Notifications
Clear all
Topic starter
25/06/2026 12:02 am
TL;DR: Organisations use IGA automation, RBAC, lifecycle management, and audit reporting to cut manual work, remove access faster, and improve compliance readiness across hybrid environments, according to Omada Identity. The core issue is not tool deployment alone, but whether governance can keep pace with joiner-mover-leaver change without leaving orphaned access behind.
NHIMG editorial — based on content published by Omada Identity: The IGA Value Proposition, summarising PeerSpot reviewers' feedback on Omada Identity Cloud
By the numbers:
- 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, 46% confirmed and 26% suspected.
Questions worth separating out
Q: How should security teams automate joiner-mover-leaver processes in IGA programmes?
A: Security teams should connect identity governance workflows to authoritative HR or asset sources so access provisioning and removal happen from state changes, not manual requests.
Q: Why do orphaned accounts remain a major identity governance risk?
A: Orphaned accounts remain risky because access often outlives employment, role change, or vendor relationships when removal depends on manual follow-through.
Q: How do organisations know if RBAC is actually reducing privilege creep?
A: Organisations should measure whether roles are shrinking exception counts, reducing entitlement overlap, and passing certification without repeated manual overrides.
Practitioner guidance
- Automate joiner-mover-leaver workflows for critical systems Connect provisioning and deprovisioning to authoritative sources of record so role changes and departures trigger access removal without waiting for manual tickets.
- Rationalise role catalogues before expanding certification cycles Review whether roles still match current job functions, remove inherited entitlements, and collapse duplicate access patterns that create hidden privilege creep.
- Treat audit trails as control evidence, not reporting output Preserve immutable records for approvals, removals, and re-certifications so auditors can reconstruct who approved what and when.
What's in the full article
Omada Identity's full blog post covers the operational detail this post intentionally leaves for the source:
- PeerSpot quote excerpts that show how practitioners describe deployment speed, automation, and audit outcomes in their own words.
- Implementation-oriented detail on how Omada connects workflow automation to provisioning, deprovisioning, and certification across hybrid environments.
- Examples of the audit-reporting and evidence collection workflow that support internal and external review.
- The source article’s framing of how customers describe reduced manual effort and faster access governance decisions.
👉 Read Omada Identity's PeerSpot review on IGA automation, security, and audit readiness →
IGA automation and lifecycle control: what practitioners should watch?
Explore further
25/06/2026 8:50 am
IGA value is measured by how quickly it collapses access drift, not by how much workflow it automates. The article’s strongest signal is that manual identity work is now the control weakness, not just the operational burden. When joiner-mover-leaver activity and certification are still handled by humans across hybrid estates, privilege persists longer than it should. Practitioners should treat workflow speed as a security control, not just an efficiency metric.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, 38% have no or low visibility and a further 47% have only partial visibility, according to the State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities, according to the State of Non-Human Identity Security.
A question worth separating out:
Q: Who is accountable when access remains active after a leaver event?
A: Accountability should sit with the business owner of the identity process, the system owner of the target application, and the governance team that defines removal standards. If offboarding is shared, the control must still have a single named owner for completion and evidence retention.
👉 Read our full editorial: PeerSpot feedback shows IGA value depends on automation and lifecycle
