What Is Identity Governance and Administration (IGA)?

Identity Governance and Administration (IGA) answers a deceptively hard question: who has access to what, why, and should they still have it? It is the control plane that keeps access correct and auditable over time.

Core functions

• Access requests and approvals with a clear trail.
• Access certifications (periodic reviews) so managers confirm their people still need what they have.
• Provisioning and deprovisioning across connected systems.
• Separation of duties (SoD) to prevent toxic combinations of access.
• Role management to keep entitlements understandable.

Why it matters

Access tends to accumulate. People change roles, projects end, and permissions linger. That drift is a top audit finding and a real breach risk. IGA exists to detect and reverse it, which is why it is central to compliance with SOC 2, ISO 27001, and similar frameworks. See our audit preparation guide.

IGA vs adjacent tools

IAM handles authentication and SSO; IGA handles governance. In the cloud, CIEM does entitlement right-sizing, and PAM governs privileged accounts specifically.

Where to start

Browse IGA platforms, compare SailPoint vs Saviynt, or read how to choose an IGA platform.