What Is IGA (Identity Governance and Administration)?

IGA (identity governance and administration) is the discipline and software that decides who should have access to what, grants and removes that access across systems, and proves it to auditors. An IGA platform answers four questions: who has access, who approved it, is it still needed, and does any combination of it break policy. IAM enforces access at login; IGA governs whether that access should exist.

What an IGA platform does

• Lifecycle provisioning. Reads joiners, movers and leavers from the HR system and creates, changes or removes accounts in connected applications, often over SCIM or vendor connectors. See joiner-mover-leaver.
• Access requests and approvals. A catalog where people ask for access, with approval routing and a recorded trail.
• Access certifications. Periodic reviews in which managers or application owners confirm or revoke each grant. See access certification.
• Separation of duties (SoD). Rules that block toxic combinations, such as creating a vendor and approving its payment. See SoD.
• Role management. Grouping entitlements into roles so access is understandable; role mining proposes roles from existing grants.
• Audit evidence. Reports that show auditors who had access, who approved it and when it was reviewed. See the audit preparation guide.

IGA vs IAM vs PAM vs CIEM

Buyers confuse these four because the vendors overlap. The split that matters is which question each answers.

IGA and IAM are usually separate products: SailPoint is not an identity provider, so it sits beside Okta or Microsoft Entra ID. Read more in what is PAM and what is CIEM.

Why it matters

Access accumulates. People change roles, projects end, contractors leave, and permissions linger. That drift is a standing audit finding and a breach path, which is why IGA is central to SOX, SOC 2 and ISO 27001 evidence. The breach record shows what happens when nobody governs the lifecycle:

• Leavers who keep access. A former Cash App employee downloaded customer brokerage reports after their employment ended. At CrowdSec, a departing engineer's GitHub account was left open to finish some work, and its still-valid OAuth token was used to copy about 170 private repositories. See orphaned account abuse.
• Accounts nobody believes exist. Colonial Pipeline was entered through a legacy VPN profile the company thought was no longer in use, protected by a single password.
• Insiders with excess standing access. A senior Ubiquiti developer used his own administrative access to AWS and GitHub to steal data, then posed as an outside attacker.
• Machine accounts outside review. In 2026 a password-spraying campaign against Chilean Microsoft 365 tenants compromised seven accounts, all functional or service accounts with no MFA and default or never-rotated passwords.

Why IGA programs stall

The uncomfortable pattern is that governance failures are almost never product failures:

• Identity data quality. The HR system, the directory and the applications disagree about who exists and which accounts belong to whom. Reconciliation is a project in its own right and it happens whether or not you budget for it.
• Connector coverage for the long tail. Governance demos well against Active Directory. It struggles against the mainframe, the ERP with no modern API, and the homegrown application whose owner left.
• Rubber-stamped certification. Show a manager APP_FIN_GL_RW_PROD and they approve it. Campaigns that produce real revocations translate entitlements into business language and show usage data alongside the grant.
• Movers. Joiners and leavers are handled; internal transfers accumulate entitlements from every role a person has ever held. See mover entitlement accumulation.

What good looks like

A working governance program can answer four questions without a project: who has access to this system and why, what changed in the last 30 days, which entitlements have gone unused for six months, and who owns this service account. Measure campaigns on revocation rate rather than completion rate, because completion measures compliance theatre and revocation measures risk reduction.

The non-human gap

Service accounts, workloads and now AI agents outnumber employees in most environments and appear in almost no certification campaign, because there is no manager to attest for them. Ownership assignment is the prerequisite, and it is where the category is expanding. See what is non-human identity.

IGA tools in 2026: who owns what

Governance is the most acquisitive corner of identity. As of November 5, 2026, per the vendor profiles and the acquisitions tracker:

• SailPoint is public (NASDAQ: SAIL) and majority-held by Thoma Bravo. It closed its acquisition of Entro Security on 29 June 2026 to govern non-human identities.
• Saviynt is private and raised 700 million dollars in a KKR-led round in December 2025.
• Veza was acquired by ServiceNow, closing on 2 March 2026 for about 1.2 billion dollars.
• C1 (formerly ConductorOne) renamed itself in April 2026, and Workday agreed on 13 October 2026 to acquire it, with closing expected by 31 January 2027.
• Zilla Security was bought by CyberArk in February 2025 and is now part of the Palo Alto Networks Idira portfolio.
• Omada acquired EmpowerID on 24 September 2026, terms undisclosed.
• Zluri was acquired by Infotech, closing on 14 October 2026.
• One Identity announced on 24 June 2026 that it will become an independent company; SWI could not confirm the separation has closed.
• Lumos remains private and SaaS-focused. midPoint by Evolveum is the leading open source option.

Prices are rarely public. In the Identity Pricing Transparency Index 2026, IGA scored 5 out of 100, the lowest of 17 categories: none of 20 vendors published a paid price. One anchor does exist: Microsoft listed Entra ID Governance at 7 dollars per user per month, paid yearly, when SWI checked on October 30, 2026.

Where to start

Compare the field in the best IGA tools ranking, the compliant IGA platforms list and the top 7 identity governance platforms. For head-to-heads, read SailPoint vs Saviynt, Veza vs SailPoint and C1 vs Lumos. Self-hosting? See the top open source IGA tools. When you are ready to buy, follow how to choose an IGA platform and run better campaigns with access review best practices.