Topic starter
12/06/2026 12:10 am
TL;DR: Only 6% of organisations have fully automated identity governance, while 84% rely entirely on manual methods and another 10% use partial legacy automation, according to Zluri’s 2025 survey. Legacy IGA still dominates identity governance because static access models cannot keep pace with SaaS sprawl, mixed identity types, and review processes that depend on fragmented data.
Editorial analysis by NHI Mgmt Group, based on content published by Zluri: “How Next-Gen IGA Addresses The Shortcomings Of Legacy IGA”.
By the numbers:
- Only 6% of organizations have a fully automated setup for managing their identity governance and administration process.
- 84% of organizations rely entirely on manual methods.
- The remaining 10% leverages legacy IGA and disparate solutions that partially automate the process and offer limited functionality.
Key questions
Q: What breaks when legacy IGA is used in cloud-first environments?
A: Legacy IGA breaks down when identity change outpaces manual governance.
Q: Why do fragmented identity systems create audit and security risk?
A: Fragmented systems break the chain between access, approval, and evidence.
Q: How should organisations handle provisioning when department labels are too coarse?
A: They should move from department-based grouping to role, usage, and account-type driven provisioning.
Practitioner guidance
- Map identity sources end to end Inventory every system feeding identity governance, including SSO, HR, ITSM, SaaS apps, and any shadow IT sources, so you can see where records are fragmented or stale.
- Unify duplicate identity records Create a reconciliation process that merges formatting variants and duplicate user records before certification, deprovisioning, or access approval decisions are made.
- Replace department-only provisioning Use role, usage, and account type signals to drive access decisions instead of relying on department labels as a proxy for entitlement need.
Bottom line: Legacy IGA is failing because it assumes a stable identity environment, while modern organisations now operate with fragmented data, SaaS sprawl, and mixed identity types.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
12/06/2026 9:14 am
Dynamic identity governance exposes a governance-data problem before it exposes a tooling problem: legacy IGA fails because the identity graph it depends on is no longer stable enough to trust. In SaaS-heavy environments, identity state changes faster than manual reconciliation or connector refresh cycles can keep up. The practitioner consequence is that governance must be evaluated as an evidence-quality discipline, not just an access workflow.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: How should teams govern service accounts and bots alongside human users?
A: Treat service accounts, bots, and other non-human identities as owned assets with explicit purpose, review, and retirement rules. They need the same lifecycle discipline as human identities, but with tighter inventory, stronger change tracking, and clearer accountability because they are often more persistent and less visible.
👉 Read our full editorial: Legacy IGA cannot keep up with dynamic identity governance
This post was modified 4 days ago by NHI Mgmt Group