Lean IGA Market Overview 2026

Hello, everyone, and welcome to today's KuppingerCole webinar on Lean Identity Governance and Administration at Lean IGA. My name is Nitish Deshpande. I'm a senior analyst at KuppingerCole Analysts, and this webinar follows through our latest report, the Leadership Composite on Lean IGA. In this webinar, we will take a look at what are our findings while doing that report, what are the trends that we observed, what are the challenges in this market segment, and also we will share with you what are the findings of this report. So stay tuned towards the end.

I will share with you which vendors participated and what was the positioning of those vendors as well. But before we begin, here's a quick – some housekeeping rules here for you. So you all are centrally muted, so you don't need to mute or unmute yourself. And we also try to keep these webinars a bit more interactive, so we will run a few polls during this webinar.

So I would encourage everyone attending this webinar to participate in these polls, provide us with your feedback, your answers, and I look forward to discussing the results of these polls towards the end of the session, which is the Q&A session. So we will use this Q&A session not only to discuss the poll results but also if you have any questions, we will try to address as many as possible. And if you have any questions, even during the webinar and during what I'm presenting, you can still enter those questions using the Livestorm Control Panel.

And finally, this webinar, the slides and recording is being done, so this will be made available on our website at communicable.com. The next is – yeah, so it's a quick agenda. This is a – we will try to look at our findings from the lean IGA market, and then we will move on towards the Q&A session. And let's start right away with the first poll of today's webinar, and that is, what is the biggest barrier to IGA in your organization? Is it limited IIM staff and budgeting? Is it complex, lengthy implementations?

Is it correcting legacy and SaaS applications, application onboarding, or is it meeting audit and compliance requirements? You can select your answer of your choice in the control panel, and I look forward to seeing the results towards the end of the session. So stay tuned. We will go through the results towards the end. So lean IGA. What is lean IGA? We have received several questions on this topic of what is lean IGA. And before we begin, I would like to maybe point these three areas where we try to define lean IGA.

It's mainly for organizations from having 50 to 5,000 employees, so these are the companies with SMBs and mid-market companies, and they are also now facing the same risks as your large enterprises. So you have your joint removal, your processors, you have the access that builds up over time, and auditors and regulators are still asking them who has access to what, how long was access granted, and who provided that access.

So you have different questions arising even for organizations of this size, and what these organizations usually lack is, one, is budget, two, is skills shortage, so they do not have a dedicated IIM team. And three, the extensive implementation time that requires for your traditional IGA is not suitable for these organizations, so they want quicker implementation, rapid deployment. And that's where these lean IGA solutions close the gap, so they are focused on delivering your core capabilities of IGA.

You have your bicycle management, access governance, certifications, and they deliver the solutions with rapid deployment. They also provide – they're focused more on providing this low-code, no-code configurations, focused on providing SRE controls as well, compliance reporting, and they're also now extending towards providing governance for your workload identities, your service accounts, your NHIF, as you call it, and also BAM integration.

So while most buyers in this segment start with the conversation with cost efficiency and automation, it is important, I guess, to remember that this is still IGA, it is still about security and governance. So these capabilities are how organizations enforce least privilege. You have your regulations, such as DORA and NISTO, that are expecting organizations to enforce least privilege. So it is becoming increasingly a compliance requirement, even for these organizations of this size.

And finally, it's about, as I mentioned, simplified delivery, and it's important to mention that by lean IGA, we do not mean it's a cut-down product with lesser capabilities. It's more about your focus capabilities and how they are delivered and how they are operated. So these can be mainly or typically SaaS solutions, but they also provide support to your on-premise applications. There are out-of-the-box workflows, templates, and compliance reporting is also provided.

So in short, lean IGA, it gives organizations of this size, let's say, a first entry into identity governance without compromising on the core capabilities. Yeah, key findings. So these are some of the five top five, let's say, key findings from the leadership composed report, which we did is most of the vendors that took part in this report were working with customers who have roughly 50,000 to 5,000 employees, but main focus was mainly around, let's say, 100,000 to 2,000 employee range. And next was the scripts, spreadsheets, and IDSM tickets no longer scale for certifications and SOEs.

