Topic starter
12/02/2026 9:16 pm
TL;DR: Identity as a Service (IDaaS) shifts IAM functions into a cloud subscription model, giving organisations SSO, MFA, logging, and access provisioning without maintaining on-premises identity infrastructure, according to StrongDM. The real issue is not whether access can be centralised, but whether outsourcing control creates new trust and visibility gaps for NHIs and broader identity governance.
Editorial analysis by NHI Mgmt Group, based on content published by StrongDM: “What is Identity as a Service (IDaaS)? All You Need to Know”.
Key questions
Q: What breaks when identity as a service becomes the main IAM control plane?
A: The main failure is not authentication itself but accountability.
Q: Why does outsourced IAM create governance risk for cloud teams?
A: Because the service can centralise control while fragmenting responsibility.
Q: Why does unmanaged third-party and machine access create more risk than traditional employee access?
A: Third-party and machine identities often span vendors, partners, contractors, bots, and shared business processes, so their access changes more often and is harder to track.
Practitioner guidance
- Define access ownership outside the provider Map every identity flow to an internal owner who can approve, review, and revoke access even when the provider runs the platform.
- Extend lifecycle controls to non-human identities Apply joiner-mover-leaver logic to service accounts, vendor identities, and machine identities so they are not left on permanent access paths.
- Separate logging from evidence ownership Confirm which logs are retained, who can query them, and how audit evidence will be assembled before relying on the service for compliance reporting.
Bottom line: Identity as a service can simplify access administration, but it does not eliminate the need for internal governance over policy, logging, and revocation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
07/10/2026 9:38 pm
Identity as a service does not remove governance, it relocates it. The control plane moves to a provider, but the decision rights over policy, lifecycle, and evidence still belong to the organisation. That makes IDaaS a governance architecture choice, not just an operational convenience. IAM teams should treat provider-managed identity as shared responsibility, not delegated accountability.
A question worth separating out:
Q: What is the difference between centralised identity administration and full identity governance?
A: Centralised administration simplifies account and policy management in one place, while full identity governance proves that access is authorised, reviewed, and revocable across every system that matters. A single portal can improve usability without covering all entitlements. Full governance requires lifecycle and certification control beyond the directory boundary.
👉 Read our full editorial: Identity as a service exposes the governance gap in cloud IAM