Topic starter
06/11/2026 6:34 pm
TL;DR: Oak says IGA implementation cost is shaped less by the licence line than by services, custom connectors, data cleanup, role modelling and ongoing run costs, while machine and AI agent identities widen scope and delay first answers. The real governance variable is whether the programme can keep pace with the estate it is meant to control.
Editorial analysis by NHI Mgmt Group, based on content published by Oak: “What Identity Governance Implementations Cost and How Long They Run”.
Key questions
Q: How should teams budget for IGA implementation beyond the licence fee?
A: Budget for implementation services, connector builds, identity data cleansing, role engineering, workflow design, testing, training, and cutover support, not just the licence fee.
Q: Why do custom connectors increase identity governance project cost?
A: Custom connectors increase project cost because they add design, build, testing, and support work that sits outside standard product configuration.
Q: How do dirty identity records affect role modelling and access reviews?
A: Dirty identity records weaken role modelling and access reviews by giving governance tools incomplete or inconsistent facts about people, accounts, entitlements, and managers.
Practitioner guidance
- Demand a written quote by cost line Ask for separate pricing on services, connectors, role modelling, data cleanup, internal staffing and run cost so hidden scope does not disappear into the licence line.
- Define ownership before automation starts Require a named owner for every application, account and review row before connector onboarding, especially where service accounts or AI agents expand the estate.
- Test connector method against real systems Insist that each integration is described by method, build owner, test owner and maintenance owner, not just by the target application name.
Bottom line: IGA implementation cost is driven by integration work, data remediation and operating effort as much as by the software licence.
What's in the full article
Oak's full blog post covers the operational detail this post intentionally leaves for the source:
- Line-by-line quote structure for services, connectors, data cleanup, staffing and run cost
- Practical examples of how connector method changes implementation effort across different system types
- Vendor-facing question set for validating first-answer timing and full rollout assumptions
- Implementation framing for organisations choosing between augmentation and replacement paths
👉 Read Oak's guidance on what drives IGA implementation cost and timeline →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Implementation cost is really governance debt made visible. A low licence price does not mean a low-cost programme when integration, data remediation and reviewer effort sit outside the quote. The budget challenge is that these hidden lines are often the work that determines whether the programme can actually govern access, so procurement should treat them as core scope rather than optional extras.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should machine identities be included in an IGA rollout?
A: Machine identities should be included from the start if they hold access to business data, production systems, or privileged APIs, because they need ownership, scope, and lifecycle controls just like users. If the rollout begins with human accounts only, the inventory, certification model, and offboarding process usually need rework when service accounts, tokens, and certificates are added later.
👉 Read our full editorial: IGA implementation costs rise with connectors, data cleanup and AI scope