So secondly, is that these mid-size organizations still manage managing access with scripts and spreadsheets and IDSM tickets that can work for your basic provisioning, onboarding, but not enforcing the full governance. So you have your rising regulatory expectations, load adoption is also increasing, and you have increasingly distributed applications. So for that, you need these lean IGA solutions for handling this different kind of applications. Connector breadth as well. Connectivity is an increasingly important point of the lean IGA market as well.

It depends on how quickly you can connect to customers, HR systems, directories, IDSM systems, SaaS, and on-premise applications as well. Standards such as schema, REST APIs are also helping, but we also found that vendors also differ in how they handle applications that do not support schema and REST APIs.

Also, the vendors in this report are supporting hundreds of different connectors for different applications. So connector breadth was evaluated. SaaS and IDaaS was the primary delivery model for most of these vendors, but that does not mean that on-premise was not supported. So on-premise connectivity was also supported. They were relevant, especially in organizations that require higher regulatory oversight. And managed services are also an option for organizations that do not have an in-house IAM staff.

And finally, the AI, you know, spoke with lots of vendors, and AI is becoming increasingly present in these solutions for various use cases such as access recommendations, risk detection. But the fully autonomous governance is still a developing phase, and we believe that I think in the next six, 12 months when we again do this report, we will see a much more mature side of autonomous governance. Challenges, yes. There are definitely some challenges for the organizations in this phase.

So if we talk about these SMBs and mid-market organizations, the main challenges is life cycle processes are manual and fragmented. So you have your GML is handled through HR notifications, tickets, emails, movers keep entitlements from previous roles while the employees who are leaving the company still kept their active accounts. So that was one challenge. There is one challenge for this organization. There is a lack of resources. There are small IT teams with not real expertise in terms of implementation, running infrastructure, end-to-end support, and overall security operations.

So platforms that need workflows and specialist models are hard to operate. And as cost is a very important point here, paying professional services for every connector or policy change can be quite expensive and can also be an aspect that stalls the project or fails the project. So these teams want local configuration, out-of-the-box workflows, and compliance templates.

Of course, the connectivity is again a problem. Teams cannot build and maintain custom connectors. So you have the vendors coming in this space or in IGA that are supporting creating custom connectors. You also have vendors that specialize, some focus on just mid-market organizations that are around 95% AD or intra and other are targeting SAP-heavy organizations. And then there is worker entities, service accounts. They often rely on these static secretes, long-lived credential, and broad permissions. We know the MTIs now are exporting at a very rapid rate compared to human entities.

And it's a common theme across different levels of organizations. So you lack clear ownership. You lack clear accountability. There's no proper recertification for them. And the IGA solutions are now slowly expanding to that space that can support.

Finally, it's the scalability and the future requirements. So governance needs to grow as organizations add applications, add new employees, and enter new regions, and also the new regulatory requirements they have to tackle. So you need to take into account not just your existing landscape, existing requirements, but also understand and look into the future on what could be the future requirements. So also another challenge, which is not mentioned here, is data quality. That is also one of the biggest challenges. So why are these organizations going for this lean IGA now?

And first is arising regulatory requirements and expectations. So compliance is now moving towards – you can say pushing towards these also SMBs and mid-market organizations. You have to answer those three questions. Who has access to what? Who can get that access? And who – and for how long was that access? So answering that is crucial. And that's why now we have these lean IGA solutions for these nexus organizations, really helping them out. Second is reducing security risk from open accounts and excessive access.

So that is another driver for organizations to go for lean IGA solutions when someone leaves and accounts are active. So that is a great service. You have no cloud adoption. That is also accelerating this problem as access is more spread across different applications as well as your on-premise systems. Automated payment processes with reliable provisioning. And just as importantly, we provisioning close these camps. So that's why we have these organizations moving towards these solutions.

Third is turning your external entities, your contractors, your partners, your suppliers, and also your worker entities. So nexus organizations work with several of these external staff and partners who need time-bound access. And they're also now running a growing number of NHIs and you're also now AI agents also coming to the organization. And lean IGA solutions are now moving towards providing support for these required capabilities.

Thirdly, it's the rapid time to value with your limited staff and budget. So taken together, these drivers are explaining why lean IGA market is expanding. And in fact, the report which we did right now is a direct result of a request from the market. We have received several requests around from customers from these segments asking for solutions for that piece of this requirement. So lean IGA is expanding and it's a very interesting space to see.

But if you talk about then the specific capabilities, what these customers are asking for, then there are several capabilities, but these are the top five ones which I have listed down here. First is, of course, faster application onboarding and broader connectors. There is demand for more connectors and simpler ways to onboard your applications.

