Topic starter
26/01/2026 11:57 am
TL;DR: Opal Security argues that many growing teams do not need to replace Google Workspace with a new IdP to improve access governance, because the core gap is authorization and lifecycle control rather than authentication. Keeping Google and adding composable governance can deliver least privilege, audit trails, and JIT access without migration overhead.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “Skip the IdP Migration: Scale Identity Security Without the Overhead”.
Key questions
Q: What breaks when authentication and authorization are treated as the same control?
A: Teams lose visibility into whether the real problem is identity proof or permission scope.
Q: When should organisations prioritise access governance over an IdP migration?
A: When the main issue is who can access what, when, and for how long rather than unsupported federation or a broken authentication layer.
Q: What do security teams get wrong about just-in-time access in mixed environments?
A: They assume JIT is a single control when it is really a boundary-dependent control.
Practitioner guidance
- Separate authentication from authorization design Document which controls belong to the IdP and which belong to access governance, approvals, and lifecycle enforcement.
- Adopt just-in-time access for elevated roles Replace persistent privileged access with task-scoped issuance so access exists only for the duration of the work.
- Extend governance to non-human identities Include service accounts, tokens, and AI agents in the same review and approval model used for human users.
Bottom line: The article's main point is that access governance problems often get mistaken for identity provider problems, which leads to unnecessary platform migration.
What's in the full article
Opal Security's full analysis covers the operational detail this post intentionally leaves for the source:
- How Google Workspace and Opal divide authentication, approval, and lifecycle responsibilities in a real deployment
- Examples of where composable governance reduces migration overhead compared with a full IdP replacement
- The specific customer-facing workflow changes involved in adding JIT access and automated reviews
- The conditions under which Google is still the right fit and when a different IdP is justified
👉 Read Opal Security's analysis of composable identity governance without an IdP migration →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 7:51 pm
Identity governance is not the same control problem as authentication. The article is right to separate IdP choice from access governance because those controls answer different questions. Authentication proves identity at sign-in, but it does not decide whether access should exist, how long it should last, or whether approvals are auditable. For practitioners, that means the migration decision should follow the control gap, not the other way around.
A few things that frame the scale:
- The average worker in a typical enterprise holds 96,000 entitlements, and 38% of IdP accounts are dormant, according to Veza's 2026 State of Identity and Access Report.
A question worth separating out:
Q: How should security teams govern human and non-human access in the same programme?
A: They should use one governance model for ownership, approval, review, and revocation, but apply it differently by actor type. Human identities rely on joiner-mover-leaver processes, while NHIs need secrets, certificates, and token lifecycle controls. AI agents add runtime behaviour that must also be monitored. The goal is consistent oversight, not identical workflows for every identity type.
👉 Read our full editorial: Google and Opal show why identity governance can stay composable