How can organisations decide whether to automate identity workflows before replacing existing IGA tools?

Why This Matters for Security Teams

The automate-first versus replace-first decision is really a question about control coverage, risk reduction, and how much operational change the organisation can absorb at once. In identity governance, teams often underestimate the gap between policy intent and day-to-day execution, especially for approvals, provisioning, and deprovisioning. If the current IGA stack still anchors the workflow, automation can create measurable improvement without a full platform migration. That matters because identity failures are rarely theoretical; NHI Mgmt Group’s Ultimate Guide to NHIs notes that only 20% have formal offboarding and API-key revocation processes.

Security teams should evaluate whether the existing tool can support current risk and audit requirements before assuming a replacement will solve the problem. A better workflow can come from orchestration, policy cleanup, and tighter control mapping to obligations in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where manual handoffs are the real failure point. In practice, many security teams discover that the breakage is not the IGA product itself, but the accumulation of exceptions, stale processes, and unclear ownership after an access review goes live.

How It Works in Practice

Start by separating workflow automation from platform replacement. Automation is usually the first move when the organisation needs faster coverage for joiner, mover, leaver events, request approvals, entitlement reviews, and access removal. Replacement is only justified when the current IGA tool cannot express the required policy, integrate with core systems, produce defensible audit evidence, or support the identity types now in scope. The practical test is whether the current stack can be extended without introducing uncontrolled risk.

Use a simple decision path:

• Map the highest-friction workflows, especially those still handled by email, spreadsheets, or ticket comments.
• Check whether the current IGA can expose APIs, event hooks, or exportable data needed for orchestration.
• Measure control gaps against required outcomes, not feature checklists.
• Automate the repetitive steps first, then reassess what remains manual because of product limits.
• Reserve replacement for cases where policy logic, reporting, or integration depth cannot be achieved.

This approach is consistent with the broader NHI security pattern described in Top 10 NHI Issues: reduce exposure quickly, then address structural weaknesses. It also fits NIST guidance that control effectiveness depends on implementation detail, not just control presence. For example, a platform may support access review in theory, but still leave revocation incomplete if downstream systems are not automated. That is where workflow automation delivers value without forcing a rip-and-replace program. These controls tend to break down when the IGA platform is tightly coupled to legacy HR or directory processes because every change turns into a multi-team dependency chain.

Common Variations and Edge Cases

Tighter automation often increases integration and governance overhead, requiring organisations to balance speed against change risk. That tradeoff is real when the identity stack supports multiple business units, acquired companies, or mixed human and non-human identities. Best practice is evolving here, and there is no universal standard for how much workflow should be automated before a replacement becomes the better option.

Some environments should lean toward replacement sooner. Examples include tools that cannot support modern policy-as-code, cannot distinguish human and non-human access paths, or cannot produce reliable evidence for auditors. Others should stay automate-first, especially where the existing IGA is stable and the main problem is manual execution rather than missing capability. The question is not whether the tool is old; it is whether it can still enforce the decisions the organisation needs.

Where the estate includes high-volume service accounts, secrets, or third-party access, automation is often the safer interim step because it closes exposure faster while the team evaluates larger change. The challenge is deciding whether the gaps are operational, architectural, or contractual. If the limits are architectural and block every reasonable extension, replacement may be warranted. If the limits are mostly process-driven, automation usually delivers the best near-term outcome.

Related resources from NHI Mgmt Group

• How should organisations decide whether to automate identity remediation?
• How should organisations decide whether existing identity controls are enough for agentic AI?
• How should organisations scope an identity and access governance programme before they start implementation?
• How can organisations reduce identity risk before buying more tools?