for access removal or entitlement modification.
Bottom line: Many integrations marketed as connected still function only as reporting feeds, which means they cannot complete identity governance at the source.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Connectivity is not governance unless it can change source access. The core governance failure is treating observation and enforcement as the same control. A system that only reads entitlements can support audit evidence, but it cannot close the loop on JML or access review outcomes. That means many programmes are certifying visibility rather than control, which leaves standing access in place until a person intervenes.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should teams do when an application cannot support automated deprovisioning?
A: Use compensating controls when an application cannot support automated deprovisioning, such as disabling the account at the directory or SSO layer, removing group memberships, or revoking tokens and certificates. Then track the gap as an exception with manual offboarding steps and an owner. Without lifecycle enforcement, access removal remains dependent on human follow-up.
👉 Read our full editorial: Connected should mean governed access, not just read-only visibility