Blog

Zero Standing Privileges: Moving from Permanent Access to Just-in-Time with midPoint

by midPoint Tips

99% of cloud identities are over-permissioned. That number comes from Palo Alto Networks’ Unit 42 Cloud Threat research. It means that virtually every identity in your environment holds more access than it needs, and that access persists 24 hours a day, 7 days a week, whether or not anyone is using it.

This is the standing privilege problem. An administrator has permanent production database access even though they touch production once a month. A developer has write access to the deployment pipeline even though they deploy once a quarter. A contractor has VPN access to internal systems even though their active project ended six weeks ago.

Each of these is a dormant attack surface. When credentials are compromised – and the Verizon 2026 DBIR confirms that credential abuse remains present in 39% of breach chains – the attacker inherits whatever standing privileges the credential carries. If the compromised account has permanent admin access to a production system, the attacker has it too. Immediately. Without escalation.

Gartner defined Zero Standing Privileges (ZSP) as “the target state for privileged access in an organization to minimize risk of stolen credentials, privilege abuse, breaches, data loss, and non-compliance.” The core mechanism is Just-in-Time (JIT) access: privileges are granted only when needed, for only as long as needed, with explicit approval, and then automatically revoked.

This is not a theoretical framework. It is a practical architecture that midPoint supports today.

The cost of standing privileges

The breach record makes the case more effectively than any analyst prediction.

Microsoft / Midnight Blizzard, January 2024. A Russian state-sponsored group compromised a legacy test account with standing elevated privileges to Microsoft’s corporate environment. The account had no business need for those privileges. A password spray was sufficient. The attackers accessed senior leadership and cybersecurity team email over a period of weeks.

Snowflake customers, May 2024. Stolen credentials – harvested by infostealer malware months or years earlier – were used to access approximately 165 customer tenants. The accounts had permanent access with no MFA. Standing credentials, standing access, massive breach.

BeyondTrust, December 2024. A compromised API key – a standing credential for a non-human identity – was paired with a command injection vulnerability to gain unauthenticated remote code execution on customer Remote Support SaaS instances.

The pattern repeats: a credential that was granted once and never re-evaluated. Access that persisted long after the legitimate need ended. Revocation that happened only after the breach was discovered.

The numbers reinforce the pattern. IBM’s 2025 Cost of a Data Breach report found that breaches involving compromised credentials cost $4.67 million on average and take 246 days to identify and contain – the longest of any attack vector. Ponemon’s 2025 research found that 45% of incidents involve overprivileged internal users and 34% involve third parties with excessive access.

What Zero Standing Privileges actually means

ZSP does not mean nobody has access. It means nobody has persistent, always-on privileged access that sits idle between uses.

The practical implementation has three components:

Just-in-Time (JIT) access. Privileges are provisioned when explicitly requested, approved, and needed. They expire automatically after a defined time window. Between requests, the identity holds no elevated access.

Just-Enough-Privilege (JEP). When access is granted, it carries only the permissions required for the specific task. An administrator who needs to restart a service does not get full root access to the server. They get the specific capability, scoped to the specific system, for the specific duration.

Continuous verification. Access decisions are re-evaluated based on context: time of day, location, device posture, recent behavior patterns. A request that makes sense at 2 PM from the office may not make sense at 3 AM from an unrecognized device.

Gartner’s April 2025 report “Reduce Risk Through a Just-in-Time Approach to PAM” recommends that IAM leaders implement JIT and JEP strategies starting with low-complexity, high-volume cases and expanding to cover all privileged access. The broader industry trend toward converged IAM/PAM/IGA platforms reflects the reality that JIT access cannot be bolted on as a separate tool – it needs to be embedded in the governance layer.

How midPoint implements Just-in-Time access

midPoint provides the governance and provisioning infrastructure that makes JIT access operational across your environment. Here is how each component works.

Time-bound role assignments

Every role assignment in midPoint can carry validity constraints: a valid-from date, a valid-to date, or both. When a user requests elevated access – production database admin, emergency change authority, audit investigation privileges – the assignment is created with an expiration. When the expiration arrives, midPoint automatically revokes the role and deprovisions the associated entitlements across all connected systems.

This is not a reminder to revoke access. It is automatic enforcement. The access disappears from every target system on schedule, whether or not anyone remembers to act.

Approval workflows

midPoint’s approval engine routes elevated access requests through configurable approval chains. The complexity of the approval process scales with the sensitivity of the access:

  • Low-risk temporary access (read-only access to a test environment) may require single-manager approval.
  • Medium-risk access (write access to staging systems) may require manager plus system owner.
  • High-risk access (production admin, financial system write access) may require manager, system owner, and security team.

Each approval step can include conditions: the approver sees the requested role, the justification, the requested duration, and any policy violations the assignment would trigger. The approver can modify the duration before approving.

Role catalog and self-service requests

Users request elevated access through midPoint’s role catalog – a structured list of available roles with descriptions, risk levels, and approval requirements. The request process works like a controlled shopping cart: the user selects the role they need, provides justification, and specifies the desired duration. midPoint evaluates the request against policies, routes it through the appropriate approval chain, and provisions access only after approval.

This replaces the informal channel – Slack messages, email requests, verbal approvals – that most organizations use for temporary access today. Every request is logged, every approval is recorded, and every grant has an expiration.

Policy-driven enforcement

midPoint’s policy rules engine can enforce constraints that go beyond individual access requests. Because policy rules are expression-based and extensible, organizations can configure constraints such as:

  • Maximum duration limits. A policy rule can specify that production admin access can never be granted for more than 8 hours, regardless of what the requester asks for.
  • Repeated-request controls. Policy rules can be configured to flag or block rapid re-requests of the same elevated role, preventing “permanent JIT” where access is simply re-requested every time it expires.
  • Scoped grant policies. Rules can enforce conditions on how many identities hold a given elevated role or require additional approvals when sensitive roles are concentrated.
  • SoD interaction. Temporary elevated access is evaluated against the same segregation-of-duties rules as permanent access. A temporary grant that would create a toxic combination is blocked or routed to additional approval.

Non-human identity JIT

Standing privileges are not only a human problem. Service accounts, API keys, and automation credentials often hold permanent elevated access because “the system needs it to run.” In many cases, the system needs the access for minutes per day but holds it for months.

midPoint can manage time-bound assignments for non-human identities the same way it does for humans. A CI/CD pipeline that needs production deployment access can receive it through an automated request with a 30-minute expiration, triggered by the deployment event and revoked automatically after completion.

