Identity Governance & Administration

Identity Governance and Administration (IGA) unifies Identity Lifecycle Management (ILM) and Access Governance (AG), but vendors still vary in depth and emphasis, with some remaining provisioning-focused and others governance-focused. Organizations mirror this split: some want ILM with limited governance, while many increasingly prioritize strong AG—often because ILM already exists or is outsourced as a managed service while governance is kept in-house for tighter control. Greenfield IAM programs typically prefer integrated IGA products that cover both ILM and AG, making requirements scoping and prioritization critical before vendor evaluation.

IGA spans identity repositories and consolidation across systems of record (e.g., HR/ERP), provisioning and deprovisioning, attribute synchronization, role and entitlement management, policy/workflow orchestration, self-service access requests and password management, certifications, segregation-of-duties (SoD) controls, and auditing/reporting. Governance is evolving from dashboards to analytics-driven intelligence, including ML-enabled pattern recognition for role design, automated reviews, and anomaly detection. Poor IGA leaves organizations exposed to identity theft, access creep, role bloat, orphan accounts, delayed fulfillment, and SoD conflicts enabling internal fraud.

Market trends include cloud integration in two directions: extending on-prem IGA via identity bridging/brokers, or adopting cloud-deployable IGA for faster deployments, upgrades, and lower near-term TCO. Demand is rising for out-of-the-box SCIM integrations, ITSM (especially ServiceNow) and PAM integrations, and selective UEM/mobile enablement—tempered by concerns that mobile-based due diligence can degrade certification/approval quality. Evaluation extends beyond core functions to UX, automation, ease of deployment (including DevSecOps and scripted promotion), interoperability via secure APIs, scalability/performance, and connector heritage. The Leadership Compass ranks vendors across Product, Innovation, and Market leadership, identifying crowded maturity with differentiated innovation in intelligence, automation, modular/containerized architectures, and API layers.

• This Leadership Compass evaluates over 20% more IGA product vendors than the previous year.
• The Leadership Compass represents 28 vendors in its rating.
• SailPoint holds the leading position in Overall Leadership, followed by IBM, with Saviynt close behind.
• More than 80% of IGA vendors offer out-of-the-box integration or API-based integration with ITSSM and PAM tools.
• The Leadership Compass focuses on on-premises-deployable products, including those offered as managed services at the customer site.
• IDaaS offerings are excluded from this Leadership Compass, with separate Leadership Compass research covering IDaaS.
• SCIM is preferred over SPML for federated and on-prem provisioning, while support for both is evaluated depending on use cases.
• ServiceNow is highlighted as a popular ITSM integration target for consolidating access requests and helpdesk functions into one portal.
• The “Big Ones” in innovation and market include EmpowerID, ForgeRock, IBM, Ilantus, Micro Focus, One Identity, Oracle, SailPoint, Saviynt, and SecurID.
• A lack of basic IGA capabilities can lead to risks including access creep, role bloating, orphan accounts, and SoD conflicts contributing to internal fraud.

• “It is important that organizations scope their IGA requirements well before starting to evaluate IGA products…”
• “Access intelligence is the analytics layer over Identity Lifecycle Management and Access Governance that offers business-related insights…”
• “Automation is a key trend in IGA to reduce management workload by automating tasks and providing process workflows.”
• “Governance moves beyond simple reporting and dashboarding to offer advanced capabilities that include machine learning techniques…”
• “Inaccurate access certifications and uncertain access request approvals… can be disastrous to an organization's overall security posture in the long term.”
• “The disconnect between business and IT security functions is another big reason for failed IGA deployments.”
• “IGA is essential to business as a strategic approach to ensure overall IT security and regulatory compliance.”
• “Ease of deployment… can increase the overall TCO of IGA deployments by nearly three folds during the initial years…”
• “Support for SCIM… is preferred over traditional SPML…”
• “Innovation is not about delivering a constant flow of new releases.”