Identity Governance and Provisioning

Identity governance is the framework of policies, processes, and technologies that manage digital identities throughout their lifecycle — ensuring that the right people have the right access to the right resources for the right reasons. It answers three critical questions: Who has access to what? Should they have it? What are they doing with it? Identity governance is required by regulations like SOX, HIPAA, and GDPR that mandate demonstrable access controls.

The identity lifecycle is often described as the Joiner-Mover-Leaver (JML) model. A Joiner is a new employee who needs accounts provisioned. A Mover has changed roles and needs access adjusted — old permissions removed, new ones granted. A Leaver has left the organization and all accounts must be promptly disabled and eventually deleted. Each transition must be triggered automatically by the HR system to prevent delays that create security gaps.

Identity governance systems define roles that bundle the access permissions needed for a particular job function. When an employee is provisioned into a role, they automatically receive all associated access. Role mining analyzes existing access patterns to discover roles that reflect actual business functions rather than historical accidents. Clean role design reduces the number of access decisions humans must make and makes access reviews faster and more accurate.

Access certification (access review or recertification) is the periodic process of reviewing and affirming that all user access rights are still appropriate. Managers or resource owners receive a list of their team members' permissions and confirm or revoke each one. Regular access reviews prevent access creep — the gradual accumulation of permissions beyond what a user's current role requires. SOX and SOC 2 compliance typically mandate quarterly or annual access reviews.

Access creep occurs when employees accumulate permissions from previous roles without having old access removed. A user who moved from finance to engineering might still have access to the payroll system — creating both a security risk and a compliance violation. IGA systems also enforce Segregation of Duties (SoD) by detecting and preventing toxic combinations: permission pairs that, together, would allow fraud (e.g., a user who can both create and approve purchase orders).

SCIM (System for Cross-domain Identity Management) is an open standard API for automating user provisioning and deprovisioning between an identity provider (like Okta or Azure AD) and target applications. When HR creates a new employee record, SCIM pushes that information to all connected applications automatically — creating accounts, assigning groups, and setting attributes — eliminating manual provisioning tickets and reducing onboarding time from days to minutes.

IAM (Identity and Access Management) is the broad discipline of managing identities and their access — including authentication systems, SSO, and MFA. IGA (Identity Governance and Administration) is a subset focused on the governance aspects: who has access, whether it's appropriate, and how it's certified. IGA adds policy-driven controls, workflow approvals, access reviews, and audit reporting on top of the provisioning and authentication capabilities of base IAM systems.

Orphaned accounts are user or service accounts with no current active owner — belonging to former employees, contractors, or decommissioned systems. Orphaned accounts are a critical security risk because: they may still have privileged access, no one monitors their usage, and attackers specifically scan for them as entry points. Automated deprovisioning tied to HR events and regular account audit reports are the primary defenses against orphaned accounts.

Governance of privileged identities requires additional controls beyond standard IGA. High-privilege accounts should have: separate dedicated accounts for privileged tasks (never use admin credentials for email), time-limited access that expires automatically, multi-person authorization for critical actions, and enhanced logging that is reviewed more frequently than standard access logs. Many compliance frameworks explicitly require audited records of all privileged access requests and approvals.

Leading IGA platforms include SailPoint IdentityNow (industry leader for enterprise IGA), Saviynt (strong cloud and SaaS coverage), IBM Security Identity Governance, and One Identity Manager. Cloud providers offer native solutions: Azure AD Identity Governance provides access reviews and entitlement management. These platforms integrate with HR systems via SCIM and APIs to automate the full identity lifecycle.

IGA directly supports compliance with multiple regulations. SOX requires demonstrable controls over who can access financial systems and audit trails of changes. HIPAA mandates access controls that limit PHI access to authorized personnel and audit logs of all access. GDPR requires data access to be limited to those with a legitimate purpose. IGA platforms generate the access review records, entitlement reports, and provisioning audit trails that auditors require.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: identity governance manages the joiner-mover-leaver lifecycle to ensure access is always appropriate, access certification reviews periodically affirm that permissions are still justified, and SCIM automates provisioning and deprovisioning to prevent orphaned accounts and reduce onboarding delays. Next up we explore just-in-time access and conditional access policies.