Topic starter
06/07/2026 9:35 am
TL;DR: IGA programmes often go live with core connectors and JML flows in place, yet the long tail of custom, legacy, and SaaS applications still gets provisioned manually, according to StackBob. That gap keeps growing because native connector development and custom builds do not scale with real enterprise application sprawl, and coverage stops being visible after go-live.
Editorial analysis by NHI Mgmt Group, based on content published by StackBob: “The IGA Coverage Gap Is the MSP Industry's Most Underused Revenue Conversation”.
Key questions
Q: Why do IGA programmes still leave applications manually provisioned after go-live?
A: Because connector scope rarely keeps pace with the full application estate.
Q: What happens when identity teams rely on custom connectors for every uncovered app?
A: The programme inherits a build-and-maintain burden that scales poorly.
Q: How do teams know if IGA is actually working?
A: Look for evidence that entitlement changes are being governed before access expands beyond need.
Practitioner guidance
- Map the unmanaged application tail Inventory every application still handled outside automated IGA flows, including legacy systems, SaaS apps without SCIM support, and shadow IT.
- Separate high-value builds from long-tail exceptions Use a triage model that reserves custom connector work for strategically important applications and assigns the rest of the tail to a broader coverage strategy.
- Track governed coverage after go-live Measure the percentage of the estate that participates in automated provisioning, reconciliation, and recertification after implementation is complete.
Bottom line: IGA implementations can be technically successful and still leave a large portion of the application estate outside automated governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 9:50 am
Coverage debt is the hidden failure mode in many IGA programmes: the implementation is not wrong, but the estate continues to grow beyond the connector set. Core applications look governed while the long tail stays manual, which makes the programme appear healthier than it is. The practical conclusion is that teams should treat incomplete connector reach as governance debt, not an edge case.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What should identity leaders do when the application tail is too broad for custom builds?
A: Prioritise a portfolio approach. Reserve bespoke integrations for high-value systems, then use a broader coverage strategy for the rest of the estate so governance does not depend on one-off connector projects.
👉 Read our full editorial: AIga coverage gaps persist where connectors and custom builds fail