Topic starter
25/06/2026 5:20 pm
TL;DR: Password management is often treated as a help desk convenience, but SailPoint argues it is a core IAM capability that supports remote onboarding, policy enforcement, and self-service resets across human and shared accounts, with 30% or more of service desk calls tied to password resets according to Gartner. The real governance issue is whether access processes reduce friction without weakening identity controls.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “Password Management – The road to IT productivity”.
By the numbers:
- 30% or more of all IT Service Desk calls are password reset-related, according to a Gartner report cited by SailPoint.
Key questions
Q: How should IAM teams reduce password-related productivity loss?
A: They should start by measuring where password failures interrupt work most often, then redesign the highest-friction journeys first.
Q: What breaks when Active Directory password policy is treated as the main security control?
A: Password policy can prove a secret meets internal rules, but it cannot prove the secret was never exposed elsewhere.
Q: How do shared and service account password changes increase identity risk?
A: They can affect multiple users, scripts, or integrations at once, so a change has a wider blast radius than an ordinary user reset.
Practitioner guidance
- Strengthen self-service onboarding flows Require identity confirmation, security-question enrolment, and completion notifications in the onboarding reset path so remote joiners can complete access setup without manual help desk intervention.
- Extend password policy beyond the directory Apply distinct reset and change policies for integrated applications such as SaaS platforms, then document those rules through a standard change request process.
- Add approvals for shared and service accounts Require extra review when a password change affects shared or service accounts, because the same credential may support multiple users, jobs, or integrations.
Bottom line: Password management still sits inside IAM governance because reset flows shape both productivity and access assurance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:57 pm
Password management is an identity governance control, not a convenience layer. In a remote-first environment, the reset workflow becomes the control point where user experience and security policy meet. That means the real question is whether organisations can preserve assurance while removing avoidable friction. IAM teams should treat password handling as a governed access path, not a service desk afterthought.
A few things that frame the scale:
- The average user manages 70 to 100 passwords, many of them outside centralised identity platforms.
A question worth separating out:
A: Organisations should prioritise centralised password governance when they need breach containment, audit evidence, and coverage across hybrid estates. User-driven self-service tools reduce help desk volume, but they do not give security teams enough control during incidents or enough telemetry for compliance. Centralised governance matters most when credentials are the main attack surface.
👉 Read our full editorial: Password management is still a core IAM productivity control