The IGA-PAM convergence

Gartner’s 2025-2026 IAM research increasingly frames JIT access as a convergence point between Identity Governance and Administration (IGA) and Privileged Access Management (PAM). The traditional division – IGA governs who has access, PAM controls how privileged access is used – breaks down when you need both governance (who should be approved, for how long, under what conditions) and enforcement (session recording, credential vaulting, command filtering) in a single workflow.

midPoint operates as the governance layer in this architecture. It decides who gets access, for how long, through what approval process, and with what policy constraints. The PAM tool – CyberArk, BeyondTrust, HashiCorp Vault, or whatever your organization uses – handles the privileged session itself: credential injection, session recording, command filtering.

The integration pattern:

  1. User requests elevated access through midPoint’s role catalog.
  2. midPoint evaluates the request against policies and routes it through approvals.
  3. On approval, midPoint provisions a time-bound entitlement in the PAM tool.
  4. The user accesses the target system through the PAM tool’s session broker.
  5. On expiration, midPoint revokes the entitlement in the PAM tool.

This gives you governance-grade audit trails (who approved what, why, for how long) combined with PAM-grade session controls (what did they actually do during the session). Neither tool alone provides both.

The attack surface reduction

The security argument for ZSP is straightforward: privileges that do not exist cannot be stolen.

BeyondTrust’s 2025 research estimates that JIT access can reduce privileged threat windows by more than 90%. SecHard’s analysis, citing Gartner frameworks, found that JIT combined with just-enough-privilege can shrink the overall attack surface by up to 80% in hardened environments, with up to 94% fewer human errors in access management.

Consider the Microsoft/Midnight Blizzard breach through a ZSP lens. The compromised test account had standing elevated privileges. Under a ZSP model, that account would have had no elevated privileges by default. An attacker who password-sprayed into it would have found an account with baseline access and no path to corporate email. The breach either would not have occurred or would have been contained to an irrelevant test environment.

The same applies to Snowflake. Under a ZSP model, dormant credentials would not carry standing access to customer data stores. Stolen credentials harvested by infostealers months earlier would be useless – the access they once granted would have expired automatically.

Where to start

Moving from permanent access to JIT is not a single project. It is a maturity progression. Gartner recommends starting with low-complexity, high-volume cases and expanding:

Phase 1: Identify standing privileges. Use midPoint’s role analysis and reporting to map which identities hold elevated access, how long they have held it, and how often they use it. The gap between “always has access” and “uses access monthly” identifies your highest-value JIT candidates.

Phase 2: Convert low-risk elevated access. Start with access categories where the blast radius of a mistake is limited: test environments, non-production databases, staging systems. Convert permanent role assignments to request-based, time-bound assignments. Build organizational familiarity with the request-approve-expire cycle.

Phase 3: Expand to production access. Move production system admin access, deployment pipeline credentials, and financial system write access to JIT. Configure appropriate approval chains, maximum durations, and SoD policies.

Phase 4: Cover non-human identities. Extend JIT to service accounts, API keys, and automation credentials. Integrate with your secrets vault for automated credential provisioning and rotation.

Phase 5: Continuous optimization. Monitor request patterns. Identify roles that are requested so frequently they should be birthright (moving them back to permanent reduces friction without increasing risk). Identify roles that are never requested and should be retired. Adjust durations based on actual usage data.

Zero Standing Privileges with WeKnowIdentity

WeKnowIdentity helps organizations design and implement JIT access architectures using midPoint’s governance engine. That includes standing privilege analysis, role catalog design, approval workflow configuration, time-bound assignment policies, PAM integration, and non-human identity JIT. We work with your existing PAM tools and infrastructure – the goal is governance that fits your environment, not a rip-and-replace.

If your administrators have permanent production access they use once a month, your contractors have VPN access that outlives their contracts, and your service accounts have credentials that have not been rotated since they were created – those standing privileges are your largest ungoverned attack surface.

Book a free privilege assessment

Related Resources

Sources

Joiner-Mover-Leaver Automation Done Right: A Practical midPoint Guide

by midPoint TipsTechnical Tutorials

A new employee starts on Monday. By Wednesday, they still cannot access their email, the project management tool, or the shared drive their team uses. The manager opens a helpdesk ticket. IT provisions accounts manually, copying permissions from a colleague who started two years ago and has since accumulated access to three systems they no longer need. The new hire inherits every one of those unnecessary permissions.

This is not a worst-case scenario. This is the default in most organizations. CloudEagle’s 2025 IGA report found that roughly 60% of organizations still handle provisioning and offboarding manually. Gartner’s 2024 research measured new hires losing up to 40% of first-week productivity waiting 3 to 5 days for basic access.

The leaver side is worse. 50% of ex-employees still have access to corporate applications after departure. 42% of organizations take more than a week to fully revoke access after someone leaves.

Joiner-mover-leaver automation is the single most impactful thing an IGA platform can do. It is also the capability most often botched in implementation – not because the technology is hard, but because the edge cases are underestimated. This guide covers what JML automation actually looks like in production with midPoint, including the parts that vendor demos skip.

What JML automation is and is not

JML automation connects your HR system to your IT systems so that identity lifecycle events – someone joins, changes role, or leaves – trigger automatic provisioning and deprovisioning actions across every connected application.

What it is: a policy-driven engine that translates HR data into access decisions, executes them across all target systems, and logs everything for audit.

What it is not: a one-time sync job. A spreadsheet of role mappings. A set of scripts that run on a cron schedule and break when the HR system adds a field.

The difference matters because most failed JML projects fail at the boundary between these definitions. They automate the simple path – new hire gets standard access – and leave everything else to manual process. The result is an automation layer that handles 60% of events and creates confusion for the other 40%.

The three lifecycle events in detail

Joiners

A joiner event begins when a new record appears in the HR system. In midPoint, the HR system is configured as the authoritative source – the single source of truth for identity data. When midPoint detects a new HR record, it triggers a sequence:

1. Identity creation. midPoint creates an identity object with attributes pulled from the HR record: name, employee ID, department, position, manager, start date, location.

2. Account provisioning. Based on the identity’s attributes, midPoint automatically creates accounts on target systems. A new employee in the Engineering department gets an Active Directory account, a GitLab account, and a Jira account. A new employee in Finance gets AD, the ERP system, and the financial reporting platform. These mappings are defined by organizational policies and role assignments, not by copying a colleague’s access.

3. Role assignment. midPoint assigns roles based on organizational rules. Birthright roles – the baseline access everyone in a given position needs – are assigned automatically. These are defined through policy rules that map HR attributes (department, job title, location, cost center) to midPoint roles. Each role carries specific entitlements on specific target systems.

4. Notification. The manager, the new hire, and the helpdesk are notified that provisioning is complete. The new employee has working accounts on day one.

Automated provisioning reduces onboarding time by 73% compared to manual processes. The real value is not speed alone – it is consistency. Every person in the same role gets the same access. No privilege accumulation from copied accounts. No forgotten systems.

Movers

Movers are the most underestimated JML event. A mover is any change in someone’s organizational context: department transfer, promotion, location change, reporting line change, temporary assignment, or restructuring.

