IdP, IGA, Access Graph and Discovery: Which Layer Does What

Why talk about layers?

Identity products overlap in marketing and differ in practice. Thinking in layers makes it easier to see which problem a product solves and which it leaves to something else. This site uses five.

Identity provider

Signs users in to applications, enforces MFA and sign-in policy, and holds the central directory. It sees the applications it federates with and the sign-ins that pass through it. It does not see accounts an application created for itself.

Identity governance and administration (IGA)

Provisions and removes accounts when people join, move and leave, runs access reviews and certifications, and records decisions for audit. SailPoint Identity Security Cloud, Saviynt, C1 and Lumos sit here, and Microsoft Entra ID Governance and Okta Identity Governance add these functions to their identity providers. An IGA governs the applications it is connected to.

Access graph

Builds a model of who can do what across connected systems, down to effective permissions. Veza describes its Access Graph this way and runs reviews and lifecycle actions on top of it. Its coverage follows its integrations.

Discovery and orchestration

Finds applications and accounts that no other layer is connected to, maps how identity works inside them, and passes that context to the layers that act. Orchid Security describes its platform as Discover, Analyze, Orchestrate and Audit, feeding IAM, IGA and ITSM tools. It does not provision access itself.

Runtime protection

Watches authentication as it happens and blocks or challenges risky sign-ins. Silverfort, for example, describes identity threat detection and response and MFA for legacy applications. This layer protects sign-ins rather than governing accounts, so it is not scored on this site.

How do the layers fit together?

A common pattern: the identity provider handles sign-on, the IGA handles lifecycle and reviews for connected applications, and a discovery layer finds what neither is connected to and sends it to the IGA or to the ticketing system. The rankings show each tool's layer next to its score, because a discovery tool and an IGA platform are often bought together rather than instead of each other.