Module 7 · Identity Governance — Lifecycle, Access Reviews, SoD

What IGA covers

• Lifecycle management: joiner, mover, leaver workflows.
• Access provisioning: who gets what, on what basis.
• Access reviews / certification: periodic re-validation of access.
• Segregation of duties (SoD): enforcement that conflicting roles don’t combine.
• Compliance reporting: evidence for audits.

The joiner-mover-leaver workflow

Joiner

1. HR creates employee record in HRIS.
2. IdP receives event; creates user with default access (email, intranet, etc.).
3. Manager triggers role-based access provisioning via SCIM.
4. First-day access ready when employee logs in.

Mover (role change)

1. HR updates role in HRIS.
2. IdP receives event; evaluates new role’s access set.
3. Differences between old and new — provision new, de-provision old.
4. “Mover” is the most-missed event; many programmes only handle joiners and leavers.

Leaver

1. HR marks employee as terminated in HRIS.
2. IdP receives event; immediately deactivates user.
3. SCIM cascades de-provisioning to all integrated SaaS.
4. Manual systems (legacy apps, shared accounts) handled by checklist.
5. Active sessions terminated; tokens revoked.

Access reviews — the quarterly discipline

Periodic re-validation of who has what access:

• Cadence: quarterly for privileged access; semi-annual for sensitive data access; annual for general.
• Reviewer: manager of the user, plus the resource owner.
• Decision: confirm, modify, or revoke.
• Tooling: SailPoint, Saviynt, Okta IGA, Microsoft Entra ID Governance.
• Evidence: who reviewed, when, decision. Audit-relevant.

The certification fatigue problem

Quarterly cert review of 50 users × 20 apps = 1000 decisions per manager per quarter. Without tooling, managers rubber-stamp. The remedy:

• Risk-based prioritisation — review high-sensitivity access more frequently.
• Smart defaults — pre-flag access that hasn’t been used in 90 days (auto-revoke unless re-justified).
• Bulk operations — confirm all, modify exceptions only.
• Mobile-friendly review — managers do reviews on phone in 5-minute slots.

Segregation of duties — preventing fraud

Certain role combinations enable fraud:

• Vendor creation + payment approval (creates fake vendor; pays it).
• Customer record edit + transaction posting (fabricates transactions).
• Code commit + production deploy approval (deploys malicious code).
• Network admin + audit log admin (covers tracks).

SoD rules enforced at provisioning time: granting role B to a user who already has role A is blocked unless explicitly exempted. Exemptions logged for audit.

SoD matrices come from finance / audit teams. The security team operationalises them in the IdP.

Dormant accounts — the audit finding

Accounts that exist but haven’t been used in 90+ days:

• Identify via IdP query.
• Disable accounts dormant >90 days.
• Delete accounts dormant >180 days unless retained for specific reason.
• Service accounts: track usage; rotate or disable if no usage detected.

Service accounts — the often-overlooked class

• Service accounts proliferate; estate often has 3-5× as many service accounts as employee accounts.
• Owner tracking: every service account has a named owner (a human).
• Quarterly review: does this service account still need to exist? Still need its current permissions?
• Credentials in vault, not in code; rotation automated where possible.

Common failure modes

• Joiner / leaver automated; mover manual; access drift accumulates.
• Quarterly review rubber-stamped — no real scrutiny.
• SoD matrix exists in finance binder; not enforced in IdP.
• Dormant accounts ignored; estate accumulates inactive users.
• Service accounts owned by departed employees; effectively orphaned.

Indian-specific considerations

• RBI Cyber Security Framework: explicit IAM expectations including access reviews and SoD.
• SEBI CSCRF: IGA as a named control domain.
• DPDP: identity governance underpins access-control obligations on personal data.

Key takeaways

• IGA = lifecycle (joiner/mover/leaver) + provisioning + access reviews + SoD + reporting.
• “Mover” events most-missed; cause access drift.
• Access reviews quarterly for privileged, with smart defaults to prevent fatigue.
• SoD rules enforced at provisioning time, not detected after.
• Dormant accounts auto-disable at 90 days, delete at 180.
• Service accounts: 3-5× employee accounts; quarterly review, owner tracking, vaulted credentials.