The problem with movers in manual environments is privilege creep. When someone moves from Engineering to Product Management, they get new access for their new role. But their old Engineering access – repository write permissions, CI/CD pipeline access, staging environment credentials – stays. Nobody revokes it because nobody remembers to, and the employee does not report it because the access is occasionally convenient.

Over time, long-tenured employees accumulate access across multiple departments. This is one of the largest sources of segregation-of-duties violations in enterprise environments and a primary target for insider threat and lateral movement after credential compromise.

midPoint handles movers through reconciliation. When the HR system updates an employee’s department, position, or manager, midPoint re-evaluates all role assignments. Roles tied to the old organizational context are revoked. Roles tied to the new context are granted. The transition happens automatically, and the employee’s access profile always reflects their current position – not their history.

This re-evaluation runs against policy rules, not static mappings. If a policy says “everyone in Finance with the title Senior Analyst gets access to the consolidation system,” then gaining or losing the Senior Analyst title in Finance automatically grants or revokes that access. No ticket required. No manager approval needed for standard birthright access.

For access that requires explicit approval – sensitive systems, elevated privileges, cross-departmental access – midPoint routes the request through approval workflows. The mover event can trigger both automatic adjustments and approval-gated requests in the same transition.

Leavers

When an employee’s termination date is set in the HR system, midPoint begins the offboarding sequence. The timing is configurable: immediate deactivation, deactivation on the termination date, or a grace period for knowledge transfer.

1. Account deactivation. On the configured trigger date, midPoint disables all accounts across all connected systems. Not deletes – disables. The accounts remain in a suspended state for the retention period required by your compliance framework (GDPR, tax law, internal policy).

2. Access revocation. All role assignments are revoked. All entitlements are removed. The identity retains its audit history but can no longer authenticate to any system.

3. Manager notification. The leaver’s manager is notified of the deactivation and any pending access reviews or knowledge transfer requirements.

4. Delegation and reassignment. midPoint can automatically reassign ownership of resources, shared mailboxes, or service accounts that the leaver was responsible for. This prevents the orphan-account problem where a service account loses its only known owner and becomes ungoverned.

5. Archival or deletion. After the retention period, midPoint can either archive the identity record or delete it, depending on policy.

The industry benchmark for automated deprovisioning is access terminated within 15 minutes of the HR event. Organizations using midPoint achieve this because the provisioning engine executes revocation across all connected systems in a single automated pass. Compare this to the 42% of organizations that take more than a week.

The edge cases that break simple automation

Every JML implementation handles the straight path: new hire, department transfer, termination. The projects that deliver real value are the ones that also handle the cases below. midPoint’s flexible policy engine and lifecycle state model make these tractable rather than exceptional.

Rehires

An employee leaves in March and returns in September. Do they get a new identity or reactivation of the old one? If the old identity is reactivated, which access rights are restored – the ones they had when they left, or the ones appropriate for their new position?

midPoint handles rehires through focal object preservation. The identity record is retained in a suspended lifecycle state. When the HR system creates a new record that matches the old identity (by employee ID, national ID, or correlation rules), midPoint reactivates the existing identity rather than creating a duplicate. Role assignments are re-evaluated based on the new position, not the old one. Audit history is preserved continuously.

Contractors and external users

Contractors do not exist in the HR system. They have no HR joiner event, no department code, and no automatic termination date. They are typically onboarded through a request from the sponsoring manager and have a fixed contract end date.

midPoint manages external identities through separate lifecycle policies. A contractor identity requires a sponsoring owner (a human employee), a defined end date, and periodic recertification. When the contract end date arrives, midPoint deactivates the identity automatically. When the sponsoring owner leaves the organization, midPoint flags the contractor identity for ownership reassignment or deactivation.

Parental leave and long-term absence

An employee on parental leave should not have their identity deleted. But should they retain active access to production systems for twelve months while they are away?

midPoint’s lifecycle state model supports suspension states that deactivate accounts without revoking role assignments. When the employee returns, reactivation restores their previous access profile without requiring a new provisioning cycle. If their role or department changed during the absence (restructuring, for example), the reconciliation engine adjusts automatically.

Multiple simultaneous positions

In universities, hospitals, and research organizations, a single person may hold multiple positions simultaneously: a professor who is also a department head and a research project lead. Each position carries different access requirements.

midPoint supports multiple assignments per identity. Each assignment can carry its own role set, validity period, and organizational context. The identity’s effective access is the union of all active assignments, evaluated against SoD policies to prevent conflicts.

Mergers and organizational restructuring

When two departments merge, or a company acquires another, the organizational structure changes for hundreds or thousands of identities simultaneously. Manual re-provisioning at this scale is not feasible.

midPoint’s policy-driven approach handles restructuring by updating organizational unit mappings. When the org structure changes in the HR system, midPoint re-evaluates every affected identity against the new structure and adjusts role assignments accordingly. The process is audited, reversible, and can be simulated before execution.

The implementation approach that works

Evolveum’s methodology for JML deployment follows a three-phase pattern: Connect, Cleanup, Automate. This sequence matters because automating on top of dirty data produces automated garbage.

Phase 1: Connect (weeks 1–4)

Connect midPoint to the HR system and target systems. Pull identity data. Pull account data. Do not automate anything yet. The goal is visibility: how many identities exist in the HR system, how many accounts exist in each target system, and how do they correlate?

midPoint’s smart correlation engine matches identities across systems even with inconsistent naming, missing fields, or transliteration differences. The output is a map of your actual identity landscape – including orphan accounts, duplicate identities, and accounts with no HR match.

Phase 2: Cleanup (weeks 3–6)

Before automating lifecycle events, clean the data. Assign owners to orphan accounts. Resolve duplicate identities. Remove accounts that belong to people who left years ago. Align role definitions with actual access patterns using midPoint’s role mining capabilities.

This phase is where most of the hard decisions happen. It is also where the most immediate security value is delivered – before any automation is turned on, you have already closed the orphan-account gap.

Phase 3: Automate (weeks 5–12)

With clean data and validated correlation, enable automated provisioning. Start with joiners (lowest risk – new accounts, no existing data to corrupt). Move to leavers (high security value – automated deprovisioning closes the biggest governance gap). Finish with movers (highest complexity – requires validated role models and SoD policies).

Each automation step runs in simulation mode first. midPoint evaluates what the automation would do against production data without executing changes. You review the results, adjust policies, and enable execution only when the simulation matches expectations.

