Topic starter
06/11/2026 6:55 pm
TL;DR: Many teams already have access reviews and lifecycle features, yet disconnected apps still force manual follow-up, according to Ploy. For practitioners, the real test is whether governance decisions are enforceable beyond the IdP-connected core.
Editorial analysis by NHI Mgmt Group, based on content published by Ploy: “IGA vs IdP: do you need identity governance alongside Okta or Microsoft Entra?”.
Key questions
Q: How should security teams govern access in disconnected apps?
A: Security teams should treat disconnected apps as lifecycle exceptions and enforce a manual control model that records every joiner, mover, and leaver action.
Q: What is the best way to verify review remediation?
A: The best way is to verify the reviewer’s decision against the underlying evidence, then test that the required remediation was actually completed.
Q: How do identity governance and identity providers differ?
A: An identity provider handles authentication, sign-in, and basic account visibility.
Practitioner guidance
- Define estate coverage by application class List connected SaaS apps, disconnected SaaS apps, local admin consoles, and team-owned tools separately so you can see where governance is native and where it is manual.
- Test whether review decisions are actually enforced Run one access review on an app outside the normal integration path and verify that a remove decision produces an executed change plus evidence.
- Separate licence availability from configuration reality Check whether governance features are included in your current edition, switched on, and connected to the applications that matter before assuming coverage.
Bottom line: The core issue is not whether Okta or Microsoft offer governance features, but whether those features cover the full estate that actually needs control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
IdP-native governance is only as strong as estate coverage. Okta and Microsoft both sell governance capabilities, but Ploy's checklist shows the real question is how much of the estate sits outside the IdP. When disconnected apps, local accounts, and third-party tools dominate, the control plane turns into a partial view of access rather than a full governance system. Practitioners should judge governance by enforcement reach, not by whether a feature exists in a licence bundle.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should teams add a separate IGA layer?
A: Teams should add a separate IGA layer when identity governance needs centralised control across multiple directories, applications, and HR sources that the native platforms cannot reconcile on their own. It becomes useful for joiner-mover-leaver workflows, access certifications, segregation-of-duties checks, and entitlement lifecycle management across disparate systems.
👉 Read our full editorial: IdP governance fails where disconnected apps stay manual