Notifications
Clear all
Topic starter
12/06/2026 9:05 pm
TL;DR: IGA projects fail for familiar reasons: unclear goals, weak stakeholder engagement, poor resource planning, integration friction, and limited monitoring, while Gartner says over 50% of IGA deployments miss functional, budgetary, or timing commitments. The real issue is not just execution quality, but whether the programme is designed for the complexity of modern identity governance.
NHIMG editorial — based on content published by Zluri: Why does The IGA Project Fail? Top 8 Reasons
By the numbers:
- With 94% of organizations reporting an identity-related breach at some point, a solid IGA strategy is necessary.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security.
Questions worth separating out
Q: What breaks when an IGA programme is launched without clear ownership?
A: The programme usually devolves into manual exception handling and uneven enforcement.
Q: Why do identity governance projects become harder as environments grow?
A: They become harder because identity data, approvals, and entitlement changes spread across more systems than the governance process can reliably coordinate.
Q: How do security teams know whether access reviews are working?
A: Access reviews are working only if they produce timely removals, clear evidence, and fewer unresolved exceptions over time.
Practitioner guidance
- Define control ownership before deployment Assign explicit owners for provisioning, role maintenance, certification, and offboarding so the programme does not rely on ambiguous cross-team accountability.
- Test lifecycle flows against real systems Validate onboarding, role change, and offboarding end to end across HR, directories, SaaS, and cloud platforms before expanding scope.
- Reduce role sprawl before certification cycles Collapse redundant roles and remove obsolete entitlements so reviewers are evaluating current access rather than inherited noise.
What's in the full article
Zluri's full blog covers the operational detail this post intentionally leaves for the source:
- The article’s full breakdown of the eight failure modes, including examples of unclear objectives, weak stakeholder alignment, and insufficient resources.
- Detailed guidance on how Zluri frames access reviews, role governance, and identity lifecycle management within an IGA programme.
- The post’s implementation-oriented examples for provisioning, deprovisioning, and certification workflows across enterprise systems.
- The vendor’s specific recommendations for preventing project delays, budget overruns, and control drift during IGA rollouts.
👉 Read Zluri's analysis of why IGA projects fail and how to prevent them →
IGA project failure: the governance gap teams keep hitting?
Explore further
12/06/2026 10:56 pm
IGA failure is usually an operating-model failure, not a tooling failure. The article shows that projects collapse when goals, ownership, and process discipline are not defined before deployment. That is the same root cause behind many identity governance programmes that look complete on paper but cannot sustain access review, role cleanup, or offboarding in live environments. Practitioners should treat governance design as the control, not the software.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption.
A question worth separating out:
Q: Who should own IGA outcomes when compliance, IAM, and application teams all touch access?
A: Ownership should sit with a named governance function that can enforce decisions across IAM, compliance, and application teams. Shared visibility is not the same as shared accountability. If no single owner can resolve entitlement disputes, approve role changes, and enforce deprovisioning, the programme will fragment into disconnected local practices.
👉 Read our full editorial: Why IGA projects fail and what that means for identity governance
