What is IGA?
Identity Governance and Administration (IGA) is the discipline of managing who has access to what inside your organization — and making sure that access is appropriate, current, and auditable.
IGA software sits above your identity provider (Microsoft Entra ID, Active Directory, Okta) and provides the governance layer those systems lack on their own. Where an identity provider handles authentication and basic directory management, IGA handles the business logic: role definitions, access approval workflows, periodic access reviews, and audit trails that prove to auditors that your access controls are working as intended.
The core capabilities of an IGA solution are:
- Provisioning and deprovisioning — automatically create, update, and remove user accounts and access when employees join, change roles, or leave
- Role-based access control — define job-function-based access profiles so new users get the right access from day one
- Access certification — periodic campaigns where managers review and certify that their team's access is still appropriate
- Access request workflows — structured, auditable processes for requesting and approving additional access
- Audit and compliance reporting — documentation that demonstrates to auditors that your access controls are working
Do you need IGA?
Most organizations do not realize they need IGA until they fail an audit, experience an insider threat incident, or go through a painful manual access review process that takes weeks and still leaves gaps.
You probably need an IGA solution if any of the following are true:
- You are pursuing SOC 2, ISO 27001, or NIS2 compliance and need documented access controls
- You have more than 50 employees and onboarding/offboarding takes more than 30 minutes per person
- Former employees retain any access after their last day
- You cannot answer "who has access to what" without manually checking multiple systems
- Access reviews are done via spreadsheets sent to managers (who mostly rubber-stamp them)
- New employees spend their first days waiting for access to tools they need
- You have no automated process for removing access when someone changes roles
If you can check three or more of those boxes, IGA is not optional — it is something you will need to address, whether through tooling or a significant increase in manual process.
Evaluation criteria
When evaluating IGA tools, most organizations focus on features and miss total cost of ownership and operational complexity. Here is a framework that covers what actually matters.
Core functionality
- Automated provisioning and deprovisioning
- Role-based access control (RBAC)
- Access certification and review campaigns
- Access request and approval workflows
- Policy enforcement and violation detection
Total cost of ownership
- Per-user licensing (all-in, not modular)
- Implementation and professional services costs
- Ongoing maintenance and upgrade costs
- Internal IT hours required for administration
- Training costs for IT staff and end users
Integration and compatibility
- Native connectors to your identity provider (Entra ID, AD, Okta)
- HR system integration (Workday, BambooHR, etc.)
- Application connectors for your SaaS estate
- API access for custom integrations
- On-premises Active Directory support
Operational complexity
- Time to first value — how fast can you go live?
- Admin interface usability
- Self-service capabilities for end users
- Change management requirements
- Ongoing configuration burden
Questions to ask vendors
Vendor demos are designed to show you the best-case scenario. These questions are designed to surface reality.
About implementation
- "How long does a typical implementation take for an organization our size?" If the answer is "it depends on scope" without a concrete range, that is a warning sign. Push for a range.
- "Do we need your professional services team, or can our IT staff implement this?" Enterprise tools often require certified implementation partners. Factor that cost in upfront.
- "Can we see a live customer go-live timeline — from contract to first real users?" Reference customers are more useful than polished case studies.
About total cost
- "What is the all-in cost at our user count — including connectors, modules, and support?" Many IGA vendors sell the base platform cheaply and charge for connectors, add-on modules, and support tiers separately.
- "What does renewal pricing look like in years two and three?" Some vendors offer low first-year pricing to win the deal, then increase significantly at renewal.
- "What does ongoing maintenance require from our side in IT hours per month?"
About compliance
- "Can you show us the exact report we would give an auditor for a SOC 2 Type II access control review?"
- "How do you handle access certification for external contractors and service accounts?"
- "Can you demonstrate a leaver workflow — from HR termination event to full access removal?"
Red flags to watch for
These are the warning signs that an IGA project is likely to go over budget, over timeline, or underdeliver.
Pricing requires a call to discuss
If the vendor cannot publish ballpark pricing on their website, expect sticker shock and a long negotiation process.
Implementation timeline is measured in months
For organizations under 1,000 users, an IGA tool that takes more than 60 days to configure is probably overengineered for your needs.
"Flexible" means "highly configurable" means "you need consultants"
Flexibility is only valuable if your IT team has the time and skills to use it. For most organizations, sensible defaults and good documentation are worth more than unlimited customization.
The demo requires a sandbox with fake data
Ask to see a live production customer environment (anonymized). If the vendor cannot arrange this, their customers may not be willing to endorse the product.
