Topic starter
25/06/2026 12:27 am
TL;DR: Legacy access reviews do not scale cleanly as cloud, SaaS, and machine identities multiply access paths, according to SecurEnds. Access certification has to keep pace with identity sprawl, or permissions stay stale and excessive access persists longer than it should.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “13 Best IGA (Identity Governance and Administration) Solutions for 2026”.
Key questions
Q: Why do modern IGA platforms matter more as cloud and SaaS sprawl grows?
A: They matter because the governance problem shifts from simple provisioning to continuous validation of who should have access, for how long, and under what policy.
Q: What are the signs that identity governance is not working in practice?
A: Common warning signs are repeated access workarounds, ignored approval workflows, super admins holding too much power, and teams bypassing the process because it is too slow or hard to use.
Q: What breaks when access reviews rely on spreadsheets and other manual tracking methods?
A: Spreadsheets and other manual methods break down when access volume, role churn, and system integrations grow.
Practitioner guidance
- Inventory every identity type in scope Map employees, contractors, service accounts, APIs, and bots into a single governance model so review coverage matches the actual estate.
- Tie access changes to lifecycle events Automate provisioning and deprovisioning from joiner, mover, and leaver triggers so access ends when the business need ends.
- Rebuild certification around policy outcomes Use access reviews to validate whether current entitlements still match role, policy, and regulatory need rather than recertifying old lists.
Bottom line: Legacy access reviews do not scale cleanly once cloud, SaaS, and machine identities multiply the number of access paths.
Glossary terms: Identity Governance and Administration (IGA), Access Certification, Role-Based Access Control, Attribute-Based Access Control
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:21 am
Legacy access review models are now structurally misaligned with identity sprawl. The article makes the core problem plain: once cloud apps, SaaS, and non-human identities multiply faster than review cycles, periodic certification stops being a control and becomes paperwork. That is why governance has to shift from inspection after the fact to lifecycle control at the point access is created or changed.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Should organisations prioritise automation or policy modelling first in IGA?
A: They should start with policy clarity, because automation only accelerates whatever rules already exist. If roles, attributes, and approval logic are poorly defined, the platform will scale bad governance faster. The right sequence is to define the access policy model, then automate provisioning, certification, and reporting against it.
👉 Read our full editorial: IGA solutions in 2026 expose the limits of legacy access reviews