What should organisations prioritise first when workforce identity is consuming too much IT time?

Why This Matters for Security Teams

When workforce identity consumes too much IT time, the real problem is rarely “too many users” alone. It is usually too much manual handling of password resets, access approvals, joiner-mover-leaver updates, and role exceptions that should have been automated long ago. That friction slows support queues, increases the chance of mistakes, and creates gaps attackers can exploit through stale access or inconsistent provisioning.

Security teams should treat this as an operational risk, not just a help desk inconvenience. The same bottlenecks that frustrate employees also weaken control reliability, especially when identity changes depend on ticket handoffs or tribal knowledge. NHI Management Group’s Ultimate Guide to NHIs shows that only 5.7% of organisations have full visibility into their service accounts, which is a useful reminder that identity sprawl becomes unmanageable when teams rely on manual processes.

Current guidance from the NIST Cybersecurity Framework 2.0 supports reducing friction through repeatable, governed identity processes rather than one-off approvals. In practice, many security teams discover the cost of weak identity design only after a bad access review, a delayed offboarding event, or a failed audit exposes how much work was being hidden by IT staff.

How It Works in Practice

The first priority is to remove the highest-volume, lowest-risk identity tasks from human handling. For most organisations, that means self-service password reset, single sign-on, automated deprovisioning, and cleaner role definitions. These controls do two things at once: they reduce time spent on routine tickets and they shrink the number of manual exceptions that accumulate over time.

Start by measuring which identity requests dominate the queue. If password resets, MFA re-enrolment, and access changes consume most effort, those are the automation candidates with the fastest return. Then map the lifecycle of each workforce identity event: onboarding, role change, temporary elevation, and offboarding. Where possible, tie those events to authoritative HR data so access changes happen automatically rather than waiting for a ticket. That approach is consistent with the broader lifecycle and offboarding emphasis in the Ultimate Guide to NHIs, which highlights how identity operations fail when revocation is delayed or inconsistent.

• Use SSO to reduce application-specific passwords and cut support demand.
• Automate deprovisioning so leavers and role changes do not depend on manual follow-up.
• Replace broad role drift with narrower, business-aligned role design.
• Keep exceptions time-bound and reviewable instead of permanent.

For governance alignment, use policy discipline from the NIST Cybersecurity Framework 2.0 to standardise access provisioning and reduce ad hoc decisions. The Top 10 NHI Issues also reinforces the operational reality that excessive privilege and weak visibility are usually symptoms of unmanaged identity processes, not isolated technical bugs. These controls tend to break down when HR data is inconsistent, application ownership is unclear, or legacy systems cannot support automated deprovisioning without custom work.

Common Variations and Edge Cases

Tighter identity automation often increases implementation effort at the start, so organisations have to balance faster support outcomes against change-management overhead. That tradeoff is real, especially in environments with legacy directories, mergers, or heavily customised line-of-business apps.

Best practice is evolving on how far to push role standardisation versus exception handling. In highly regulated teams, some access will remain manual because of segregation-of-duties checks or sensitive approvals. The practical goal is not to eliminate every exception, but to make exceptions visible, short-lived, and auditable. That is also where the risk of over-rotating on help desk metrics appears: reducing tickets is useful only if it does not create a brittle access model that fails during audits or incident response.

NHI Management Group’s research in 52 NHI Breaches Analysis is a reminder that hidden identity sprawl often persists because organisations optimise for convenience before governance. If workforce identity is consuming too much IT time, the fastest sustainable path is to automate the repeatable work first, then redesign the roles and approval flows that still need human judgment.

Related resources from NHI Mgmt Group

• Should organisations prioritise external exposure or internal credential governance first?
• How can organisations tell if identity governance is too noisy?
• How do organisations reduce the dwell time of exposed credentials at scale?
• Should organisations prioritise IGA or identity security first?