Topic starter
25/06/2026 12:28 am
TL;DR: Remote and hybrid work have exposed the limits of spreadsheet-driven, quarterly IGA, because access changes faster than manual certification cycles can track, according to SecurEnds. Continuous governance now matters more than periodic clean-up, and the real challenge is keeping entitlements, offboarding, and audit evidence aligned with how people actually work.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “How IGA is Evolving to Support Remote Work and Hybrid Teams”.
Key questions
Q: What breaks when quarterly access reviews are used for remote work?
A: Quarterly reviews miss the pace of remote-work entitlement change.
Q: Why do hybrid environments make identity governance harder?
A: Hybrid environments mix cloud controls, on-premises directories, legacy systems, and inconsistent security defaults.
Q: How can teams tell whether access governance is actually working?
A: Look for short revocation times, low rates of stale entitlements, and repeatable access review outcomes across systems.
Practitioner guidance
- Implement continuous certification for high-risk access Move privileged and externally facing accounts out of quarterly campaigns and into continuous review with event-driven exceptions for remote workers and contractors.
- Automate joiner-mover-leaver triggers from authoritative sources Use HR and directory updates to drive access grants, transfers, and removals so entitlement changes follow the workforce lifecycle instead of manual tickets.
- Centralise entitlement visibility across cloud and on-prem systems Maintain a single operational view of certifications, pending approvals, and active permissions so teams can detect access sprawl before it becomes audit drift.
Bottom line: Remote work exposes the weakness of quarterly IGA by making entitlement changes faster than manual certification can track.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:23 am
Quarterly IGA is a scheduling assumption, not a governance strategy: it assumes access changes slowly enough to be certified after the fact. Remote work breaks that premise because entitlements now drift continuously across cloud apps, devices, and locations. The result is that review cadence becomes disconnected from control reality, and practitioners must treat governance as an always-on state rather than a periodic event.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should organisations prioritise automation over manual certificate handling?
A: Automation should be the default once an organisation manages more than a small number of certificates, because scale makes manual renewal unreliable. The turning point is not a specific count, but the moment certificates span teams, tools, and infrastructure layers that no single person can track safely.
👉 Read our full editorial: Remote-work IGA is shifting from quarterly reviews to real-time control