Topic starter
09/06/2026 11:57 pm
TL;DR: Managing multiple identity providers is costly and security-intensive, especially when M&A, multi-cloud, and fragmented app estates leave access paths, policy models, and user experiences inconsistent, according to Strata Identity. The real issue is not consolidation alone but the governance drift that appears when identity control planes multiply faster than teams can normalize them.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Product & Engineering”.
Key questions
Q: What breaks when multiple identity providers are left to coexist without governance normalisation?
A: Policy drift breaks first.
Q: Why do M&A and multi-cloud programmes make identity provider sprawl worse?
A: They import separate trust decisions faster than identity teams can standardise them.
Q: How can security teams tell whether identity rationalisation is actually working?
A: Look for fewer divergent policy paths, consistent lifecycle handling, and fewer application-specific exceptions across providers.
Practitioner guidance
- Inventory every identity control plane Document which provider handles authentication, federation, step-up, recovery, and lifecycle decisions for each population and application.
- Map inherited trust and exception paths Trace how M&A and cloud adoption introduced separate directories, federation links, and app-specific exceptions.
- Standardise lifecycle handling across providers Align joiner, mover, and leaver processes so offboarding, recertification, and access reassignment behave consistently even when multiple IDPs remain in place.
Bottom line: Multiple identity providers create a governance problem when policy, recovery, and lifecycle handling diverge behind a unified front end.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 19 hours ago by NHI Mgmt Group
10/06/2026 2:31 am
IDP rationalization is really a governance standardisation problem, not a tooling replacement exercise. The central issue is that enterprises often inherit multiple identity control planes with different policy models, access lifecycles, and integration assumptions. That fragmentation weakens assurance across human identity, service access, and application trust. Practitioners should treat rationalization as a control design problem first and a platform decision second.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, 38% have no or low visibility, and a further 47% have only partial visibility, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What should IAM leaders do when an identity provider must remain in place during migration?
A: Treat it as a temporary trust boundary with documented expiry conditions, not a permanent exception. Restrict new dependencies, keep application mappings explicit, and track which access flows still rely on the older provider. If the coexistence state has no end date, it becomes inherited sprawl rather than migration support.
👉 Read our full editorial: Identity provider rationalization exposes the hidden IAM sprawl problem
11/06/2026 1:31 am
IDP rationalization is really a governance standardisation problem, not a tooling replacement exercise. The central issue is that enterprises often inherit multiple identity control planes with different policy models, access lifecycles, and integration assumptions. That fragmentation weakens assurance across human identity, service access, and application trust. Practitioners should treat rationalization as a control design problem first and a platform decision second.
A few things that frame the scale:
- 85% of organisations lack full visibility into third-party vendors connected via OAuth apps, 38% have no or low visibility, and a further 47% have only partial visibility, according to The State of Non-Human Identity Security.
- Only 1.5 out of 10 organisations are highly confident in their ability to secure NHIs, compared to nearly 1 in 4 for securing human identities.
A question worth separating out:
Q: What should IAM leaders do when an identity provider must remain in place during migration?
A: Treat it as a temporary trust boundary with documented expiry conditions, not a permanent exception. Restrict new dependencies, keep application mappings explicit, and track which access flows still rely on the older provider. If the coexistence state has no end date, it becomes inherited sprawl rather than migration support.
👉 Read our full editorial: Identity provider rationalization exposes the hidden IAM sprawl problem
12/06/2026 3:06 am
Identity provider rationalisation is fundamentally a governance normalisation problem, not a consolidation exercise. Multiple IDPs usually persist because different parts of the enterprise inherited different trust decisions, not because teams deliberately chose architectural duplication. The result is a policy estate that looks centralised from the outside but behaves inconsistently in practice. Practitioners should therefore evaluate rationalisation by how much governance drift it removes, not by how many providers remain.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Prioritise lifecycle consistency first when the enterprise still has different offboarding, recertification, or recovery behaviours across providers. A single front door does not solve hidden access drift if account ownership and deprovisioning remain inconsistent behind it.
👉 Read our full editorial: Identity provider rationalization exposes the hidden IAM sprawl problem
This post was modified 19 hours ago by NHI Mgmt Group