Topic starter
30/07/2026 10:49 pm
TL;DR: IGA programmes often look mature on paper but still govern only a fraction of the application estate because connectivity, not features, is the real constraint, according to StackBob and survey data from SailPoint, Omdia, Gartner, and others. The governance problem is coverage, not capability: if identity state cannot be read or written, maturity scores overstate control.
Editorial analysis by NHI Mgmt Group, based on content published by StackBob: “You Can't Govern What You Can't Connect”.
Key questions
Q: How should teams measure IGA maturity when many applications are not integrated?
A: Measure the percentage of the application estate that can be governed end to end, not the number of features purchased.
Q: Why do mature IGA programmes still leave major gaps in access governance?
A: Because governance capability and application connectivity are different controls.
Q: What breaks when an IGA platform has no discovery layer for unconnected applications?
A: Without discovery, governance only covers the apps already in the system of record.
Practitioner guidance
- Map governance coverage separately from tool ownership Create an application-by-application view that distinguishes inventory, policy inclusion, and live connectivity so you can see where governance is only nominal.
- Prioritise the long tail of hard-to-connect apps Identify the applications that still require manual exports, ticketing, or spreadsheet-based reviews and assign them a remediation track based on risk and business criticality.
- Validate that reviews touch live entitlement state Check whether certification, provisioning, and deprovisioning outcomes are written back to the source application instead of stopping at the governance workflow.
Bottom line: The core problem is not missing governance features, but limited application reach, which means many IGA programmes control only part of their estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:56 pm
Application connectivity is the real maturity control, not feature breadth. An IGA programme can own certification, workflows, and JML processes and still govern only a subset of the estate if it cannot reach the applications themselves. That means maturity scores based on capability inventories systematically overstate real control. For identity leaders, the practical conclusion is that coverage must be measured as an operational control surface, not as a software checklist.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: Should teams replace their IGA platform or fix connectivity first?
A: Fix connectivity first unless the platform is truly end-of-life or incompatible with the architecture. Replacing the tool does not remove application constraints such as missing APIs, SCIM, or connector support, so the same coverage ceiling often returns in a new product wrapper.
👉 Read our full editorial: Application connectivity is the real gap in IGA maturity