Identity governance and administration (IGA) is the set of processes and tools used to manage the full lifecycle of user access: requesting, approving, reviewing, and removing permissions. It helps organizations answer two key questions: who should have access, and who still does. In practice, IGA systems connect to directories, SaaS apps, and business platforms to automate provisioning and deprovisioning, run periodic access certifications, and enforce separation-of-duties rules.
IGA matters because access drift is a common security problem. Users accumulate stale entitlements, contractors keep accounts after projects end, and privileged roles are sometimes granted without enough oversight. Attackers often exploit this by taking over dormant accounts or abusing excessive permissions. Good IGA reduces that risk by tying access to job roles, validating approvals, and removing access when it is no longer justified. In regulated environments, it also provides audit evidence that access decisions were reviewed and enforced.