The measurable impact

Organizations that implement JML automation with an IGA platform report consistent improvements across security, efficiency, and compliance metrics:

  • Provisioning time reduced by 73%, from days to hours or minutes
  • Deprovisioning time reduced significantly, from weeks to minutes
  • Identity-related security incidents reduced by over 67%
  • Audit pass rates exceeding 95% for SOC 2 and ISO 27001
  • Helpdesk ticket volume for access requests reduced by 40–60%
  • Privilege creep incidents reduced through automated mover re-evaluation

The ROI is not theoretical. Forrester’s 2025 Total Economic Impact study of enterprise IGA automation (commissioned by Saviynt, but representative of IGA-class automation outcomes) measured 269% ROI with payback under nine months, including 577,000 hours saved on manual provisioning and access reviews. The specific numbers will vary by platform and environment, but the order of magnitude is consistent across IGA implementations.

Start your JML automation project

WeKnowIdentity has delivered 10+ enterprise midPoint deployments managing up to 1,000,000+ identities across telecom, finance, government, healthcare, education, and technology sectors. Our team holds four Evolveum midPoint certifications and has hands-on experience with JML automation projects ranging from single-HR-source deployments to complex multi-source, multi-country environments.

If your onboarding still involves helpdesk tickets, your offboarding still takes more than a day, and your movers still accumulate privileges from every role they have ever held – those are the gaps that JML automation closes first.

Book a free JML assessment

Related Resources

Sources

AI-Powered Identity Attacks: Why Identity Governance Is Your Best Defense

by CompliancemidPoint Tips

AI has not changed what attackers want. They still want credentials, access, and data. What AI has changed is how fast and how convincingly they get them. CrowdStrike’s 2026 Global Threat Report recorded an 89% increase in attacks by AI-enabled adversaries. Deepfake fraud losses hit $1.65 billion in a single year. 82% of CrowdStrike’s 2025 detections were malware-free – attackers logging in, not breaking in.

The security industry has responded with better endpoint detection, smarter email filters, and AI-powered threat intelligence. These are necessary. But none of them address the core problem: once an attacker has valid credentials – stolen, phished, or deepfaked past your verification – your perimeter defenses have already lost.

That is where identity governance picks up. Not as a replacement for detection, but as the control layer that limits what stolen credentials can actually reach.

The numbers behind the shift

The scale of AI-assisted identity attacks in 2025-2026 is not incremental. It is a category change.

Phishing has become AI-native. The FBI’s 2025 IC3 report recorded a 37% rise in AI-assisted business email compromise. Hoxhunt’s Phishing Trends Report found that 40% of BEC emails in Q2 2025 were AI-generated. Vishing – voice phishing – grew 442% between the first and second half of 2024, according to CrowdStrike and Pindrop.

Deepfakes have moved from novelty to operational weapon. Surfshark’s 2026 research tracked $2.19 billion in global deepfake fraud losses from January 2019 to March 2026, with $1.65 billion of that concentrated in 2025 alone. Pindrop recorded a 1,300% year-over-year rise in deepfake fraud attempts in contact centers. 62% of organizations surveyed by Gartner in September 2025 reported experiencing at least one deepfake attack in the prior twelve months.

Credential abuse remains the dominant breach vector. The Verizon 2026 DBIR found credential abuse present in 39% of full breach chains – the single most pervasive technique. IBM’s 2025 Cost of a Data Breach report measured breaches via compromised credentials at $4.67 million average cost, taking 246 days to identify and contain. CrowdStrike’s 2026 Global Threat Report noted an 89% increase in attacks by AI-enabled adversaries.

The speed has changed. CrowdStrike recorded the fastest eCrime breakout time at 27 seconds. Average breakout speed increased 65% year-over-year. When an attacker moves from initial access to lateral movement in under a minute, manual response processes are irrelevant.

Why better authentication is not enough

The instinctive response to credential-based attacks is stronger authentication: phishing-resistant MFA, passkeys, biometric verification. These are necessary. They are not sufficient.

Authentication answers one question: “Is this person who they claim to be at the moment of login?” It does not answer the questions that matter after authentication succeeds:

  • Should this person still have access to this system?
  • Does this access make sense given their current role?
  • Has anyone reviewed whether these privileges are still appropriate?
  • Is this combination of access rights creating a segregation-of-duties violation?
  • Would revoking this access, right now, take minutes or weeks?

These are identity governance questions. And for most organizations, the honest answer to each of them is “we don’t know” or “it depends on someone remembering to check.”

The real incidents tell the same story

The pattern in recent AI-assisted breaches is remarkably consistent. The attacker does not need a zero-day. They need a credential that nobody governs.

Arup, February 2024. A finance worker in Hong Kong joined a video call with colleagues including the company CFO. Every other participant on the call was an AI-generated deepfake. The worker authorized $25 million in transfers before the fraud was discovered.

Microsoft / Midnight Blizzard, January 2024. The Russian state-sponsored group password-sprayed into a legacy test account that had been left with elevated standing privileges to Microsoft’s corporate environment. They accessed email accounts of senior leadership and the cybersecurity team. The test account had no business need for those privileges. Nobody had reviewed it.

Snowflake customers, May 2024. Attackers used credentials stolen by infostealer malware to access approximately 165 customer tenants. No backdoors, no exploits. The accounts lacked MFA and had persistent standing access. Ticketmaster, Santander, and dozens more were affected.

Rakuten Mobile, February 2025. Three teenagers with no coding background used ChatGPT to build an attack tool that hit systems approximately 220,000 times. The barrier to entry for identity-based attacks has collapsed.

In every case, the governance gap was the same: credentials existed with excessive privileges, nobody was reviewing whether the access was still appropriate, and revocation processes were too slow to matter.

What identity governance actually defends

Identity governance does not stop phishing emails from arriving. It does not detect deepfakes. What it does is ensure that when an attacker succeeds in stealing or faking a credential, the damage they can do is constrained, detectable, and reversible.

Least privilege enforcement

The most direct defense against credential compromise is ensuring that every identity – human or machine – has only the access it currently needs. Not the access it needed six months ago. Not the access its predecessor in the role had. The access required by its current job function, right now.

midPoint enforces least privilege through automated role assignment based on HR data. When someone changes departments, their old access is revoked and new access is granted automatically. There is no accumulation of stale privileges, no “just in case” access lingering from a previous project.

Continuous access certification

Periodic access reviews catch the privileges that automated rules miss. midPoint runs access certification campaigns where managers and application owners verify that each identity’s access is still appropriate. Unreviewed items escalate automatically. Rejected access is revoked through automated provisioning, not a ticket queue.

This directly addresses the Snowflake and Microsoft breach patterns. Those dormant accounts with excessive privileges would have been flagged and revoked in the next certification cycle – or immediately, if event-triggered certification was configured for high-risk access.

Segregation of duties enforcement

AI-powered social engineering often targets finance and administrative functions where a single compromised identity can authorize transactions. midPoint’s SoD engine prevents toxic role combinations in real time. A user cannot simultaneously hold “create payment” and “approve payment” entitlements. An identity that acquires both – through any mechanism – triggers an automatic policy violation.

