Identity Governance and Administration
Identity Governance and Administration is the discipline that governs who should have access, how access is granted, reviewed, and removed, and how identity-related controls are enforced over time.
- Acronym
- IGA
Definition
Identity Governance and Administration, often shortened to IGA, is the operating model and technology domain that combines identity lifecycle control, access request management, approval workflows, certification, policy enforcement, and auditability. It links business identity data, access policies, application onboarding, and compliance controls so that access decisions remain explainable and governed across the organization. IGA (Identity Governance and Administration) traditionally bundles governance with administrative provisioning capabilities in a single platform; IAG (Identity and Access Governance) is a broader framing that focuses on the governance dimension itself, independent of the provisioning engine.
Why it matters
IGA is the backbone of identity compliance and the primary mechanism for demonstrating that access is intentional, reviewed, and controlled.
IGA at the heart of NIS2 and DORA compliance
Identity management is no longer only a productivity concern: it has become part of the cyber-resilience regulators expect. Under NIS2 (Article 21), essential and important entities must apply proportionate measures covering identity management and access control; in the financial sector, DORA adds its own requirements on access control and evidence. Neither text imposes a specific tool, but both make it necessary to demonstrate that access is intentional, reviewed and controlled.
This is where IGA provides the evidence of compliance: full traceability of who has access to what, why and since when; periodic recertification campaigns that remove orphan accounts and excessive rights; and enforcement of least privilege so each identity holds only the access its mission strictly requires.
Automation and identity analytics
To avoid wearing teams out with manual reviews, modern governance relies on automation. The Joiner-Mover-Leaver lifecycle ensures that a departure immediately triggers access revocation, rather than leaving dormant accounts behind.
Identity analytics complements this by flagging atypical entitlements (outliers) and suggesting priority clean-up actions, so that review campaigns focus on what is genuinely risky instead of generating rubber-stamp approvals.
The Ariovis perspective
Ariovis treats the person or service, its context and its responsibilities as the starting point. Accounts and permissions are technical consequences that must remain tied to a governed identity.
Related services
Common pitfalls
- A common pitfall is treating IGA as a technology deployment rather than a governance operating model requiring sustained business engagement.
- Launching recertification campaigns without automation, which leads to certification fatigue and rubber-stamp approvals.
Resources
- Identity Governance services
- Insight — Netwrix Identity Manager
- Netwrix partnership
- IAM strategy and Zero TrustFrame the trajectory before choosing the tools: governance is a programme, not a deployment.
- Active Directory securityAD often concentrates the most sensitive entitlements to bring under governance.
- NIS2 and Active Directory: 90 daysOur expert insight on turning NIS2 requirements into concrete identity controls.
- Complying with DORAThe full use case for financial entities: access control, evidence and resilience.
Explore this category
These concepts matter most inside a real project.
The first conversation helps establish your context, the systems involved and the next useful decision.