Topic starter
25/06/2026 12:28 am
TL;DR: Remote and hybrid work make quarterly IGA miss entitlement changes faster than manual certification can track, with SecurEnds citing the gap. Remote-work access then drifts away from review records, leaving offboarding and audit evidence out of sync.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “How IGA is Evolving to Support Remote Work and Hybrid Teams”.
Key questions
Q: Why do hybrid environments make identity governance harder?
A: Hybrid environments mix cloud controls, on-premises directories, legacy systems, and inconsistent security defaults.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems.
Q: What breaks when quarterly access reviews are used for remote work?
A: Quarterly reviews miss the pace of remote-work entitlement change.
Practitioner guidance
- Implement continuous certification for high-risk access Move privileged and externally facing accounts out of quarterly campaigns and into continuous review with event-driven exceptions for remote workers and contractors.
- Automate joiner-mover-leaver triggers from authoritative sources Use HR and directory updates to drive access grants, transfers, and removals so entitlement changes follow the workforce lifecycle instead of manual tickets.
- Centralise entitlement visibility across cloud and on-prem systems Maintain a single operational view of certifications, pending approvals, and active permissions so teams can detect access sprawl before it becomes audit drift.
Bottom line: Remote work exposes the weakness of quarterly IGA by making entitlement changes faster than manual certification can track.
Glossary terms: Continuous Identity Governance, Access Sprawl, Entitlement Drift, Continuous Compliance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:23 am
Quarterly IGA is a scheduling assumption, not a governance strategy: it assumes access changes slowly enough to be certified after the fact. Remote work breaks that premise because entitlements now drift continuously across cloud apps, devices, and locations. The result is that review cadence becomes disconnected from control reality, and practitioners must treat governance as an always-on state rather than a periodic event.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
👉 Read our full editorial: Remote-work IGA is shifting from quarterly reviews to real-time control