Outlier detection

When an attacker uses compromised credentials to request additional access or move laterally, their behavior creates anomalies in the identity data. midPoint’s outlier detection flags identities whose role assignments deviate from peers in the same organizational unit, job function, or archetype. An account that suddenly holds access to systems outside its normal scope surfaces as an outlier – even if every individual access grant was technically approved.

Rapid deprovisioning

When a breach is detected, the speed of access revocation determines the blast radius. Organizations using midPoint can revoke all access for a compromised identity across every connected system within minutes, not the days or weeks that manual processes require. IBM’s research shows that breaches involving compromised credentials take an average of 246 days to identify and contain. Automated deprovisioning compresses the “contain” portion to near zero.

Non-human identity governance

AI agents, service accounts, and API keys are increasingly targeted because they typically have broader access and weaker governance than human users. midPoint governs non-human identities with the same lifecycle controls as human identities. For a deep dive on this topic, see our article on Non-Human Identity Governance in midPoint.

The governance gap is measurable

IBM’s 2025 Cost of a Data Breach report found that organizations using extensive security AI and automation saved $1.9 million per breach compared to those that did not. But the report also found that 97% of organizations that experienced AI-related security incidents lacked proper AI access controls, and 63% lacked AI governance policies entirely.

The gap is not a technology gap. It is a governance gap. The controls exist. They are not deployed.

Gartner’s 2026 cybersecurity predictions explicitly recommend fortifying identities – both human and machine – with strong lifecycle controls as a top defense priority. Not as a nice-to-have compliance exercise, but as the primary control against credential-based attacks that now dominate the threat landscape.

What this means for your IGA program

If your identity governance program was designed primarily for compliance – annual access reviews, basic role assignments, audit log generation – it is not configured for an AI-powered threat environment. The difference between a compliance-oriented IGA deployment and a security-oriented one is:

Certification frequency. Annual reviews miss too much. High-risk access should be certified quarterly or on every change. midPoint supports both scheduled and event-triggered certification campaigns.

Scope. If your certifications cover human users but not service accounts, API keys, and AI agents, you are certifying the minority of your identity population. midPoint governs all identity types through the same framework.

Automation depth. If access revocation requires a helpdesk ticket, you cannot respond to a breach in the timeframe that matters. midPoint’s provisioning engine executes revocation automatically on certification decisions, policy violations, and lifecycle events.

SoD coverage. If segregation-of-duties checks only run at request time but not continuously, privilege accumulation creates exploitable gaps. midPoint evaluates SoD policies continuously across all role assignments.

Outlier visibility. If you cannot identify which identities hold access that deviates from their peers, you cannot detect lateral movement through compromised credentials. midPoint’s outlier detection makes this visible without manual analysis.

Start closing the governance gap

AI has made credential-based attacks faster, cheaper, and more convincing. The organizations that will weather this shift are not the ones with the best email filters. They are the ones where a stolen credential grants the minimum access required, where that access is reviewed regularly, where anomalies are detected automatically, and where revocation happens in minutes.

WeKnowIdentity helps organizations configure midPoint’s governance engine for security, not just compliance. That includes least-privilege role modeling, continuous certification campaigns, SoD policy design, outlier detection activation, and non-human identity governance. If your IGA program was built for auditors but not for attackers, that is the gap we close.

Book a free governance assessment

Related Resources

Sources

Entra ID Governance vs midPoint: A Practical Comparison

by CompliancemidPoint Tips

Microsoft Entra ID Governance is the default identity governance option for organizations deep in the Microsoft ecosystem. It is cloud-native, tightly integrated with M365 and Azure, and available as an add-on to the Entra ID licenses most enterprises already hold. For pure Microsoft environments, it works.

The question is what happens when your environment is not purely Microsoft.

Most enterprises are not. They run SAP alongside Azure. Oracle databases alongside SharePoint. Custom HR systems alongside Workday. On-premises Active Directory alongside Entra ID. Legacy LDAP directories that predate their cloud migration. And increasingly, Keycloak for application-level authentication and federation that sits outside Microsoft’s reach.

That is where Entra ID Governance’s scope ends and the governance gap begins. This article compares Microsoft Entra ID Governance with Evolveum midPoint – not to declare a winner, but to help you understand which platform governs what, where the gaps are, and how they work together in the hybrid reality most enterprises actually operate in.

DORA Compliance: How midPoint Meets Identity Governance Requirements

by Compliance

The Digital Operational Resilience Act (DORA) has been fully enforceable since January 2025. In 2026, European supervisors moved from readiness checks to active enforcement. If your financial institution still treats identity governance as an IT project rather than a regulatory obligation, the gap between your policies and your evidence is where the examiner will start.

DORA applies to more than 22,000 financial entities across the EU – banks, insurers, investment firms, payment providers, crypto-asset service providers, and their critical ICT third-party providers. Its identity and access requirements are not vague best practices. They are specific, article-level legal obligations with penalties reaching 2% of global annual turnover and up to EUR 1 million in personal fines for senior management.

Here is what DORA actually requires for identity governance, where most organizations are falling short, and how midPoint addresses each requirement.

Non-Human Identity Governance in midPoint: Closing the 109-to-1 Gap

by CompliancemidPoint Tips

Service accounts, API keys, RPA bots, and AI agents now outnumber human users in the average enterprise by 109 to 1. Most IGA programs barely see them. Here is what that gap looks like, why it matters for your 2026 security posture, and how midPoint treats non-human identities (NHIs) as first-class identities you can actually govern.

The numbers most IGA programs would rather not look at

Palo Alto Networks publishes the 2026 Identity Security Landscape Report, which puts the average ratio of machine identities to human identities at 109 to 1. Rubrik Zero Labs measures the ratio at 45 to 1 in traditional enterprises, rising to 82 to 1 in their most recent Identity Crisis study. Some hyper-automated, cloud-native organizations report ratios closer to 500 to 1.

In absolute terms, the average enterprise now manages over 250,000 non-human identities across its cloud and on-premise estate. That includes:

  • Service accounts on Active Directory, Linux, databases, and middleware
  • API keys, OAuth tokens, and personal access tokens
  • Workload identities (containers, serverless functions, virtual machines)
  • CI/CD pipeline credentials
  • RPA bots
  • Machine-to-machine (M2M) certificates
  • AI agents and copilots, the fastest-growing category, projected to grow 85% over the next 12 months

The governance posture, when measured, is uncomfortable:

  • 97% of NHIs carry privileges beyond what their function requires
  • 71% have not been rotated within the recommended timeframe
  • 68% of identity-related security incidents now involve a machine identity
  • Only 15% of organizations report high confidence in their ability to prevent NHI-based attacks

This is the gap, and it is not a future problem.

What recent breaches tell us

The 2024 and 2025 breach record reads like an NHI governance manual written backwards.