Support tiers are separated by price
If getting a response within 24 hours requires an enterprise support contract, that is a hidden cost. Find out what the standard SLA is before signing.
Enterprise vs mid-market tools
The IGA market splits roughly into two segments: traditional enterprise platforms designed for large, complex organizations, and purpose-built tools for mid-market companies with simpler requirements.
| Factor | Enterprise IGA | Mid-market IGA |
|---|---|---|
| Best for | 1,000+ users, complex multi-system environments | 50–500 users, Entra ID / cloud-first |
| Examples | SailPoint, Saviynt, One Identity | Adcyma, Omada (mid), Netwrix |
| Annual cost | $50–$150/user plus services | $15–$40/user, all-in |
| Implementation | 6–24 months | Days to weeks |
| Requires consultants? | Almost always | Usually not |
| Customization | Very high — and required | Sensible defaults, limited customization |
| Compliance coverage | All major frameworks | SOC 2, ISO 27001, NIS2 |
Most organizations under 500 users are better served by a purpose-built mid-market tool. The flexibility of enterprise platforms is wasted on simpler environments — and the cost and complexity are not.
What implementation looks like
Implementation complexity is the most underestimated cost in IGA purchases. Here is what the process typically involves, regardless of the tool you choose.
Phase 1: Discovery and design (weeks 1–2)
Map your identity environment: how many identity providers, what HR systems, how many applications need connectors, what role structures you want to enforce. This phase is mostly your IT team's time, regardless of the tool.
Phase 2: Integration and configuration (weeks 2–8)
Connect the IGA tool to your identity provider and HR system. Define roles, configure lifecycle workflows, set up access request and certification processes. This is where tool complexity makes the biggest difference — a well-designed tool with good defaults can do this in days; an enterprise platform may take months.
Phase 3: Pilot and validation (weeks 3–10)
Run lifecycle events through the system with a subset of users. Validate that joiners get the right access, movers get updated profiles, and leavers are fully deprovisioned. Test access certification with a pilot manager group.
Phase 4: Full rollout and handover
Expand to all users. Train IT administrators. Document processes for compliance purposes. Run the first formal access certification campaign.
A realistic timeline for a 200-person organization using a mid-market tool is 4–8 weeks end to end. For an enterprise platform at the same size, expect 3–6 months.
A simple decision framework
If you are trying to choose between IGA vendors and feeling overwhelmed, use this simplified framework.
Under 200 users, Entra ID as primary identity provider, pursuing SOC 2 or ISO 27001
Purpose-built mid-market IGA. You do not need the complexity or cost of enterprise platforms.
200–1,000 users, hybrid AD + Entra ID, multiple HR systems
Mid-market IGA with strong hybrid AD support. Evaluate Adcyma, Netwrix, or Omada.
1,000+ users, complex multi-cloud environment, many custom applications
Enterprise IGA is likely warranted. Evaluate SailPoint or Saviynt — but budget for professional services.
Unsure of your requirements, under time pressure from audit
Start with a lightweight tool that can go live quickly. You can migrate to a more complex platform later if needed. A fast partial solution is better than a perfect solution that takes two years.
Common questions
What is IGA software?
Identity Governance and Administration (IGA) software manages who has access to what within an organization. It handles user provisioning and deprovisioning, access request workflows, role management, access certification (periodic reviews), and audit reporting. IGA sits on top of identity providers like Microsoft Entra ID to enforce governance policies.
How much does an IGA solution cost?
Traditional enterprise IGA solutions from vendors like SailPoint or Saviynt typically cost $50–$150 per user per year, plus significant implementation fees that can run $200,000–$500,000 or more. Modern lightweight solutions designed for mid-market organizations, like Adcyma, cost considerably less — often $2–5 per user per month with no implementation fees.
How long does IGA implementation take?
Enterprise IGA projects at large organizations often take 12–24 months to fully deploy. For mid-market organizations using a purpose-built solution, implementation can take days to weeks. The difference comes down to scope, customization requirements, and whether the tool requires professional services to configure.
Do I need an IGA tool if I already have Microsoft Entra ID?
Entra ID provides identity infrastructure, but it lacks the governance layer most compliance frameworks require. Entra ID does not have built-in access certification workflows, structured role management, HR-triggered lifecycle automation, or comprehensive audit trails across all access types. An IGA tool fills these gaps.
What is the difference between IGA and PAM?
IGA (Identity Governance and Administration) manages the entire workforce identity lifecycle — who gets access, when, and why. PAM (Privileged Access Management) specifically secures high-risk administrative accounts with vaulting, session recording, and just-in-time access. Many organizations need both, but IGA is typically the broader foundational layer.