Identity Governance and Administration, lifecycle management, and compliance.
What Identity Governance and Administration (IGA) actually is, how identity administration differs from identity governance, what IGA is not, and the business drivers and returns that get an IGA program funded.
Why an IGA program depends on its identity data model: what makes a source authoritative, how identities are matched across systems, how drift is caught, and why bad data upstream breaks certification and provisioning downstream.
How an IGA program governs the joiner-mover-leaver lifecycle: why matching quality decides whether an event reaches the right accounts, why a mover needs a separation-of-duties check nobody scheduled, and how reconciliation and certification catch what the workflow engine missed.
How to build an entitlement catalog: the real difference between a permission, an entitlement, and a role, how to choose the right granularity, a naming scheme that survives a dozen systems, and why every entitlement needs a named owner and a risk tier.
Who actually runs an IGA program: the program manager, IAM architect, IAM engineer, business analyst, application owner, compliance officer, and security, what each is accountable for, who makes the real access decisions, and how a small team covers all of it.
How access requests work in an IGA program: what a governed request contains that an IT ticket doesn't, how to design a catalog people can actually request from, approvals sized by risk, conflict checks before anything is granted, end dates, and the measures that show whether the process works.
How access certification works in an IGA program: campaign types, scope and frequency set by risk, the context a reviewer needs to make a real decision, how to design out rubber-stamping, event-driven reviews, and the evidence an auditor actually tests.
How to design roles an IGA program can actually govern: where the two meanings of 'role' used in this domain meet, business versus technical roles, top-down and bottom-up design and how they converge, role mining and its blind spots, role quality, role explosion, and the role lifecycle.
How IGA policies assign and constrain access automatically: attribute-based assignment rules, how small a birthright bundle should be, separation-of-duties rules as policy, what happens when two policies disagree, and why every policy change should be simulated before it goes live.
How an IGA platform actually creates, changes, and removes access in target systems: connector types, systems with no API, what deprovisioning should really do, failed and partial operations, reconciliation and drift, and why removing access is harder to get right than granting it.
What an IGA program needs to record, how auditors actually test access controls, why a report is itself something an auditor checks, point-in-time questions, operational versus risk reporting, protecting the audit trail, and how long to keep it.
What separation of duties means in identity governance, which duties get separated, how toxic combinations arise, static versus dynamic SoD, how to build a conflict matrix from risks down to permissions, and how to prevent conflicts or detect them after the fact.