Topic starter
24/06/2026 11:39 pm
TL;DR: Beach Energy says its identity security programme was hampered by overly manual onboarding, offboarding and user management, poor user experience, and limited access visibility before it reworked its approach with SailPoint. The case shows that identity operations become a security control, not an administrative task, as programmes scale.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Beach Energy Builds Sustainable Identity Security”.
Key questions
Q: How should IAM teams automate onboarding and offboarding without losing governance?
A: They should automate the repeatable lifecycle steps, but keep policy ownership, exception handling and audit evidence under explicit governance.
Q: Why does manual identity management become a security problem at scale?
A: Because each manual step introduces delay, inconsistency and missed revocation opportunities.
Q: What signs show that user access visibility is too weak?
A: Common signs include unclear ownership of entitlements, difficulty explaining why access exists, delayed removal of old access and repeated exceptions outside normal workflow.
Practitioner guidance
- Govern joiner-mover-leaver workflows Map onboarding, offboarding and user-change events to controlled workflows with explicit approvals, ownership and audit records so access changes are consistent.
- Inventory active user access Create a current view of granted access, approval source and business justification so security and compliance teams can spot stale entitlements.
- Reduce access-request friction Remove unnecessary handoffs and duplicated approvals that slow legitimate access changes and encourage informal workarounds.
Bottom line: Beach Energy's example shows that manual identity processes can become a security weakness when they slow down access changes and obscure who should have access.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:36 am
Manual identity operations become a governance liability once scale increases. Beach Energy's experience shows that onboarding, offboarding and access administration stop being back-office tasks when they cannot keep pace with business change. The problem is not just speed, but control integrity: every manual step creates room for delay, inconsistency and undocumented exception handling. Practitioners should treat manual identity handling as a governance gap, not an efficiency issue.
A question worth separating out:
Q: What should organisations prioritise first in identity governance?
A: Organisations should prioritise the highest-cost access problems first: orphaned accounts, excessive privilege, and manual review bottlenecks. Those issues generate both breach risk and operating cost. Start where access cannot be explained cleanly, because unexplained access is usually where governance work, audit delay, and incident scope expand fastest.
👉 Read our full editorial: Beach Energy shows why manual identity security breaks at scale