Identity Governance and Administration
This domain covers governance around identities rather than authentication: who should have access, who approved it, and how it is removed. CyberArk Identity Governance handles lifecycle management, provisioning, access requests, certifications, roles and separation of duties, and it extends the same discipline to privileged access held in the Vault.
Lifecycle and provisioning
Joiner, mover and leaver events from an HR system or directory drive provisioning through connectors such as SCIM, AD/LDAP and SaaS APIs. Birthright roles grant baseline access automatically at onboarding, so new starters are productive without a request. Leavers are the audit-critical case: orphaned accounts and retained entitlements are the most common finding.
Roles and separation of duties
Role mining proposes roles from entitlements people already hold, which reduces one-off grants. Separation-of-duties policies define forbidden combinations - creating a vendor and approving its payment, for example - and violations are flagged at request time and in periodic reviews.
Requests and certifications
Access requests route to a manager, resource owner or application owner for approval. Certification campaigns are scheduled reviews in which the reviewer confirms or revokes each entitlement; a revocation must trigger a deprovisioning task, not merely a record. Scoping matters: certifying every entitlement of a large application produces rubber-stamping, while certifying only privileged and sensitive entitlements produces meaningful decisions.
Privileged access governance
Safe memberships and privileged accounts are certified alongside business applications. The decision must feed back into the Vault so the user is actually removed from the Safe.
Worked example
A campaign closes with a revoke decision for a user's server administrator role, yet the next audit finds the access still active. Reasoning: the certification recorded a decision, but the connector either lacks a deprovision operation for that target or the provisioning task failed silently. The fix is to verify connector capability and task status, then re-run deprovisioning - repeating the campaign does not remove anything by itself.
Traps
Treating certification as documentation rather than an enforcement trigger. Assuming SoD is only checked after access is granted. Confusing authentication and single sign-on with governance.