IGA???

• Immunoglobulin A (IgA)
• Independent Grocers of Australia (IGA)
• International Geothermal Association (IGA)

The acronym IGA can mean many things.

But have you ever been in a meeting where everyone confidently discussed “the IGA” and you had absolutely no idea what they were talking about?

When we talk about IGA in cybersecurity, we are not referring to a supermarket chain, an antibody in your saliva, or a geothermal organization.

We mean Identity Governance & Administration.

If you’ve heard the term before but never fully understood what it means, or how it could help your organization, this blog is for you.

The Traditional Way of Managing Accounts: Where Does It Go Wrong?

To understand IGA, let’s start with something familiar: the traditional way organizations manage user accounts.

The Traditional Process

Most organizations follow this pattern:

1. A candidate is hired.
2. HR informs IT.
3. IT creates accounts.
4. IT must be informed every time something changes.

On paper, this seems logical. The problem? There is usually no automated link between HR and IT systems.

That link is often human. And humans make mistakes.

The Risks of Manual Account Management

1. Employees leave, but accounts stay active

HR processes the departure. IT may not be informed on time — or at all.

The result? The account remains active. That account can then be:

• Used by the former employee
• Exploited by someone who knows the password
• Discovered by an attacker and used for lateral movement

Inactive employees with active accounts are prime “low-hanging fruit” in an attack chain.

2. One person = multiple accounts

Organizations often underestimate how many accounts one person actually has:

• A primary user account
• An admin account
• A test or service account

Disabling only the primary account does not eliminate the risk.

3. Forgotten Privileged Accounts

Even when IT is notified, only the main account is typically disabled. Admin and secondary accounts often remain untouched and forgotten.

These overlooked accounts create silent, persistent vulnerabilities.

The Core Problem

Manual processes create:

• Lack of control
• Lack of visibility
• Lack of automation

And ultimately: avoidable security incidents. Human error remains one of the leading causes of breaches.

From Account Management to Identity Management

IGA fundamentally changes the model. Instead of managing separate accounts, we manage identities.

A digital identity represents a physical person. All accounts are linked to that single digital identity. The identity becomes the master record. Every account follows the identity.

What Does This Achieve?

Full Visibility

At any moment, you can see:

• Which accounts a person has
• What rights are attached
• Across which systems

Not scattered across platforms, but centrally governed.

Automated Offboarding

When HR registers an employee’s departure:

• The identity is marked inactive.
• All linked accounts are automatically disabled or removed.
• Primary, admin, and test accounts are handled consistently.

No forgotten accounts. No manual follow-up.

From Human Dependencies to System Integrations

Traditional processes rely on people. IGA replaces this with automated system integrations.

An IGA solution connects:

• Source systems (typically HR systems)
• Target systems (Active Directory, Entra ID, SaaS platforms, etc.)