Identity Governance & Administration (IGA)

Identity Governance and Administration (IGA) unifies Identity Provisioning (fulfilment and lifecycle administration) with Access Governance (business-facing workflows, certifications, reporting, and Segregation of Duties controls), with access intelligence providing the analytics layer across both. Vendors vary widely: some focus on provisioning depth, others on governance strength, and organizations often adopt either capability first depending on maturity. Common patterns include using managed services for fulfilment while retaining in-house control over governance, and choosing full IGA platforms for greenfield programs needing both provisioning and governance. Weak IGA foundations create exposure to risks such as access creep, orphan accounts, role bloating, unauthorized changes, and SOD conflicts that can enable internal fraud.

The market is shifting toward cloud integration through two approaches: re-architecting on-prem products to bridge to cloud services, or delivering cloud-deployable “cloud IGA” with faster upgrades and lower short-term TCO. Out-of-the-box integration pressure is rising due to cloud directories like Azure AD and standards such as SCIM. Integrations with ITSM (especially ServiceNow) and PAM are now common, and interest is increasing in connecting IGA to UBA and Data Access Governance tools. While UX has improved (often via shopping-cart access requests), the text cautions that mobile support for high-diligence tasks like certifications and approvals can degrade governance quality.

KuppingerCole evaluates vendors across identity repositories, lifecycle, password and request management, policies/workflows, role management, analytics, certification, role governance, SOD controls, and reporting—plus operational criteria like UX, automation balance, deployment ease, scalability, and integration depth. In leadership ratings, SailPoint leads overall, with IBM close behind; other overall leaders include One Identity, Oracle, Micro Focus, Saviynt, Broadcom, RSA, SAP, EmpowerID, and Hitachi ID. The market remains crowded (22 vendors rated), with no vendors placed in the follower segment overall.

• Identity Provisioning focuses on administering access fulfilment and entitlements throughout an identity lifecycle.
• Access Governance provides self-service tools for workflows, reporting, certifications, and SOD checks.
• Access intelligence is the analytics layer over provisioning and governance that provides business insights for decision-making.
• More than 80% of IGA vendors offer out-of-the-box integration or API-based integration with ITSSM and PAM tools.
• Increased adoption of Microsoft Azure Active Directory has intensified demand for out-of-the-box integrations with cloud services using SCIM.
• The Leadership Compass for IGA evaluates products offered in on-premises deployable form or as managed services, excluding IDaaS offerings.
• The Overall Leadership rating combines Product Leadership, Innovation Leadership, and Market Leadership.
• The Leadership Compass represents 22 vendors in its IGA rating.
• SailPoint holds the top position in Overall Leadership, closely followed by IBM.
• No vendors appear in the Follower segment in the Overall Leadership rating.

• “Identity Governance and Administration (IGA) combines the traditional User Access Provisioning (UAP) and Identity and Access Governance (IAG) markets.”
• “Access intelligence is the analytics layer over Identity Provisioning and Access Governance that offers business-related insights to support effective decision making.”
• “Governance moves beyond simple reporting and dashboarding to offer advanced capabilities that include machine learning techniques enabling pattern recognition.”
• “A lack of basic IGA capabilities can leave organizations exposed to risks originating from inefficient administration of identities and access entitlements.”
• “The disconnect between business and IT security functions is another big reason for failed IGA deployments.”
• “Security leaders focused on IAM must ensure they are able to demonstrate the success of IGA deployments early-on.”
• “Increased adoption of cloud-based identity stores and directories such as Microsoft Azure Active Directory (AAD) has created additional pressure on IGA tools.”
• “Inaccurate access certifications and uncertain access request approvals… can be disastrous to an organization's overall security posture in the long term.”
• “Heritage of connectors… provided by partners is not recommended and considered a risk for ongoing support and available know-how at the vendor.”
• “Innovation is not about delivering a constant flow of new releases.”