Topic starter
22/01/2026 4:53 pm
TL;DR: IDaaS has expanded from $7 billion to a projected $21.4 billion by 2028 at a 25% CAGR as organisations adopt SSO, MFA, and basic provisioning, according to Omada Identity. Authentication is only the entry point, and without IGA, access certification, segregation of duties, and audit-ready justification remain outside the control model.
Editorial analysis by NHI Mgmt Group, based on content published by Omada Identity: “What is Identity as a Service? The Authentication Solution That Needs an IGA Layer”.
Key questions
Q: What breaks when organisations rely on IDaaS without an IGA layer?
A: Without an IGA layer, IDaaS can secure the login event but still leave excessive access, toxic entitlement combinations, and weak audit evidence in place.
Q: Why does IDaaS create compliance risk even when authentication is strong?
A: Strong authentication does not answer the governance questions auditors ask, such as who approved access, why the entitlement exists, and when it was last reviewed.
Q: How can security teams tell whether identity drift is becoming a control failure?
A: Look for a growing delay between unauthorised changes and formal review, especially on systems that still depend on manual extracts.
Practitioner guidance
- Define the IGA control boundary Map which access decisions must move beyond IDaaS login controls into continuous governance, including certifications, approvals, and exception handling.
- Automate access certification cycles Replace spreadsheet reviews with recurring certification campaigns that follow role changes, entitlements, and system ownership.
- Enforce separation of duties at entitlement level Check cross-application combinations before approval so conflicting permissions are blocked or routed through documented exception workflows.
Bottom line: IDaaS solves the entry problem, but not the governance problem that appears after users log in.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/10/2026 3:07 am
Authentication without governance is a partial identity model. IDaaS solves the entry problem, but it does not complete the access decision. Once the user is inside, entitlements can diverge from current need without the platform automatically correcting them. For identity programmes, that means the control boundary is too narrow if it stops at login.
A few things that frame the scale:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
A question worth separating out:
Q: When should organisations add IGA to an existing IDaaS deployment?
A: Organisations should add IGA when audits, role churn, SaaS growth, or non-human identity sprawl make it impossible to prove that access is still appropriate. If the team can authenticate users but cannot certify access or explain why entitlements remain, governance has become the missing layer.
👉 Read our full editorial: Identity as a service needs an IGA layer to close access drift