Also, including your disconnected ones. Next is just a better user experience, you know, self-service capabilities, mobile access, you need a better interface for your business users, self-service portals for requesting access and mobile applications for access approvals and rejections. Identity risk scoring and adaptive access. Requests for identity risk goals, real-time SOD risk detection and certifications based on risk. So this is also the lean IAM teams. Organizations focus on their – focus their limited review time on critical reviews and critical certifications.

Governance for NHIs and AI agencies is growing in these organizations and lean IGA vendors are slowly expanding in that region. And the final most requested capability from the – this MIPS organization was the AI, ML, and Gen AI driven governance. This was the most requested one where – such as for having different use cases such as Gen AI assistance, machine learning recommendation for access modeling. These organizations want AI to take on manual work such as schema discovery, attribute mapping, and access decision.

So there are a few more capabilities as well, but these are the top five ones which the customers are looking for in the lean IGA solution. And that takes me to the next poll of today's webinar, and that is what is the main driver for adopting IGA in your organization? Is it regulatory compliance? Is it replacing scripts, spreadsheets, and tickets? Is it governing growing SaaS and cloud access? Or is it using IT workload through automation?

You can again go towards the Livestream control panel and select the right option that you feel is correct, and I look forward to discussing your results in the final section. Before we move towards the Q&A, now is the time to show you the results from the leadership impulse report and the methodology that we use. It's a very extensive methodology. We start with the vendor list. We reach out to these vendors. Then we conduct briefings with them. We also send out the questionnaire which they fill out and send back to us, and we do this on an average of 20 vendors for every leadership impulse.

So that's a very long and extensive process. After the briefings and questionnaire, we do the drafting of the report, and we then submit for a fact check where the vendors can look at the report before the report goes live, and then once it's agreed, the report is live on our website. But for this specific Lean IGA report, we evaluated the vendors on several capabilities, but these are the top eight capabilities that we looked into, first being the identity lifecycle management.

So this is about provisioning, managing identities, access entitlements, and other identity information in target systems. Other capabilities that are also considered in this criteria are the ability to access identity stores, data modeling and mapping, as well as the ability to manage different identity types. Target system support are also considered, the capability of the vendor to support not just the breadth, but the breadth of connectors for different on-premises SaaS applications. User and admin self-service was also evaluated.

This is about user interfaces, support for secure mobile access to secure IGA capabilities, and also other capabilities such as authenticators that are supported, data solution support delegation, and also password reset capabilities, as well as some other minor capabilities in this third category. Audit reporting compliance is another critical capability where we evaluated how the vendor provides tracking and logging of access. This also includes support for audit trails, compliance reporting for different major compliance frameworks like GDPR, Nesto.

We also looked at support for dashboarding, integrating with SIEM tools, alignment with regulatory or internal audit requirements. Fifth is the identity and access intelligence. On this capability, we looked at different areas such as providing business data insights, advanced capabilities of use of AI and machine learning techniques. For example, we mentioned access recommendation, role mining, role design, automated reviews, and anomaly detection were also some of the other capabilities that were considered in this capability. Professional services support is a different one.

This is particularly important for organizations of this size who are operating in a particular geographic region. They're looking for vendors who are available and can provide technical support, 24-7 coverage, support options, what kind of local language support is available, and also what kind of engagements can they support with such as implementation, professional services, as well as their different system integrator partners and documentation is also related in the sixth category.

Access governance is around just understanding the full capabilities, core capabilities of access governance, what kind of – this also includes SRE controls as well. And the eighth one is workflow and policy management. This is around your workflow capabilities, including graphical workflow configuration and the extent to which common IT tasks can be automated. We also evaluated here the access control principles of the solution, what kind of access control are supported, RBAC, AVAC, VBAC.

We also evaluated other policy capabilities such as policy monitoring, policy simulation, policy testing. And also, there are a few more categories that were a bit more around your security, interoperability, usability, and deployment of the solution.

So, combine all of these 12 categories with a good picture of the vendor's full breadth of capabilities. And in this report, we had around 17 vendors that took part in this report. As you can see, the list of vendors includes several established IGA vendors, as well as several new vendors that have entered this space, specifically working just for this segment of organizations, specifically for these mid-size organizations and SMBs.

