Identity Governance. The Value of Leveraging IGA Functions from the Cloud

Identity Governance and Administration (IGA) is a core IAM discipline combining identity provisioning (lifecycle management and account changes across directories, apps, and databases) with access governance (regulatory compliance, segregation of duties, access reviews). Traditional IGA has focused on on-premises applications and static entitlements—what access is allowed—driven largely by auditor attention to financial risk and least-privilege compliance. The text argues this is now too narrow: business access risk includes fraudulent access to intellectual property and personally identifiable information, and static entitlements do not reveal how access is actually used at runtime.

Modern IGA must therefore expand in two directions: breadth of coverage (all applications across cloud and on-premises, and all user types from employees to partners and consumers) and depth of control (beyond entitlement management into runtime controls). Needed controls include adaptive, risk- and context-based authentication, user behavior analytics for anomaly detection, device security, threat intelligence, and integrated privileged access management for highly privileged infrastructure and business accounts—prime targets for both external and internal attackers.

Because enterprise IT has become cloud-centric (while remaining hybrid), the text positions IGA as a “cloud first” core function. Running IGA as a cloud service improves integration with adjacent cloud-native capabilities such as threat intelligence, device management, CASB functions, and cloud authentication/SSO, while still requiring strong connectivity back to on-premises “legacy” services.

Microsoft’s approach centers on Azure AD Identity Governance, combining directory and conditional access with lifecycle management integrations (including Workday and Microsoft Identity Manager for on-premises connectivity), access reviews, and privileged identity management, integrated within Microsoft EMS alongside Cloud App Security, Defender ATP, Intune, Azure Information Protection, and Azure Security Center. An action plan proposes revisiting IT, IAM, and IGA strategies to define broader risk-based requirements and implement an integrated security architecture.

• IGA combines identity provisioning and access governance.
• Identity provisioning manages identity lifecycles and provisions account changes across target systems such as directory services, business applications, and databases.
• Access governance supports regulatory compliance requirements including segregation of duties and access reviews.
• Traditional IGA has focused on on-premises applications and static entitlements.
• Static entitlements define which access is allowed but do not show which access actually occurs.
• External attackers can hijack internal accounts and access systems using the entitlements of those accounts.
• Internal attackers can abuse their entitlements for fraudulent access.
• Automated attacks can run in the context of a user account.
• Azure AD includes conditional access that bases access decisions on policies including authentication requirements and conditions such as device security.
• Azure AD Privileged Identity Management provides controls for securing access rights for resources across Microsoft cloud services.

• “Just support Least Privilege Access isn’t sufficient anymore for IGA – it is about managing both static entitlements and runtime access.”
• “Static entitlements might allow a user to perform certain business transactions or run backups on critical data – but they don’t control how these entitlements are concretely used.”
• “Business access risks occur not only from not enforcing least privilege access, but from malicious access in a variety of forms.”
• “Core functions of IT – such as IGA – should be considered becoming a ‘cloud first’ service.”
• “There is a shift in infrastructure and platform services from running on premises but supporting the cloud to running in the cloud but supporting on premises.”
• “IGA should become a service.”
• “This shouldn’t be simple a tools choice, but part of revisiting the IT strategy, the IT security strategy, and the IAM strategy.”
• “It is not about just running the same IGA from the cloud, but to broaden the scope for today’s requirement on IAM, governance, and IT security.”