KeySkopeWhat is identity governance and administration?
Identity governance and administration (IGA) is the combination of policies, review processes and account-lifecycle controls used to decide who should have access, to what, and for how long. It connects a business decision about access with the identities, accounts and permissions that implement that decision.
A useful IGA program answers four questions: who owns this account, what can it do, why does it need that access, and when should that access be reviewed or removed? An application inventory alone does not answer them. Neither does a list of successful sign-ins.
IGA, IAM and access visibility: different responsibilities
| Discipline | Main question | Typical work |
|---|---|---|
| Identity and access management (IAM) | Can this identity authenticate and access a resource? | Sign-in, federation and access controls |
| Identity governance and administration (IGA) | Should this access exist? | Ownership, approvals, periodic reviews and lifecycle decisions |
| Account access visibility | What access is actually present? | Collecting accounts, roles, status and available activity |
These responsibilities overlap. A strong sign-in control does not establish whether an old administrator role is still necessary. A review process needs current source evidence before it can make a useful decision.
Build a review around accounts, not just people
One employee may have a standard account, a separate administrator account and an integration credential. A service account may have no employee identity at all. Count the application accounts in scope, then establish their owners and purposes.
For example, an employee can leave while a local console account remains enabled. Removing the employee from the identity provider may not remove that local account. A review should compare the inactive identity with the current application account, rather than assume a single offboarding action closed every access path.
A practical IGA review cycle
- Define scope. Record the applications, environments and account populations included. Identify coverage gaps.
- Collect evidence. Confirm the latest successful collection and retain the source account identifier, role, status and available activity.
- Assign responsibility. Identify who can explain the account and who can approve a change.
- Decide. Record whether to retain, reduce, remove or investigate access, including the reason.
- Verify. Check the source application after the approved change and review the updated evidence.
Where KeySkope fits
KeySkope supplies account and access visibility across supported connected systems. Overview highlights findings; Access explorer lets a reviewer inspect their underlying records. This supports the evidence-gathering part of an IGA process.
Bring clearer evidence into your existing approval and remediation workflows. Review a finding with its application owner, make the approved change in the source application, and sync again to check the result.
Continue with the SaaS access review guide and connector coverage.
Continue your review
Explore the IGA and AI access governance library, check connector coverage or read the documentation.