What is identity lifecycle management?

An identity is a person, contractor, service account or AI agent that can use systems. Lifecycle management answers four questions about each one at any moment: which accounts does it have, in which applications, with what access, and should it still have them. The program is a set of processes and tools that keep those answers correct as people join, change roles and leave.

Regulators describe the same thing in their own words. Commission Delegated Regulation (EU) 2024/1774, the technical standard under DORA for ICT risk management, requires financial entities to operate a lifecycle management process for identities and accounts covering creation, change, review and update, temporary deactivation and termination of all accounts (Article 20). NIST SP 800-53 Rev. 5 control AC-2 (Account Management) asks organizations to create, enable, modify, disable and remove accounts in line with defined policy, and to review accounts for compliance on a defined frequency.

An identity provider (IdP) controls sign-on. An IGA platform controls provisioning, reviews and policy. Both act through connections: SSO federation, SCIM, APIs or connectors. Where an application has none of these, neither system can see its accounts or change them. Microsoft's documentation for Entra ID Governance covers this case with a manual procedure: export the application's users to a CSV file, match them to directory users, then review.

Those disconnected applications are usually legacy, on-premises or custom-built, and often hold the most sensitive data. They are also where local accounts, created inside the app and never passed through the IdP, accumulate.

1. Application inventory, including applications nobody connected.
2. Account inventory per application, reconciled to the HR system of record.
3. Automated JML for connected apps; a timed, ticketed process for disconnected ones.
4. Access reviews that include disconnected apps.
5. Orphan-account detection on a schedule, not only at audit time.
6. Evidence retained so each audit does not start from zero.

Governance platforms (SailPoint Identity Security Cloud, Saviynt, Microsoft Entra ID Governance, Okta Identity Governance, C1, Lumos) automate stages 1 to 4 for connected applications. Veza adds effective-permission visibility across its integrations. Orchid Security focuses on discovering unmanaged applications and the accounts inside them, then feeding them to those platforms. Scores and trade-offs: tool comparison.