Every organization has to answer two questions for an auditor: who has access to what, and can you prove it was approved? IGA is the discipline built to answer both. It is one of the oldest parts of identity security and the one most organizations already have in some form, but it is also frequently confused with the newer posture and detection layers. This guide explains what IGA is, what it actually does, and where it sits in the identity security stack.
What is IGA?
IGA, Identity Governance and Administration, is the collection of processes and practices used to manage digital identities and their access throughout the enterprise. It has two halves. Governance covers oversight: visibility into who has access, roles, attestation that access is appropriate, and separation of duties. Administration covers control: managing accounts and credentials, provisioning and deprovisioning access, and entitlement management.
In plain terms: IGA is how access gets granted, reviewed, and revoked in a controlled, auditable way, so that access is always deliberate and always provable.
What does IGA do?
IGA runs the lifecycle of access from the moment an identity is created to the moment it is retired.
It provisions access when someone joins or changes roles, and deprovisions it when they leave, so access matches the role a person actually holds. It runs access requests and approvals through a central platform, often integrated with ticketing, so every grant has a trail. It enforces separation of duties, preventing one person from holding a combination of access that would let them act without oversight. And it conducts the periodic access reviews and attestations that auditors expect, where owners confirm that the access people hold is still appropriate.
IGA answers the governance question: who should have access to what, and can we prove it was approved and reviewed?
Why IGA exists: the compliance driver
IGA grew largely out of regulatory pressure. Organizations have to be able to show what access was granted, why, and how, and manual or ad hoc provisioning cannot produce that evidence reliably. IGA creates a controlled, repeatable process with records at every step, which is what turns access management into something an auditor can sign off on.
It is worth being honest about what IGA does not do. IGA cannot prevent every breach. It will not stop an attacker who has stolen a valid credential, because that attacker is using access that was legitimately granted. What IGA does is limit what any identity can do in the first place and create the record of what happened. Stopping the attack in progress is a different layer's job.
IGA vs ISPM vs ITDR
This is where the confusion usually lives, so it is worth drawing the lines clearly. IGA governs access as a process: who should have it, and is it approved. ISPM continuously measures the risk that access represents: how exposed an identity is right now. ITDR detects and responds to attacks against that access in real time.
The sequence matters. IGA grants and governs access. ISPM reduces the risk that the granted access creates. ITDR catches any attack that still gets through. A gap opens when governance approves access that nothing re-evaluates, which is exactly the gap ISPM fills. For the full comparison, see ISPM vs ITDR vs IGA.
How IGA and ISPM work together
IGA and ISPM overlap on entitlements, and that overlap is where they strengthen each other. IGA holds the record of what access was granted and approved. ISPM evaluates whether that access is now risky. IGA said yes once; ISPM asks whether yes is still safe today.
An identity can pass every IGA access review and still be dangerous, because governance confirms that access was approved, not that it is currently safe. A service account approved two years ago may now hold unused admin rights, sit unowned, and be reachable through a risky federation path. IGA will not flag that; ISPM will. The two together cover both halves: access that is properly governed and access that is continuously risk-assessed. For the posture side, see identity security posture management.
Where 8Layers fits
8Layers is not an IGA platform. It focuses on identity posture, detection, and compliance, the layers that sit alongside IGA and continuously assess the risk of the access that IGA governs. Octagon scores every identity against security baselines and maps cross-system risk, so the access your IGA tool approved is continuously re-evaluated for whether it is still safe. Because Octagon shares an identity data layer with Thor for detection and Compass for compliance, governed access, posture risk, and compliance evidence all sit in one view.
If you want to see how risky your governed access looks today, request a demo.
Frequently asked questions
What is IGA?
IGA, Identity Governance and Administration, is the collection of processes and practices used to manage digital identities and their access across the enterprise. It covers governance (visibility, attestation, separation of duties) and administration (provisioning, deprovisioning, credential and entitlement management).
What does IGA do?
IGA provisions and deprovisions access as roles change, runs access requests and approvals, enforces separation of duties, and conducts periodic access reviews and attestations. It answers who should have access to what and provides the evidence that access was approved and reviewed.
What is the difference between IGA and ISPM?
IGA governs access as a process: who should have access and whether it was approved. ISPM continuously measures the security risk that access represents: how exposed an identity is right now. IGA decides who gets access; ISPM measures how risky that access makes you. They are complementary.
Does IGA stop identity attacks?
No. IGA governs and limits access and creates audit records, but it cannot stop an attacker using a validly granted, stolen credential. Detecting and responding to attacks in progress is the job of ITDR, and reducing the attack surface beforehand is the job of ISPM.
About the author
Product Marketing Manager, 8Layers
Over a decade in product marketing, go-to-market, and product launches across B2B SaaS environments. Always tracking where the Identity Security space is heading. Focused on translating what's next into what the business does today.