Topic starter
06/11/2026 6:38 pm
TL;DR: Many IGA programmes appear live while only governing the easiest applications, leaving legacy, homegrown and disconnected systems outside enforcement, according to Way Security research. NHIMG's view is that ownership without universal enforcement produces the appearance of governance, not governance itself.
Editorial analysis by NHI Mgmt Group, based on content published by Way Security: “Deployed Is Not Enforced: Ending IGA Implementation Limbo”.
Key questions
Q: How should teams handle applications that cannot be enforced by IGA tooling?
A: Treat them as a governance exception with a named owner, documented scope, and compensating controls such as manual certification, periodic entitlement attestation, log review, and time-bound review dates.
Q: Why do access reviews fail when key applications are out of scope?
A: Access reviews fail because the review only covers what the IGA platform can see, so material entitlements in out-of-scope systems remain unexamined.
Q: How should security teams reduce risk in manual identity governance processes?
A: Security teams should remove repeatable approval work from email and spreadsheet handling, then tie each access decision to identity context, entitlement state, and ownership.
Practitioner guidance
- Audit enforcement coverage by application class Separate apps that are genuinely enforced from apps that are only listed in the programme.
- Eliminate manual middleware for recurring controls Replace CSV exports, spreadsheet-based certification and console-by-console offboarding with a tracked control path.
- Set a hard standard for in-scope systems Require each application to meet a defined governance threshold before it can be counted as covered.
Bottom line: IGA programmes can appear operational while still leaving critical applications outside enforced control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Implementation limbo is a governance state, not a temporary rollout phase. A programme that controls only the applications with clean connectors does not become safer because it is fully licensed or well diagrammed. It becomes selective governance, with the hardest systems left to manual exception handling. The practitioner question is not whether the platform works on the easy estate. It is whether the control model survives contact with the rest of the portfolio.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between lifecycle automation and partial governance coverage?
A: Lifecycle automation provisions, changes, and removes access through an integrated workflow, while partial governance coverage only certifies or reports on some systems. The joiner, mover and leaver process can still work for covered applications, but uncovered ones need manual provisioning, deprovisioning, and evidence collection, otherwise access drift persists outside the automated control.
👉 Read our full editorial: IGA enforcement fails when non-standard apps stay out of scope