Omada Identity Cloud

Automated joiner, mover, and leaver processes for workforce and workload identities, including AI agents, that create, change, and revoke identities and their access across connected systems, correlating identity and application data from multiple authoritative sources (HR, directories, contractor systems) into one identity record.

Automated fulfillment of access changes to target systems through prebuilt out-of-the-box connectors (for example SAP, Workday, Microsoft 365), purpose-built custom connectors for homegrown platforms, and standards-based provisioning (SCIM 2.0), with ITSM ticket-based manual fulfillment as the fallback for applications no connector reaches.

Access review campaigns in which reviewers attest to or revoke access for workforce and workload identities, including AI agents, down to the entitlement level. Certifications are event-triggered (a transfer, a risk change, a new entitlement) as well as scheduled, and risk context and recommendations are surfaced so reviewers act on exceptions instead of rubber-stamping every line.

Defines static segregation-of-duties rules as conflicting roles and entitlements, blocks toxic combinations at request time, and continuously monitors for SOD violations with alerts and mitigating-control tracking. Static SOD became a mandatory IGA capability in 2026; predictive dynamic SOD analysis is a separate feature.

Descriptive and diagnostic analytics over identity and access data: scores each identity's risk from its entitlements, peer-group outliers, orphaned and dormant accounts, and SOD exposure, and feeds those scores into certification prioritization and remediation. Predictive and prescriptive recommendations belong to AI-Assisted Identity Governance.

Role mining, modeling, and administration to standardize access through roles.

Self-service access request catalog with configurable, policy-driven approval workflows.

Continuously discovers entitlements across applications and systems, reconciles them against what is actually granted in each target, and enriches each entitlement with a description, owner, and risk level so requesters and reviewers understand what they are approving. Fine-grained runtime entitlements are covered by Fine-Grained Authorization Policy Orchestration.

Applies predictive and prescriptive analytics and AI assistants to governance decisions: recommends approvals and certification outcomes, proposes role and policy models from access patterns, flags anomalous access for review, and answers natural-language questions about who has access and why. Distinct from Identity Analytics and Risk Scoring, which supplies the descriptive risk scores these recommendations build on.

Registers and manages identities and profiles for nonemployee, contractor and business-partner populations not held in another authoritative source.

Produces audit evidence mapped to specific regulatory mandates (NIS2, DORA, SOX, GDPR, HIPAA): automated regulation-specific reports, scheduled and ad hoc exports, and immutable audit trails that demonstrate continuous audit readiness rather than point-in-time evidence collection. Basic access reporting is table stakes; assign only when controls are mapped to named regulations.

Grants entitlements for a defined, limited period and automatically revokes or re-reviews them when the period expires, so temporary, project-based, and elevated access does not accumulate as standing entitlements.

Governs workload identities (service accounts, applications, containers, RPA bots, and AI agents) and their accounts through the same lifecycle, ownership, certification, and policy controls as workforce identities: assigns a business sponsor and technical owner, records purpose, and removes the identity and its access when it is no longer justified.