Topic starter
24/06/2026 11:17 pm
TL;DR: User access management still handles provisioning and revocation, but it breaks down when organisations need context, ownership, and continuous review across changing roles and systems, according to SecurEnds. IGA is now the governance layer that keeps access decisions tied to lifecycle events, policy, and audit-ready evidence.
Editorial analysis by NHI Mgmt Group, based on content published by SecurEnds: “Why IGA Is Central to Effective User Access Management in 2026”.
Key questions
Q: What breaks when access management is separated from identity governance?
A: Teams gain the ability to grant access but lose confidence that access remains appropriate over time.
Q: Why does access creep become a governance problem instead of a tooling problem?
A: Access creep grows when roles, projects, and teams change faster than access decisions are revisited.
Q: How do organisations know whether access reviews are working?
A: Access reviews are working when they lead to timely removals, reduced exception volume, and role definitions that stop accumulating unused rights.
Practitioner guidance
- Define lifecycle-linked access governance Tie joiner, mover, and leaver events to access change rules so permissions follow the identity rather than remaining static after role changes.
- Centralize entitlement visibility Build a single view of access across SaaS, cloud, and legacy systems so reviewers can see who has access, where, and why before approving it.
- Automate access certification workflows Replace spreadsheet-based reviews with tracked certifications, reminders, and evidence capture so approvals and exceptions are recorded consistently.
Bottom line: User access management can still enforce permissions, but it cannot by itself explain whether access remains appropriate after roles and systems change.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:03 am
IGA is now the control plane because access without ownership becomes ungovernable. The article correctly shows that enforcement alone does not answer why a permission exists or who is accountable for it. Once access drifts across systems and roles, the security problem is no longer authentication but governance continuity. The practitioner conclusion is straightforward: access control must be wrapped in lifecycle accountability if it is expected to scale.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: What is the difference between access management and identity governance?
A: Access management controls how access is granted and used at runtime, while identity governance decides whether that access should continue to exist. The two functions become much stronger when connected, because usage data can inform governance actions. Without that connection, teams often review stale entitlements without knowing whether they were ever used.
👉 Read our full editorial: Identity governance is now the control plane for user access