Identity governance and administration (IGA) is a practice of overseeing identity lifecycles and access rights so permissions remain justified and accountable.

It connects the administration of accounts with decisions about who should have access and why. An identity system may be able to create accounts quickly while still lacking a reliable way to review their permissions. IGA addresses that ongoing oversight, including what should happen when a person’s responsibilities change.

What identity governance covers

Governance starts with understanding which identities exist and what access they hold. Access owners define approval policies and review whether assignments remain appropriate. Some organizations also enforce separation of duties, preventing incompatible permissions from being held by the same person.

Administration carries out lifecycle changes such as provisioning and removal. A useful governance process connects its decisions to those changes: rejecting an access assignment in a review should lead to confirmed removal in the system that enforces it.

Records of requests and approvals support accountability. They help establish why access existed at a particular time, rather than relying on the memory of an administrator who granted it months earlier. Reliable identity data is necessary for those records to describe the right person and organization.

A B2B customer example

A wholesale customer appoints an employee to manage purchases through a supplier’s portal. The employee receives ordering rights for that customer’s organization, approved by its designated administrator.

When the employee changes responsibilities, a review may show that ordering access is no longer justified. The employee can keep a basic portal identity while losing that permission. If an integration still accepts the old entitlement, the governance decision has not yet achieved its intended result.

The example uses customer identities, although many IGA programs focus primarily on workforce access. The relevant principle is the same: ownership and lifecycle decisions need to follow the business relationship that justifies access.

IGA, IAM and CIAM

Identity and access management (IAM) is the broader discipline of managing identities and their access. IGA concentrates on lifecycle administration and oversight of access decisions. Customer identity and access management (CIAM) addresses customer-facing identity needs, including registration and sign-in experiences.

These areas can work together without being interchangeable. A good sign-in experience does not prove that old administrator permissions have been reviewed. A completed access review does not detect every fraudulent transaction made by a currently authorized account.

Entitlement management supplies the detailed handling of access assignments. Runtime authorization enforces permission on individual requests. Governance sets expectations and verifies outcomes across those activities, with clear responsibility for resolving exceptions.

Frequently asked questions

Is IGA only for employees?

No. Workforce identities are a common focus, but partners and customer administrators also have access relationships that need approval, review and removal.

How is an access review different from authentication?

Authentication checks the identity signing in. An access review asks whether that identity should still hold particular permissions, based on current responsibilities and policy.

Does deploying an IGA tool establish governance?

No. Tools support inventory and workflows, but access owners must define policies, make meaningful review decisions and confirm that required changes take effect.

Related: Identity and Access Management (IAM) · Identity Lifecycle · User Provisioning · Principle of Least Privilege · Delegated Administration · CIAM