Why do IGA implementations often run into trouble in large organizations?

Why IGA Becomes Harder as Organisations Scale

Identity governance and administration is rarely difficult because the technology itself is obscure. It becomes difficult because large organisations have too many connected systems, too many business owners, and too many exceptions to model cleanly. Access decisions that look simple in a pilot often break when they must reflect multiple roles, regional policies, inherited entitlements, contractor access, and frequent joiner-mover-leaver changes across business units.

The deeper issue is that IGA is a coordination problem as much as a controls problem. It has to reconcile business approval, compliance evidence, provisioning accuracy, and revocation speed without creating so much friction that users work around it. That is why scale exposes weak role design, poor data quality, and unclear ownership faster than smaller environments do. NHI Management Group notes that Ultimate Guide to NHIs shows how organisations can have large identity populations while still lacking full visibility into service accounts, which is a useful reminder that governance problems often surface first as inventory and accountability gaps.

In practice, many IGA programmes stall only after the organisation discovers that nobody agrees on who should approve access, who should own exceptions, or what “good” access actually looks like across different functions.

How Large Organisations Actually Break IGA

Most large-scale failures come from treating entitlements as static records instead of living business relationships. A role catalogue may look tidy in design workshops, but it becomes brittle when the real environment includes shared service accounts, temporary project access, inherited permissions, external partners, and application-specific exceptions. Once that happens, automation can still be useful, but it cannot compensate for a weak operating model.

Effective IGA depends on accurate identity data, a defensible entitlement model, and clear ownership of every application and role. Without those, certification campaigns turn into rubber-stamping exercises, provisioning queues fill with exceptions, and revocation becomes slow enough that access outlives the business need that justified it. That is why many teams separate identity governance into layers: source identity quality, access request and approval, entitlement review, and deprovisioning. The framework guidance in the OWASP Non-Human Identity Top 10 is relevant here because machine and service identities often expose the same structural weaknesses IGA has with humans: poor ownership, weak lifecycle control, and excessive standing access.

• Identity source systems must be clean enough to trust before access reviews can be meaningful.
• Roles should reflect real business functions, not just application convenience or historical inheritance.
• Exceptions need expiry and ownership, or they become permanent policy drift.
• Revocation must be tested, not assumed, because delayed removal is where governance often fails.

Where this guidance breaks down is in organisations that have heavily decentralised application ownership and no reliable entitlement inventory, because automation then amplifies bad data instead of fixing it.

What Changes in Complex Environments

Tighter governance often increases operational overhead, so organisations have to balance control depth against business throughput. That tradeoff becomes sharper at scale because every added approval path, exception workflow, or review cycle increases latency unless the underlying model is highly standardised.

Current guidance suggests that large organisations should expect IGA to vary by identity type and risk tier rather than forcing one universal process everywhere. High-risk entitlements, privileged access, and externally exposed accounts usually need stricter review and evidence than low-impact application access. This is also where NHI-related governance logic becomes useful: if an organisation cannot reliably track service accounts, API keys, or other machine credentials, it will struggle to maintain confidence in its broader access model because hidden access paths undermine both review quality and revocation. Using the Ultimate Guide to NHIs as a practitioner reference can help teams recognise that human and non-human governance problems often share the same failure mode, namely unclear ownership and weak lifecycle discipline.

What practitioners often underestimate is that IGA maturity is measured less by the number of workflows deployed and more by whether the organisation can prove timely deprovisioning, explain exceptions, and keep entitlement data usable as the enterprise changes.

Risk and Threat Considerations

When IGA breaks at scale, the material risk is not just administrative inefficiency. It is prolonged access exposure, weak accountability, and a higher chance that stale or excessive entitlements survive long enough to be misused. That risk grows when organisations cannot reliably map who owns an account, who approved it, and when it should have been removed.

Failure mechanism: In large environments, incomplete inventories, messy role models, and exception sprawl create gaps between policy and actual access. Those gaps let dormant accounts, over-privileged users, and unmanaged machine identities retain access after business need has ended, which weakens both governance and detection.

Impact: The result is broader blast radius during compromise, weaker audit evidence, slower incident containment, and higher likelihood that access reviews become ceremonial rather than preventive.

Practitioner Guidance

What to prioritise: Start with inventory quality and ownership clarity before trying to automate every approval path. If the organisation cannot say which business owner is accountable for an entitlement, the rest of the IGA design will be fragile.

Decision rule: If a role or entitlement cannot be reviewed, revoked, and reissued cleanly within an acceptable business window, treat it as a control gap rather than a process inconvenience. That usually means the model is too complex, too inherited, or too loosely governed.

What practitioners underestimate: Change management is not a communications exercise alone. In large organisations, the real blocker is usually that business units experience the new governance model as slower than the old informal one, so they quietly preserve shadow paths unless the new process delivers visible value quickly.

Practitioner takeaway: IGA succeeds at scale only when governance is designed around actual operating reality, not idealised role charts, and when access lifecycle control is simple enough that people keep using it instead of bypassing it.

Related resources from NHI Mgmt Group

• Why do legacy IGA platforms often create more ticketing than real automation in enterprise access management?
• How should security teams run access reviews for non-human identities?
• How should organizations prioritize environments for NHI management?
• Why do collaboration tools create such a large secrets risk?