  • BeyondTrust (December 2024). A compromised API key was paired with a command-injection bug to gain unauthenticated remote code execution on customer instances of its Remote Support SaaS.
  • Snowflake customers (May 2024). Stolen credentials for non-MFA-protected service accounts gave attackers data from Ticketmaster, Santander, and dozens more.
  • Dropbox Sign (May 2024). A compromised backend service account opened the customer database, exposing emails, API keys, and OAuth tokens.
  • Schneider Electric (November 2024). Exposed Jira credentials let attackers exfiltrate 40 GB of internal project data.
  • AWS “Codefinger” campaign (January 2025). Ransomware operators used compromised AWS keys plus customer-provided-key encryption to lock S3 buckets.
  • DeepSeek (January 2025). Over one million log lines and sensitive secret keys exposed via an unsecured database.

The pattern is consistent. The attacker rarely needed a zero-day. They needed a credential that nobody owned, nobody reviewed, and nobody had rotated. NHIs.

Why traditional IGA misses non-human identities

Most IGA programs were built around employees: hire date, manager, department, role, leaver event. The data model and the workflows assume a human owner and a human lifecycle. That assumption breaks for NHIs in four ways:

1. No HR feed. A service account does not appear in Workday. There is no source of truth and no “joiner” event.

2. No clear owner. A bot created three years ago by a contractor who has since left has no human attached to it. Ownership rots.

3. No leaver. When the application that created the account is decommissioned, the NHI is rarely cleaned up. Orphan accounts accumulate.

4. No certification. Even where access reviews exist, certifiers either skip service accounts (“don’t touch, it’ll break production”) or rubber-stamp them.

The result is a population larger than your workforce, growing faster than your workforce, with weaker governance than your workforce. Gartner’s 2026 IAM track captured the same observation. Many organizations are still in a basic discovery phase for NHIs, inventorying what exists, assigning ownership, and understanding exposure before any meaningful policy work can begin.

How midPoint governs non-human identities

midPoint was designed around a generic identity object model rather than a fixed “user” type. That distinction matters more for NHIs than for any other category. In midPoint, a service account, an RPA bot, and an AI agent are governed using the same primitives as a human identity (roles, archetypes, policies, approvals, certifications, audit, outlier detection), but with object types, lifecycle rules, and ownership models tuned to non-human reality.

Here is what that looks like in practice.

First-class object model with archetypes

midPoint’s archetype mechanism lets you define distinct identity types such as service-account, rpa-bot, ci-cd-credential, and ai-agent. Each archetype carries its own:

  • Required attributes (purpose, system, owner, expiry, risk tier)
  • Lifecycle states and transitions
  • Approval policies for creation and privilege change
  • Certification cadence
  • Default role assignments via inducement

This is what makes governance possible. An ai-agent archetype can require an explicit human owner, a 90-day certification cycle, and an attestation that the agent’s tool list has been reviewed, automatically on every change.

Joiner-Mover-Leaver, adapted for machines

midPoint extends its JML processes to NHIs with a critical addition: human-dependency triggers. When the responsible person for a service account leaves the organization, midPoint can:

  • Re-route ownership to the leaver’s manager
  • Suspend the account if no owner is reassigned within an SLA
  • Trigger an immediate access review
  • Decommission the account when the underlying application is retired

This closes the orphan-account loop that most NHI breaches exploit.

Role-based and policy-based access for machines

Service accounts get the same RBAC discipline as users. Roles can be:

  • Birthright for a given archetype. An ai-agent may always get logging and observability access.
  • Conditional on attributes. Only agents deployed in production get database read access.
  • Approval-gated for anything sensitive. Write access to a financial system requires the data owner’s sign-off.

Segregation-of-duties checks apply equally. A bot cannot simultaneously hold “create payment” and “approve payment” entitlements without raising a policy violation.

Certifications that cover the whole identity population

midPoint’s access certification campaigns can target NHIs as their own scope. The certifier sees the account, the owner, the assigned roles, the last-used timestamp (when fed from the target system), and the risk tier. Decisions such as keep, revoke, or reassign owner flow back as automated provisioning actions, not Jira tickets.

This is where the “97% over-privileged” statistic finally gets addressable.

Outlier detection for the population you cannot eyeball

When you are governing 250,000 identities, the human eye cannot find the bad one. midPoint’s outlier detection flags accounts whose role assignments deviate from peers in the same archetype, owner group, or organizational unit. That surfaces the rogue bot which has accumulated production write access nobody approved.

Integration with secrets vaults and PAM

midPoint is the governance layer, not the secret store. The pattern that works in production is:

  • midPoint owns the lifecycle, ownership, role assignments, certifications, and audit.
  • A vault (HashiCorp Vault, CyberArk Conjur, AWS Secrets Manager, Azure Key Vault) owns the credential material, rotation, and short-lived issuance.
  • ConnId connectors wire midPoint to the vault, so that creating a service account in midPoint provisions both the identity record and the vault entry, and decommissioning cleans both sides.

This separation means rotation, ephemerality, and policy enforcement live where they belong, while governance, ownership, and audit live in midPoint.

AI agents as a governed identity class

The fastest-growing NHI category is also the least governed. midPoint’s archetype model makes AI agents tractable:

  • Each agent gets a human owner and a documented purpose
  • The agent’s tool list and target systems are modeled as role assignments
  • Privilege escalation requires the same approval flow as a human role request
  • Periodic certifications attest that the agent still needs every entitlement it holds
  • Decommissioning the agent’s owning application triggers automatic clean-up

Gartner predicts that by 2028, at least 15% of daily workplace decisions will be made by AI agents. Each of those decisions traces back to an NHI with access to data. Governing that population the same way you govern people is not optional. It is the only model that survives audit.

A reference blueprint: NHIs in midPoint

For a typical enterprise starting from a midPoint baseline, the working blueprint is:

1. Discovery and inventory. Use midPoint’s resource shadows to pull every service account from Active Directory, Linux, databases, cloud IAM, and SaaS admin consoles. Tag each with its source system.

2. Archetype design. Define service-account, rpa-bot, ci-cd-credential, workload-identity, and ai-agent. Set required attributes and risk tiers.

3. Ownership assignment. Bulk-assign owners from application catalogues, CMDB, or where nothing exists, to the department head responsible for the target system. Make ownership mandatory.

4. Role modeling. Define birthright roles per archetype. Move ad-hoc entitlements into named roles. Apply SoD policies.

5. Vault integration. Connect the credential store. Wire creation, rotation, and revocation events both ways.

6. Certifications and outlier detection. Schedule NHI-specific campaigns. Turn on outlier detection. Make remediation automated, not a ticket queue.

7. Decommissioning rules. Build the JML triggers for application retirement and owner departure. Rehearse them.

Most organizations can stand up steps 1 to 4 within a single quarter on top of an existing midPoint instance. Vault integration and certifications follow in the next cycle.

