Topic starter
11/06/2026 10:38 pm
TL;DR: Manual access reviews, provisioning, deprovisioning, and certification create visibility and compliance gaps across SaaS estates, according to Zluri, and its 2026 IGA positioning centres on automation, discovery, and ticketless requests for governance workflows. The deeper issue is that access governance only works when entitlement state is current, complete, and reviewable, which manual processes rarely guarantee.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “Why is Zluri the Best IGA Platform In 2026?”.
Key questions
Q: What breaks when access reviews rely on stale entitlement data?
A: Access reviews become a documentation exercise instead of a control test when entitlement data is stale.
Q: When should organisations automate data access instead of using tickets?
A: Organisations should automate access when the request is recurring, low-risk, and policy-driven, such as standard analyst access or repeat AI consumption patterns.
Q: What are the signs that SaaS app permission governance is failing?
A: Common warning signs include users approving apps outside policy, security teams lacking visibility into permission changes, and integrations with broad access that no one can explain.
Practitioner guidance
- Map every SaaS app to a single entitlement source of truth Consolidate SSO, HRMS, finance and direct app data into one governance view before running certification or access reviews.
- Automate deprovisioning at offboarding Trigger revocation and account suspension from leaver events so access does not survive employment changes or role exits.
- Classify managed, unmanaged and shadow IT apps Use discovery signals to separate controlled applications from unknown or unsanctioned ones before assigning reviewers or owners.
Bottom line: Manual access governance breaks down when entitlement state is fragmented, stale or hard to verify across SaaS estates.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 6:52 am
Manual IGA breaks because reviewable truth is usually missing. Certification, provisioning and deprovisioning only work when entitlement state is current enough to be trusted. In SaaS estates, that state is often distributed across multiple systems and updated unevenly, so the governance process validates fragments instead of facts. The practitioner conclusion is that access review quality depends on data integrity before reviewer diligence.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How do identity teams reduce access drift across onboarding, changes and offboarding?
A: They should connect identity lifecycle events to provisioning, modification and deprovisioning workflows so access changes follow the business event rather than a later manual ticket. That keeps role changes, departures and new joiners aligned with policy and reduces the chance that stale access survives past its justified window.
👉 Read our full editorial: Zluri’s IGA pitch exposes where manual access governance breaks
This post was modified 4 days ago by NHI Mgmt Group