Why it matters
IGA is how enterprises turn access policy into an operating system. Without it, permissions grow through one-off requests and tribal knowledge. With it, organizations can require approvals, separate duties, certify access, and show regulators that controls exist.
Owning an IGA platform is not the same as enforcing it everywhere. Lifecycle automation and certifications only cover applications that are onboarded and connected. The rest of the estate remains outside day-to-day governance, even when the platform itself is mature.
That coverage gap is why many programs feel permanently "in rollout." The tool works. The portfolio is larger than the connectors.
Example
A global manufacturer runs SailPoint for access requests and quarterly certifications. Finance SaaS apps are fully onboarded. A plant maintenance system critical to operations is still waiting on a connector. Reviews for that system are spreadsheet-based and months behind. The IGA is live, but enforcement is partial.
How it is typically handled (and where it breaks)
IGA deployments start with high-value, well-documented applications, HR feeds, and role models. Teams then face connector backlogs, flat entitlement schemas, and business-owned apps that resist integration. Professional services and custom development stretch timelines.
Meanwhile, movers and leavers continue. Manual work fills the holes, and certification campaigns inherit incomplete account data.
How Redblock handles it
Redblock extends IGA enforcement to disconnected applications. It aggregates accounts and entitlements into the governance platform, executes approved lifecycle and revocation actions inside apps that lack connectors, and returns verification evidence for audit.
Policy, roles, and approvals remain in the IGA. Redblock supplies the last-mile execution those platforms need for no-API and legacy applications. Learn more on the Redblock for identity governance page and the SailPoint solution page.
IGA investments are large. Boards expect them to reduce breach risk and audit pain. When coverage stalls at the easy apps, the organization still pays for the platform while continuing to run manual governance for systems that often matter most operationally.
That is why deployed and enforced are different milestones. An IGA can be in production and still leave critical applications outside lifecycle automation and certifications.
Program responses usually include more services budget, a stricter app intake process, or a multi-year roadmap. Those responses can be rational. They still leave a standing gap unless the team finds a way to onboard and enforce faster on nonstandard applications.
Related terms
- Access Certification
- Joiner-Mover-Leaver (JML)
- Application Onboarding
- Account Aggregation
- Disconnected Applications
Frequently Asked Questions
How is IGA different from an IdP?
An IdP primarily authenticates users and brokers SSO. IGA focuses on governance: who should have access, lifecycle policy, reviews, and audit. Enterprises usually run both.
Why do IGA programs stall?
Because onboarding nonstandard applications is slow. Without connectors or SCIM, teams rely on services projects and manual processes, so coverage plateaus.
Does Redblock replace an IGA?
No. Redblock is designed to extend IGA platforms by executing and verifying changes in applications the IGA cannot reach on its own.