Common mistakes to avoid

  • Treating NHIs as a discovery problem only. Inventory without governance is a spreadsheet that rots.
  • Building a separate “NHI platform.” A parallel system means parallel ownership, parallel audit, and parallel cost. midPoint already has the primitives.
  • Excluding service accounts from certification campaigns. This is the single most common audit finding.
  • Letting application teams self-manage their bots’ privileges without policy. That is how the 97-percent-over-privileged number was earned.
  • Treating AI agents as “just an integration” instead of an identity. They are identities. They have entitlements. They need owners.

The bottom line

Non-human identities are not a niche category any more. They are the majority of your identity population, they are the majority of identity-related incidents, and they are growing faster than your headcount ever will. The NHI access management market itself is forecast to grow from USD 9.45 billion in 2024 to USD 18.71 billion in 2030, at an 11.9% CAGR. That is the market following a problem that already exists, not creating one.

The good news is that midPoint does not require a new product, a new vendor, or a new program to govern this population. It requires the same IGA discipline you already apply to your workforce, extended to the identities that now outnumber them by 109 to 1.

Start your NHI governance journey

WeKnowIdentity helps organizations extend midPoint’s governance model to the full non-human identity population. That includes archetypes, lifecycle automation, certifications, vault integration, and AI-agent onboarding. If your midPoint deployment governs your workforce but not your service accounts, bots, and AI agents, that is the gap where your next incident will land.

Book a free NHI governance assessment

Related Resources

Sources

Microsoft Identity Manager (MIM) End of Support: Your Migration Options

by

Microsoft Identity Manager (MIM) extended support runs until January 2029. If your organization still relies on MIM for identity provisioning, now is the time to plan your next move.

MIM has served enterprises well for over a decade. But Microsoft has made it clear: MIM’s future is limited. The platform receives only security patches, no new features, and its architecture is fundamentally tied to on-premises Active Directory in an era where hybrid and cloud-first identity is the standard.

What happens after MIM?

Microsoft’s own recommendation is Microsoft Entra ID Governance for cloud-native organizations. But for enterprises with complex on-premises infrastructure, hybrid AD environments, and custom provisioning workflows, Entra ID Governance alone may not cover all use cases.

This is where open-source alternatives like Evolveum midPoint become compelling.

Why midPoint is a strong alternative

  • Full lifecycle management: joiner, mover, leaver automation with HR integration, just like MIM but without the deprecated architecture
  • ConnId connector framework: midPoint connects to the same targets MIM does: Active Directory, LDAP, databases, REST APIs, SOAP services, CSV feeds, and SCIM endpoints
  • No per-user licensing: midPoint is open source. You pay for implementation and support, not per-identity fees that scale with your organization
  • Modern deployment: runs natively on Kubernetes with GitOps-based configuration management, Helm charts, and full CI/CD pipeline support
  • Built-in governance: role-based access control, access certification campaigns, segregation of duties, and audit-ready compliance reporting for GDPR, NIS2, and ISO 27001

Planning the migration

A MIM to midPoint migration typically involves these phases:

1. Assessment: Map your current MIM configuration: management agents, sync rules, provisioning workflows, and custom extensions. Identify which connectors and business logic need to be replicated.

2. Architecture design: Define the midPoint deployment model (Kubernetes, Docker, or bare metal), HR source of truth integration, and connector architecture.

3. Connector development: Build midPoint ConnId connectors for each target system. Many standard connectors (AD, LDAP, database, CSV) are available out of the box.

4. Parallel operation: Run MIM and midPoint side by side during the transition period. Validate identity data consistency across both systems.

5. Cutover: Switch production traffic to midPoint with zero downtime. Decommission MIM.

The cost of waiting

January 2029 sounds far away, but enterprise identity migrations are complex projects. A typical migration takes 6 to 12 months depending on the number of connected systems and custom business logic. Starting in 2026 gives you comfortable runway. Starting in 2028 means rushing, cutting corners, and accepting risk.

Our experience with MIM migrations

At WeKnowIdentity, we have delivered 10+ enterprise midPoint deployments managing up to 1,000,000+ identities. Our founder holds four Evolveum midPoint certifications (Professional, Advanced, Deployment, Group Synchronization) and has hands-on experience with MIM migration projects.

We work across telecom, finance, government, healthcare, education, and technology sectors in Slovakia, Switzerland, Germany, Austria, and Poland.

Ready to plan your migration?

Contact us for a free initial assessment. We will evaluate your current MIM setup, map the migration path, and provide a realistic timeline and roadmap to midPoint.

Related Resources

Related: For a comprehensive side-by-side analysis of open source and commercial IGA platforms, read our full guide: midPoint vs Commercial IGA: Which Approach Fits Your Enterprise?

Why Migrate from SAP IDM to midPoint Before 2027

by

SAP Identity Management reaches end of maintenance in December 2027. If your organization relies on SAP IDM, the clock is ticking.

For years, SAP IDM has been a reliable workhorse for enterprise identity governance. But with SAP officially ending maintenance, organizations face a critical decision: migrate to a new platform or risk running unsupported identity infrastructure.

Why midPoint?

Evolveum midPoint is an open-source Identity Governance and Administration (IGA) platform that covers everything SAP IDM does, and more. No per-user licensing fees, no vendor lock-in, and a thriving community backed by professional support from Evolveum.

What makes the migration feasible

  • midPoint’s ConnId connector framework supports the same target systems SAP IDM connects to: Active Directory, LDAP, databases, REST APIs, SOAP services, CSV feeds, and SAP systems themselves
  • Role-based access control, access certification, and segregation of duties are built into midPoint’s core
  • midPoint runs on Kubernetes with GitOps-based configuration management, making it cloud-native from day one
  • The migration can be phased: run both systems in parallel during transition, with zero downtime cutover

The cost of waiting

Every month closer to the 2027 deadline narrows your options. Rushed migrations lead to gaps in compliance, broken provisioning flows, and security exposure. Starting now gives you time to properly map connectors, test role models, and train your team.

Our experience

At WeKnowIdentity, we have delivered 10+ enterprise midPoint deployments managing up to 1,000,000+ identities across telecom, finance, government, and technology sectors in Europe. Our team holds 4 Evolveum midPoint certifications and has hands-on experience with SAP IDM migration specifically.

Ready to plan your migration?

Contact us for a free initial assessment. We will evaluate your current SAP IDM setup and provide a realistic migration roadmap to midPoint.

Related Resources

Related: For a comprehensive side-by-side analysis of open source and commercial IGA platforms, read our full guide: midPoint vs Commercial IGA: Which Approach Fits Your Enterprise?

