IGA is the discipline of ensuring access stays appropriate throughout an identity's life: provisioning and de-provisioning, requesting and approving access, certifying it periodically, and evidencing all of it for auditors. Where authentication proves who you are, governance proves your access is still justified. The governance labs build these controls end to end.

JML automation connects an authoritative source (usually HR) to the identity provider and downstream apps so lifecycle events trigger access changes automatically: joiners get birthright access, movers gain and lose entitlements on role change, and leavers are disabled and de-provisioned promptly. Automating it closes the gap where movers accumulate access and leavers are never fully removed.

Access certification is a periodic campaign where reviewers — managers or resource owners — confirm that each person still needs the access they hold, and revoke what they do not. It produces the audit evidence that entitlements are still justified. Effective reviews are scoped, risk-prioritized and generate a defensible record rather than rubber-stamping everything.

Segregation of duties prevents any one identity from holding a combination of entitlements that enables fraud or error — for example, both creating a vendor and approving its payments. SoD design defines these toxic combinations and detects or blocks them. It is a core control for financial and regulated systems, and a common audit finding when missing.

Birthright access is the default set of entitlements every member of a department, role or persona receives automatically on joining — email, collaboration tools, baseline systems. Defining birthright access well speeds onboarding and keeps grants consistent, while everything beyond it should be requested and approved. Getting the baseline right reduces both friction and over-provisioning.

Entitlement (or role) mining analyzes who currently has which permissions to discover natural role structures and outliers — access that only one person has, or that a whole team shares. It informs sensible role design instead of guessing, and surfaces excess privilege to clean up. It is the analytics step that makes an RBAC or access-package rollout evidence-based.

Governance sits on top of authentication and authorization: strong sign-in and least-privilege policy mean little if access is granted forever and never reviewed. IGA closes the loop by continually reconciling granted access against what is justified, feeding clean data to Conditional Access, PAM and the SOC. It is what keeps a hardened tenant hardened over time.