Identity Governance & Administration

Short Summary

Identity Governance and Administration (IGA) is positioned as the convergence of Identity Provisioning (fulfilment and lifecycle administration) and Access Governance (business-facing workflows, certifications, reporting, and Segregation of Duties controls), increasingly complemented by access intelligence analytics. Vendors vary widely in functional depth and breadth, leading to “provisioning-focused” versus “governance-focused” offerings, and organizations often adopt only one capability depending on IAM maturity. A common pattern is outsourcing fulfilment via managed services while retaining Access Governance in-house to preserve direct control. For greenfield programs needing both provisioning and governance, integrated IGA products are typically preferred, making upfront scoping and prioritization critical.

IGA is framed as a security risk-management discipline: weak lifecycle controls, entitlement sprawl, poor role management, and insufficient auditability expose organizations to identity theft, unauthorized changes, access creep, orphan accounts, and SOD-driven fraud. Market evolution is driven by cloud adoption, OOB integrations (notably SCIM and Azure AD), and integration norms with ITSM (especially ServiceNow), PAM, UBA, and Data Access Governance tools. While vendors push mobile UX, the text cautions against enabling mobile approvals/certifications where due diligence may suffer. DevSecOps alignment and microservices/containerization are emerging, exemplified by containerized IGA platforms.

The Leadership Compass evaluates on-premises deployable IGA (including managed service delivery), excluding IDaaS, and scores vendors across technical capabilities (connectors, standards, customization, security, HA, multi-tenancy, analytics, role/risk models) plus operational criteria (UX, automation, deployment ease, third-party integrations, scalability). Leadership ratings show a crowded, mature market: SailPoint leads overall; IBM leads market leadership; several established and niche vendors differentiate via access intelligence, deployment modernization, connector depth, and risk-based governance.

Interesting Facts

• IGA combines the traditional User Access Provisioning (UAP) and Identity and Access Governance (IAG) markets.
• Three distinct Leadership Compass documents were created: Identity Provisioning, Access Governance, and Identity Governance and Administration.
• Two additional Leadership Compass documents complement them: IGA for SMBs and IAM Suites.
• The Leadership Compass for IGA focuses on products offered in on-premises deployable form, including managed service delivery.
• IDaaS offerings are excluded from this Leadership Compass.
• More than 80% of IGA vendors offer out-of-the-box integration with ITSSM tools or use APIs for integration.
• ServiceNow is identified as a popular ITSSM integration choice to unify IGA user functions with helpdesk workflows.
• SCIM is preferred over SPML for federated as well as on-prem provisioning, while support for both may be evaluated by use case.
• SailPoint retains the leadership position in the Overall Leadership evaluation, with IBM, CA Technologies, and Oracle following.
• IBM is set to lead the Market Leadership evaluation.

Notable Quotes

• “It is important that organizations scope their IGA requirements well before starting to evaluate IGA products that differ in the strength of IGA functionalities…”
• “Access intelligence is the analytics layer over Identity Provisioning and Access Governance that offers business-related insights to support effective decision making…”
• “Governance moves beyond simple reporting and dashboarding to offer advanced capabilities that include machine learning techniques…”
• “The disconnect between business and IT security functions is another big reason for failed IGA deployments.”
• “IT security is primarily driven by the need to meet regulatory compliance, resulting in an undesired shift of IGA priorities…”
• “Inaccurate access certifications and uncertain access request approvals… can be disastrous to an organization's overall security posture in the long term.”
• “Having connectors as OEM components or provided by partners is not recommended and considered a risk for ongoing support…”
• “Support for SCIM… is preferred over traditional SPML…”
• “Selecting a vendor of a product or service must not be only based on the comparison provided by a KuppingerCole Leadership Compass.”
• “A thorough selection includes a subsequent detailed analysis and a Proof of Concept or pilot phase, based on the specific criteria of the customer.”