What Is Identity Governance and Administration (IGA)?

Short answer: Identity governance and administration (IGA) is a category of identity security software that decides who should have access to which systems, grants and removes that access automatically as people join, move and leave, and produces the review and audit evidence that proves access is appropriate. Access management checks whether a login is allowed; IGA checks whether the access should exist at all.

How identity governance and administration works

Identity governance and administration works as a loop tied to the employee lifecycle. The HR system is the source of truth, the IGA tool turns HR events into access changes, and periodic reviews catch whatever drifted in between.

1. Joiner: a new hire record in the HR system (Workday, SuccessFactors or similar) creates the identity and assigns baseline access by role or department.
2. Mover: a job or department change adds the new role's access and, more importantly, removes the old role's access.
3. Leaver: a termination date triggers account disablement and removal from groups and applications.
4. Request: anything outside the role baseline goes through a self-service request with manager or resource-owner approval.
5. Review: managers or application owners recertify access on a schedule, and denied access is removed.
6. Report: every grant, approval, review decision and removal is logged as audit evidence.

Microsoft's own Entra documentation describes this pattern: inbound provisioning from HR sources, lifecycle workflows that run before a start date, on status changes and at departure, and provisioning connectors to cloud and on-premises applications via SCIM, LDAP and SQL (Microsoft Learn).

Why IGA matters for IT teams

Identity governance matters because auditors test access controls, not intentions. NIST SP 800-53 AC-2 asks organizations to review accounts for compliance at a defined frequency, to disable accounts within a defined period when they expire, go inactive or break policy, and to notify account managers within a defined period when users are terminated or transferred.

Without IGA, those controls usually run on spreadsheets and tickets. An admin exports group memberships, emails managers, chases replies and removes access by hand. That works for 50 people and a handful of apps. It breaks as application count, contractor count and audit scope grow, because every manual step is a place where a leaver keeps access.

The mover step is where most access creep happens: new access gets added on a role change, but nobody owns removing the old access unless a process forces it.

Key components of identity governance and administration

IGA components fall into two groups: governance decides and proves, administration executes. The table follows SailPoint's published split (SailPoint).

IGA vs access management vs PAM

IGA, access management and privileged access management (PAM) are separate layers of identity security that buyers often blur. Access management answers "can this login happen right now", IGA answers "should this access exist", and PAM controls the highest-risk admin accounts.

The layers overlap at the edges. Microsoft, for example, places Privileged Identity Management with its just-in-time access under the Entra ID Governance umbrella (Microsoft Learn). Products are listed as neutral examples, not a ranking.

Common misconceptions about identity governance

• "We have SSO, so we have governance." SSO controls how people sign in. It does not remove a leaver's local accounts in apps outside SSO, and it produces no access review evidence.
• "IGA is only for large enterprises." Dedicated IGA suites target large, complex environments, but the underlying controls (joiner-mover-leaver, periodic review) apply to any organization under SOC 2, HIPAA or similar audits. Smaller teams often start with governance features inside their existing identity provider.
• "Access reviews fix access creep." Reviews only work if reviewers see enough context to make real decisions. A review where managers approve everything produces audit evidence without reducing risk.
• "IGA is a one-time project." Roles, applications and org charts change constantly, so role models and connectors need ongoing ownership after go-live.

Identity governance and administration in practice

Three illustrative scenarios, not case studies, show where IGA earns its cost and where it does not.

• A 3,000-employee public company preparing for SOX audits: quarterly access reviews for financial applications and SoD checks on ERP roles are audit requirements, so a dedicated IGA platform with ERP connectors is usually justified.
• A 400-person healthcare organization on Microsoft 365: HR-driven provisioning plus recurring access reviews for clinical apps can often be built with Entra ID Governance features, if the organization licenses them.
• A 60-person startup preparing for its first SOC 2 report: a documented offboarding checklist, SCIM provisioning from the identity provider and a quarterly review export may satisfy the auditor before a full IGA tool is worth buying.

What to look for in an IGA tool

When identity governance moves from spreadsheets to software, the evaluation should focus on connectors and process fit rather than dashboards.

• HR integration: native inbound provisioning from your HR system, including future-dated hires and terminations.
• Connector coverage: SCIM, LDAP, database and REST connectors for the applications auditors care about, including on-premises ones.
• Review experience: reviewer context (last sign-in, peer comparison) so managers can make real decisions.
• Policy controls: SoD rules and least-privilege checks at request time, not only after the fact.
• Audit evidence: exportable reports showing decisions, reviewers and timestamps.
• Non-human identities: coverage for service accounts and, increasingly, AI agent identities, which Microsoft now governs through the same entitlement packages as people in preview (Microsoft Learn).

Compare vendors against these requirements on the identity and access management software hub.

Bottom line

If access reviews and offboarding still run on spreadsheets and tickets, and audits or application sprawl are growing, identity governance and administration is the layer to add next. Check first whether your identity provider already includes governance features on a license you could add, and move to a dedicated IGA platform when ERP roles, segregation of duties or on-premises connectors push past what those features cover. To compare options against your requirements, start a software shortlist.