Recommendations for aligning ITSM with IAM/IGA

Many medium to large organizations want a single tool and portal for all employee service requests to improve convenience, standardize user experience, and extract more value from existing IT Service Management (ITSM) investments. This often leads to extending ITSM to handle Identity and Access Management/Identity Governance and Administration (IAM/IGA) requests such as provisioning identities and granting access. While this can appear efficient in the short term, it introduces significant security and compliance risk because IAM/IGA activities require robust documentation, logging, monitoring, policy enforcement, and auditability that ITSM platforms are not designed to provide natively.

Using ITSM to deliver IAM/IGA functions commonly results in inadequate controls and incomplete audit trails, creating opportunities for abuse—for example, password changes processed purely in ITSM may lack reliable records of requestor, approver/executor, and execution time. The deeper issue is that ITSM is oriented toward coarse-grained service requests (e.g., new laptop or application), whereas IAM/IGA governs fine-grained entitlements, hierarchical permissions, and complex rule sets such as segregation of duties. Recreating IAM/IGA depth inside ITSM typically demands heavy customization that is costly to maintain over time and brittle when original developers or integrators are no longer available.

A practical middle ground is to use the ITSM portal as a single point of entry, but route IAM/IGA requests to a dedicated IAM/IGA portal with matching look-and-feel, ensuring the actual workflows, approvals, provisioning, and policy decisions occur within specialized IAM/IGA systems. Integration between ITSM and IAM/IGA should be used only where manual fulfillment or “gray areas” exist (e.g., legacy or unconnected applications), with ticketing linked to auditing and status synchronization. Achieving this requires ITSM and IAM/IGA teams to define processes, interfaces, responsibilities, and accountability together.

• Many organizations are building IAM/IGA workflows on ITSM systems despite security and compliance risks.
• ITSM systems are designed to optimize the design, delivery, support, use, and governance of IT services to reduce cost and improve satisfaction.
• IAM/IGA systems provision, store, track, monitor, manage, and retire digital identities and access rights.
• IAM/IGA enforces the Principle of Least Privilege so entities have only the access rights they need and are authorized to have.
• ITSM is fundamentally focused on coarse-grained requests such as new laptops, applications, or printers.
• IAM/IGA focuses on hierarchical, fine-grained entitlements and complex rules such as segregation of duties.
• Dedicated IAM/IGA systems typically include self-service facilities for requesting access to specific IT resources.
• Implementations of IAM/IGA inside ITSM often lack capabilities such as activity logging and monitoring, access reviews, automatic deprovisioning, complete audit trails, data protection, and policy enforcement.
• Manual fulfillment needs commonly arise in identity lifecycle management, privileged access management, and onboarding to IAM services such as PAM, IGA, and access federation.
• Ticketing used for manual IAM/IGA-related work must be integrated with auditing to maintain a proper audit trail.

• “Use the right tool for the job”
• “ITSM should never be used for any activity where there is specialized functionality for doing that activity in an existing IAM/IGA or other system.”
• “Implementing IAM/IGA functionality within ITSM is highly likely to fail and is therefore essentially wasted effort that will result in security and compliance risk and additional cost in terms of maintenance overhead.”
• “The ITSM Portal, therefore, could be a common way of accessing all services within an organization.”
• “All requests must run through the IAM/IGA system, which acts as a single point of control, and its workflows, but where manual fulfilment is required, organizations should use ITSM tickets to initiate the required action and report when it has been carried out.”
• “While integration is unavoidable where manual fulfilment is required, automating processes wherever possible will help to keep integrations to an absolute minimum.”
• “Set up regular meetings between the ITSM and IAM/IGA teams”
• “Defining these things in tandem rather than in isolation will ensure that processes are not only aligned but so are policies.”
• “This is a risky strategy because IAM/IGA functions are extremely important when it comes to information security and compliance.”
• “This Leadership brief outlines how a middle ground might be achieved without exposing an organization to security and compliance risk.”