So, it's a very strong group of vendors. And once we do all the evaluation of these vendors, we come towards the final picture of how the final overall leadership diagram in our leadership reports looks like. And this is a combined view of three different leadership ratings. One is your product leadership, then you have the innovation leadership, and then a third one is the market leadership.

Now, in the product leadership rating, we look at all those 12 categories which I mentioned in the previous slide. Those are taken into account for evaluating the product leadership. In the innovation leadership, we take a look at how the vendor is delivering the solutions in an innovative way.

RME, we also look at the roadmap for the next six to 12 months that defines the innovation leadership. And the third one is the market leadership. This is about just the overall market presence of the vendor. We look at the customers. We look at the geographic presence, in which regions they are operating, in which industry sectors they are operating. We also look at how many system-integrated partners they have, the partner ecosystem, in which regions that is available. So it's a wide range of criteria that we select for evaluating all the vendors, and this gives us the final picture.

And you can see it's a good mix of your IG specialist as well as lean IG specialist. And if we now go towards the next diagram, this is now – this gives you a spider diagram that we do for each vendor. I have given an example of one vendor that participated in this report. This spider diagram maps to those 12 capabilities that I mentioned for product leadership, and this is available in our report online on our website. So this is really very extensive research we do for each vendor, and it's the same for all our reports.

And I think that brings us now towards the – oh, yes, the Q&A session. So before we go to the Q&A session, I would like to quickly check the results of the poll that we discussed.

Okay, so the first question was, what is the biggest barrier to IGA in your organization? Is it needed IAM staff and budget? Is it connecting legacy and SaaS applications? Meeting all the compliance requirements? Or is it something else? The option that has received the most reports, 38 percent, is connecting legacy and SaaS applications, and I think this is very much in line with what we also see as one of the challenges in this application. And the next one is also very relevant. Limited IAM staff and budget. And this is exactly where these lean IGA vendors come into space.

They are targeting this market segment just for addressing these concerns. The second question that we asked was, what is the main driver for adopting IGA in your organization? Is it regulatory compliance, refreshing spreadsheets and tickets, governing growing SaaS and cloud access, or reducing IT workload? We have received, what a surprise, 56 percent, 50 percent of the votes for regulatory compliance, 30 percent for reducing IT workload through automation, and 20 percent for governing growing SaaS and cloud access. And it's aggravated.

And you have organizations of this size as well that are now under regulatory pressure. They need to now prove those questions around access governance. So this is where the lean IGA solutions come in for this size of organizations. And that brings us towards the end of the poll. We still have a couple of minutes left. I will quickly check some of the questions. Okay. So we already run Microsoft Intra ID and Microsoft 365. Do we really need a separate lean IGA tool, or can we just extend what we have? And I think this is a very good question.

So yes, in this report, if you go back to the list of vendors that participated here, you will not see Microsoft. And to answer your question, why not Microsoft?

Well, the factor is not the size of the organizations here for Microsoft. You can have your 500 percent company with 90 percent Microsoft native. Let me do the job just fine with your Intra ID governance. But similarly, if there's a 500 percent company that has a mix of applications, on-prem, SAP and dozens of other SaaS applications from different vendors, and that is exactly where these lean IGA solutions come in for providing this kind of support.

So we received several questions again on this one on why Microsoft was not here and why I go for a lean IGA solution if you already have Microsoft. I guess hopefully this makes the question easier. Which IGA tool use the best currently? It's a very, I think it's a very open-ended question. We have several IGA solutions that now are working extensively towards incorporating AI for different IA related use cases. You have authentication, you have access recommendation, scoring, certification as well. So it's very difficult to mention just one vendor here right now.

What maybe I can suggest is that this report on lean IGA, as well as the main IGA report is live on our website. And you can go to that website and go to those reports and select the tool which matches your requirements as well. And I hope we are just towards the end of the session. We're already at time, but here are some more. As I mentioned, if you want to see more of our reports, they are available on our website. We will share this deck after the webinar, and you can go on these links and check out those reports and evaluate the right solution for your company.

We still have a few more questions. Unfortunately, we do not have the right, we don't have enough time left, but you can connect with me on LinkedIn. And I look forward to maybe connecting with you offline and take this discussion even further on this topic. So thank you everyone for joining the session. And I look forward to seeing you in the next webinar. So have a nice evening. Thank you.