Identity governance (IGA), by ear

What IGA is: the merger of user provisioning and identity lifecycle management with access governance, and why most buyers now choose combined suites.

The core capabilities of access governance: access reviews, certification campaigns, SoD checks, request management and analytics for knowing who has access to what.

Identity compliance basics: defining roles, applying segregation of duties to prevent errors and fraud, and running regular access audits.

Why governance starts with mapping HR and lifecycle processes, and why automation should anchor on immutable IDs rather than names or email addresses.

What SCIM is and how it standardizes user provisioning between systems, explained by the editor of the SCIM specifications.

HR-driven provisioning as the first-mile problem of joiner-mover-leaver: connectors for Workday and SuccessFactors, API-driven inbound provisioning, and migrating off legacy IGA.

Practitioners from banking, manufacturing and retail compare how they build and maintain role-based access control in real IAM programs.

How a regulated financial firm runs user access reviews, with practical steps for better certifications and for governing service accounts.

Why access reviews suffer from rubber stamping when reviewers lack context, and how AI recommendations aim to support better review decisions.

Why recertification campaigns fail, and how policy-based entitlements, time-limited access and usage analytics can remove most review work.

How event-based standards such as the Shared Signals Framework, CAEP, RISC and SCIM events can make provisioning and governance react in near real time.

Lessons from replacing a decade-old on-premises IGA system: person-based identity models, cleaning data first, and running old and new platforms in parallel.

A critique of the batch joiner-mover-leaver model and the case for continuous identity driven by shared signals.

Where the IGA market is heading: governing non-human identities, remaining gaps in role mining and anomaly detection, and SaaS versus on-premises deployment trade-offs.