IGA for Active Directory
Many IGA programs assume cloud-first catalogs. Mid-market Microsoft estates still grant critical access through AD groups. IGA for Active Directory means ownership, reviews, and revocation that change the directory — not only attest on a spreadsheet.
Spreadsheet / ticket reviews
Manual attestation with weak remediation.
Only as a temporary stopgap.
Strengths
- Low software cost
- Familiar to auditors who accept screenshots
Trade-offs
- Revokes often never hit AD
- No dry-run of membership removals
- Evidence quality collapses under scale
Cloud-only IGA
Strong for SaaS; thin for on-prem AD groups.
When almost all entitlements are cloud apps.
Strengths
- Modern UX
- Good SaaS connector stories
Trade-offs
- Multi-domain AD day-2 work still lives elsewhere
- Hybrid memberships fall through cracks
Rivitan (hybrid Microsoft)
AD + Entra governance with reviews that revoke.
When AD groups still matter and Entra is part of the same estate.
Strengths
- AD-aware reviews and operations
- Dry-run then apply remediation
- Hygiene for stale accounts and empty groups
- Path to Entra and broader portals without changing the core story
Trade-offs
- Not a universal connector IGA for every legacy ERP
- Best fit is Microsoft-centric hybrid estates
The verdict
If Active Directory still holds critical access, your IGA program must remediate AD — not only certify cloud packages. Rivitan is built for that hybrid Microsoft wedge.
Ready to simplify enterprise IAM?
Book a free 30-minute discovery call. We'll talk through your identity estate and where the biggest wins are — platform, advisory, or both.