Identity governance and administration (IGA) is software that creates, changes and removes each person's access to a company's systems as they join the company, move to a new role and leave. It also runs access reviews, in which managers confirm who still needs which access. The three events are called joiner, mover and leaver, or JML.
A large company may run hundreds of systems, each with its own accounts and roles. Without IGA, an IT employee creates each account by hand when a request arrives, and nobody removes it later. So a person who has changed roles three times keeps the access of all three roles. A person who has left may keep an account for months. Both break the rule of least privilege, which says that each person should have only the access that their job needs.
IGA starts from the HR system. The human resources information system (HRIS) records each joining date, each transfer and each last working day. IGA reads these changes every few hours. It keeps a set of roles, each one a list of the access that one job needs. For a joiner, it creates every account that the role needs, in the directory services and in each application. For a mover, it adds the new role's access and removes the old role's access. For a leaver, it removes everything on the last working day.
Take, for example, an employee in the procurement team at a steel plant in Jamshedpur who moves to the sales team. On the day of the transfer, the HR system records her new department. That night, IGA gives her access to the sales CRM and the sales reports. It also removes her right to approve purchase orders in the ERP system. Why does that matter? A person who can both raise a purchase order and approve it could pay a supplier without anyone else checking. Keeping these two powers with different people is called segregation of duties. The same check runs inside SAP access control.
Every quarter, IGA asks each manager to review the access of each team member, and to keep or remove each item. Auditors ask to see these reviews. IGA sends the records to compliance automation software as proof. Employees can also ask for extra access through the IT service desk. IGA sends each request to the manager, and it creates the access only after the manager approves.
IGA now has to govern programs as well as people. Service accounts and keys belong to programs, so they never join or leave through HR. Each one still needs an owner, a reason and a review. These are non-human identities.