Understanding Identity Providers (IdPs) and Identity Governance and Administration (IGA)
IdPs and IGA are foundational ICAM components. They are related and often integrated, but have distinct functions and objectives.
What is an Identity Provider (IdP)?
An Identity Provider is a service focused on authentication. Its primary role is to verify that a user is who they claim to be before granting access to a system.
Key functions
- Authentication: Confirms identity through credentials such as a username and password or PKI, including multi-factor authentication (MFA).
- Federation: Provides Single Sign-On (SSO), allowing a user to log in once and access multiple services without re-authenticating.
- Token issuance: Creates security tokens (such as SAML and OIDC) for applications to verify a user's identity.
- Directory services: Integrates with user directories such as Active Directory to source identity information.
The core benefit of an IdP is a centralized and streamlined authentication experience for users.
What is Identity Governance and Administration (IGA)?
IGA manages and enforces access policies. It coordinates access policies throughout a person's time with an organization. The governing principle is least privilege.
Key functions
- Provisioning and deprovisioning: Creates accounts and grants access for joiners, modifies access as roles change, and revokes access when people leave.
- Access certification: Facilitates periodic reviews for managers to confirm their team members' access rights remain necessary.
- Access policies: Applies RBAC and ABAC as described in the security concepts.
- Policy enforcement and auditing: Ensures access rules comply with regulations and provides detailed reports for auditors.
The core benefit of an IGA system is reduced security risk and regulatory compliance.
Direct comparison
| Feature | Identity Provider (IdP) | Identity Governance and Administration (IGA) |
|---|---|---|
| Primary focus | Authentication and federation | Access governance and compliance |
| Lifecycle management | Basic provisioning | Full lifecycle automation (joiner, mover, leaver) |
| Access reviews | Not a standard feature | Core capability |
| Compliance and audit | Limited reporting | Extensive reporting and policy enforcement |
| Role management | Basic group-based access | Advanced RBAC and Separation of Duties (SoD) |
| Integration scope | Applications and services | HR systems, ticketing platforms, applications, and more |
Why both are necessary
An IdP and an IGA solution address different parts of access management:
- An IdP verifies identity at the point of entry.
- An IGA manages and governs what that identity can do after authentication.
A comprehensive security strategy uses the IdP to confirm users are who they say they are and the IGA to ensure they have only the resources appropriate for their roles and responsibilities.
Content last reviewed 29 October 2026. Next review due 27 January 2027.