Open Source IAM vs Commercial Platforms: Why Enterprises Are Choosing midPoint

by

The identity and access management market is dominated by commercial vendors like SailPoint, One Identity, Saviynt, and Omada. But a growing number of enterprises are choosing open-source alternatives, with Evolveum midPoint leading the shift. Here is why.

The Cost Problem with Commercial IAM

Commercial IAM platforms typically charge per managed identity. For an organization with 50,000 identities, annual licensing alone can exceed EUR 500,000. Add implementation costs, annual maintenance, and mandatory upgrades, and the 5-year total cost of ownership often reaches seven figures.

This per-user model creates a perverse incentive: the more identities you manage (which is the whole point of IAM), the more you pay. Organizations managing contractors, partners, and machine identities alongside employees see costs escalate rapidly.

The Open Source Alternative

midPoint eliminates per-user licensing entirely. The software is free under the Apache License. You pay for:

  • Implementation: Consulting to deploy, configure, and integrate midPoint
  • Custom development: Connectors and extensions for your specific systems
  • Support subscription: Optional professional support from Evolveum
  • Training: Knowledge transfer to your internal team

After the initial implementation, ongoing costs are limited to support subscriptions and internal staff time. There are no surprise license renewals or per-user fee increases.

Feature Comparison: midPoint vs Commercial Platforms

The perception that open-source IAM means fewer features is outdated. midPoint offers enterprise-grade capabilities:

  • Identity lifecycle management: Full joiner/mover/leaver automation, equivalent to commercial platforms
  • Access certification: Scheduled and event-triggered review campaigns with remediation
  • Role management: RBAC, ABAC, role mining, and automatic role assignment
  • Segregation of duties: Policy-driven conflict detection and prevention
  • Audit and compliance: Comprehensive logging, exportable reports, SIEM integration
  • Connector framework: ConnId supports AD, LDAP, REST, SOAP, SCIM, databases, CSV, and custom targets
  • Self-service portal: Access requests, password reset, profile management
  • Organizational structure modeling: Complex multi-tenant and multi-org hierarchies

What Open Source Gets You That Commercial Does Not

No Vendor Lock-In

You own your identity platform. If you decide to change consulting partners, extend the platform, or fork the code, you can. With commercial platforms, your data and configuration are trapped in a proprietary format.

Full Transparency

midPoint’s source code is on GitHub. You can audit every line of code that processes your identity data. For regulated industries and government agencies, this transparency is not optional.

Community Innovation

Evolveum’s development is driven by real customer needs and community contributions, not shareholder expectations. Features are added because they solve real problems, not because they make good marketing slides.

Deployment Freedom

Run midPoint anywhere: Kubernetes, Docker, bare-metal, any cloud provider, or on-premises. No vendor-mandated infrastructure requirements.

When Commercial Still Makes Sense

To be fair, commercial platforms have advantages in specific scenarios:

  • You need the absolute largest pre-built connector library with zero custom development
  • AI-driven access recommendations are a critical requirement today (not in your roadmap)
  • Your organization requires a fully managed SaaS IGA solution
  • You have no internal IT capacity and need a vendor to manage everything end-to-end

The Trend Is Clear

With SAP IDM reaching end of maintenance in 2027 and Microsoft MIM extended support ending in 2029, thousands of enterprises must choose a new IGA platform. Many are discovering that the open-source path offers better economics, more flexibility, and no lock-in.

midPoint is not a compromise. It is a strategic choice.

Explore midPoint for Your Organization

WeKnowIdentity helps enterprises evaluate, implement, and optimize midPoint. We have completed 10+ enterprise deployments across telecom, government, finance, healthcare, and technology sectors. Contact us for a free assessment of how midPoint fits your environment.

Related Resources

Related: For a comprehensive side-by-side analysis of open source and commercial IGA platforms, read our full guide: midPoint vs Commercial IGA: Which Approach Fits Your Enterprise?

NIS2 Directive: How midPoint Helps You Meet Identity Security Requirements

by

The NIS2 Directive (Network and Information Security Directive 2) came into force across the EU in October 2024, significantly expanding cybersecurity obligations for essential and important entities. Identity and access management is a core requirement. Here is how midPoint helps you comply.

What NIS2 Requires for Identity Management

NIS2 Article 21 mandates that organizations implement “policies on access control and asset management” as part of their cybersecurity risk management measures. Specifically, entities must:

  • Implement access control policies based on the principle of least privilege
  • Manage privileged accounts with enhanced security measures
  • Maintain an inventory of critical assets and their access relationships
  • Ensure supply chain security, including third-party access governance
  • Report significant incidents within 24 hours of detection

midPoint Capabilities for NIS2 Compliance

Least Privilege Access Control

midPoint’s role-based (RBAC) and attribute-based (ABAC) access control ensures users receive only the permissions required for their job function. Automated joiner/mover/leaver processes adjust access instantly when roles change, eliminating stale permissions that violate least privilege principles.

Privileged Account Management

midPoint tracks and governs privileged accounts across all connected systems. Policies can enforce:

  • Separate privileged and standard accounts for administrators
  • Time-limited privileged access with automatic expiration
  • Mandatory approval workflows for privileged role assignment
  • Enhanced logging and monitoring of all privileged account activity

Asset and Access Inventory

midPoint maintains a real-time inventory of all identities, their role assignments, and the systems they can access. This inventory is always current because midPoint provisions and de-provisions access automatically. For NIS2 compliance, this means you can produce an accurate access map for any identity at any time.

Supply Chain Access Governance

Third-party vendors, contractors, and partners often need access to your systems. midPoint manages external identities with:

  • Separate lifecycle policies for external users
  • Automatic expiration dates on contractor accounts
  • Periodic access recertification for all external users
  • Immediate de-provisioning when contracts end

Incident Response Support

NIS2 requires rapid incident reporting. midPoint’s audit logs provide the evidence trail needed to:

  • Determine which accounts were compromised
  • Identify what data and systems the compromised accounts could access
  • Trace the timeline of access changes around the incident
  • Support forensic investigation with complete provisioning history

Who Must Comply?

NIS2 applies to a broad range of sectors:

  • Essential entities: Energy, transport, banking, health, water, digital infrastructure, ICT service management, public administration, space
  • Important entities: Postal services, waste management, chemicals, food, manufacturing, digital providers, research

Organizations in these sectors with 50+ employees or EUR 10M+ turnover are generally in scope.

Penalties for Non-Compliance

NIS2 introduces significant penalties: up to EUR 10 million or 2% of global annual turnover for essential entities, and up to EUR 7 million or 1.4% for important entities. Management bodies can be held personally liable.

Start Your NIS2 Compliance Journey

WeKnowIdentity helps organizations implement midPoint’s identity governance capabilities to meet NIS2 requirements. We assess your current access control posture, design compliant policies, and deploy automated governance workflows. Contact us for a NIS2 readiness assessment.

Related Resources