What breaks when higher education replaces IGA with Microsoft workflows?

What Microsoft workflows preserve, and what they do not

Microsoft workflows can automate events, approvals, notifications, and simple routing. That is useful for moving requests through a process, but governance is not the same as workflow. IGA adds a control model for who should have access, why that access exists, and when it must be reviewed or removed.

Once that control model is removed, the institution usually keeps activity without keeping meaning. Accounts still move, but the environment loses the policy layer that ties those moves back to role, entitlement, owner, and business justification. That is where IGA differs from automation: the former governs access state, while the latter only executes steps.

Which governance functions disappear first

The first loss is usually role modelling. Without stable roles, permissions become request-by-request exceptions, which makes access drift harder to detect and harder to explain. The second loss is certification discipline, because periodic review depends on a governed entitlement model, not just a completed workflow ticket. IAM and IGA Basics is a useful reference point for the distinction between access administration and governance.

Segregation of duties is also difficult to preserve when it exists only as a series of manual approvals. A workflow can route a conflict for sign-off, but it does not by itself maintain durable SoD rules, detect new toxic combinations, or keep those rules aligned as roles and systems change. Segregation of Duties (SoD) Guide explains why this control needs rules, not just process steps.

Evidence is the third casualty. IGA usually provides a stable record of request, approval, entitlement, review, and revocation, which is what auditors and control owners rely on to reconstruct why access was granted. A workflow trace may show that something happened, but not necessarily that the access decision remained appropriate over time. IGA Buyer’s Guide is relevant here because connector coverage, review design, and lifecycle control are what turn activity into governance evidence.

Why higher education feels the break more acutely

Higher education environments are especially exposed because access is high-churn and unusually heterogeneous. Students, faculty, researchers, contractors, and temporary staff all move through different lifecycle states, often across many applications and federated services. When IGA is replaced by a workflow layer, institutions tend to lose the structure needed to keep birthright access, role changes, and offboarding aligned with academic calendars and job changes. Education Identity Security Guide is directly relevant to that churn problem.

That churn also makes role sprawl and access creep more likely. In a university, the same person may be a student, employee, researcher, lab member, and system owner across different systems. A workflow can move tickets, but it does not model those overlapping identities or the entitlement boundaries that keep them manageable. For that reason, role design and lifecycle control remain central even when the institution wants a lighter operating model. Role Mining and Role Design Guide supports that design problem.

Access reviews are another weak point. If review campaigns are reduced to ad hoc approvals in Microsoft tooling, they often become one-off checks rather than a repeatable certification process with remediation and closure. The result is that stale access can remain in place even when nobody disputes the workflow history. Access Reviews and Certification Guide shows why closure matters as much as review.

What a workflow-only model changes in practice

A workflow-only model usually shifts the institution from governed access management to process automation. That sounds efficient, but it often creates a false sense of control because the tool can prove motion without proving entitlement quality. The practical consequence is that access reviews become slower to interpret, exceptions become harder to track, and ownership becomes less clear when something is overprovisioned or no longer needed.

It also weakens offboarding. A workflow may close a ticket, but if it does not connect to authoritative lifecycle events, old access can survive long after the user’s role has ended. That is especially dangerous where shared accounts, delegated access, or third-party integrations exist. The more distributed the environment becomes, the more important it is to know whether the workflow is merely moving data or actually enforcing removal.

For universities, the operational question is not whether automation exists, it is whether the institution can still answer the governance questions after the workflow completes. If the answer to who approved it, why it exists, and when it should be reviewed is buried in ticket history, the control has become fragile. When that happens, the institution has preserved motion but lost governance.

Risk and Threat Considerations

Replacing IGA with workflows creates a governance gap that attackers and internal misuse can exploit. If access is not tied to durable role and entitlement controls, excessive permissions can persist unnoticed, stale accounts may survive offboarding, and conflicting duties can accumulate inside ordinary business processes.

Failure mechanism: The workflow proves that a change was requested or approved, but it does not continuously enforce least privilege, SoD, recertification discipline, or authoritative access state. Over time, that gap produces orphaned access, weak evidence, and inconsistent revocation.

Impact: The institution can lose the ability to demonstrate why access exists, detect when it should be removed, or defend the control in audit or incident response. In practice, that increases the likelihood of unauthorized access persisting long enough to matter.

Practitioner Guidance

What to prioritise: Treat role modelling, certification, and revocation as control requirements, not workflow outputs. If the process cannot show current entitlement state and ownership, it is not an IGA replacement.

What to verify: Check whether the workflow is backed by authoritative sources for joiner-mover-leaver events, role assignment, and review evidence. If it only records approvals, it is a transport layer, not a governance layer.

Common mistake: Teams often confuse approval routing with control enforcement. A routed request is not the same thing as a durable access decision, and auditors will usually test that distinction.

Practitioner takeaway: The right test is whether the institution can still explain, at any point in time, why a user has access and whether that access should continue. If it cannot, the governance function has been displaced, not simplified.

Related resources from NHI Mgmt Group

• When do service accounts become a higher risk than ordinary user accounts?
• What breaks when access reviews happen too slowly in higher education?
• What breaks when non-human identities are left outside IGA workflows?
• What breaks when higher education treats vendor integrations as outside IAM scope?