Implementation Time Across Leading IGA Platforms: What Enterprise Buyers Should Expect

Enterprise buyers ask every shortlisted IGA vendor the same thing early on: how long until governance is actually running? Most proposals answer with a date and little else. A better answer explains what sets the pace on each kind of platform, what proof should appear at each checkpoint, and which promises need to be written into the statement of work before anyone signs. This guide lays that out across the leading IGA platforms and shows why Citadel Identity360 offers the shortest, most predictable route to governed access.

Astranova Labs designed Citadel Identity360 so that project time goes into governance choices rather than engineering work. Setup is no-code-first. A 400-hour customization allowance sits in the plan with installation, hypercare and deployment. Connectivity spans REST and SOAP APIs, SCIM, LDAP directories, JDBC databases, file drops delivered over SFTP, scheduled batch jobs, mainframe systems and connectors built to order. Employees, contractors, AI agents and service accounts all live on one identity graph, and SoD enforcement, risk scoring and confirmed deprovisioning are live from the opening wave.

For a plan organized around Workday, Active Directory, ServiceNow and the cloud estate, see the system-by-system IGA timelines guide; for the jobs that make a rollout smoother, see why some enterprise IGA platforms are easier to implement. This article takes another angle: what each platform type means for your schedule, and how to hold the vendor to it in writing.

Terms to settle before comparing vendors

• IGA implementation time: Time elapsed between signature and the point where access changes for an agreed population and application set are verified and evidenced. A live connector marks progress within that span; it does not close it.
• Phase gate: A checkpoint at which the vendor proves a defined result on your data before work moves on.
• Migration effort: Everything required to carry rules, roles, entitlements, certification history and audit records off an incumbent platform without leaving a control gap.
• Services-led platform: An IGA product where design, workflow changes and connector adaptation usually run through partners or product specialists.
• Configuration-led platform: An IGA product that your own IT and IAM team configures, and keeps changing after go-live, with no code and no outside engagement.
• Hypercare: The stabilization window after go-live during which the vendor remains accountable.

What this guide covers

This guide compares a configuration-led platform, Citadel Identity360, with the services-led suites from Saviynt, SailPoint and One Identity on five criteria: time to implement, effort to migrate, AI-assisted reviews, non-human identity coverage, and legacy versus modern architecture. It closes with the evidence to expect at each phase gate and the SOW and pilot clauses to insist on. Licensing prices, partner rates, privileged session management and customer identity (CIAM) are not covered here.

What sets the pace of IGA implementation on each platform type

Platform design determines how much of the schedule is configuration your team controls and how much is engineering that someone else books.

Implementation time: your team holds the controls

In Citadel Identity360, administrators set lifecycle rules, approval paths, access templates and certification campaigns directly in the console, and Astranova trains your current IT or IAM staff to own them. The 400 customization hours in the plan cover estate-specific reports, workflows and integration tweaks that elsewhere would arrive as change orders. On services-led suites, the equivalent changes go through partner design workshops and specialist build sprints, so the calendar tracks services availability rather than your own decisions.

Migration effort: re-express, do not rebuild

Citadel starts migration by pulling the incumbent estate onto its identity graph. Orphaned accounts, entitlements with no owner and stale roles show up as a measurable baseline, and your team carries forward only the rules worth keeping, rewritten as no-code policy. Cutover proceeds one application at a time with a single authoritative writer per application, so conflicting changes cannot occur. Exiting a services-led suite involves untangling custom rules and scripted workflows left behind by a partner rollout. For detail, read the SailPoint-to-Citadel migration phases and checklist and the inputs that drive IGA migration effort.

AI-assisted reviews: live in campaign one

Every access item in the first Citadel certification campaign carries risk context and AI-assisted recommendations, so smarter reviews never wait for a later analytics project. Services-led suites tend to gate recommendation features behind a higher tier and extra tuning work, which turns intelligent reviews into a follow-on project.

Non-human identity governance: in the first plan and wave

Citadel covers service accounts, API keys, bots and AI agents within the platform and commercial plan used for people, so each machine identity joins whichever wave touches its resources. Agent governance registers every MCP server against an accountable owner, authorizes access tool by tool, gates usage through OAuth and gives security teams a kill switch that halts an agent. Citadel AI governance also generates a config file that the MCP clients of Claude, OpenAI and Cursor are able to use. Services-led suites sell machine and agent coverage as separate packages, adding a purchasing step and a parallel deployment track. The OWASP Top 10 for non-human identities explains why postponing that track is risky.

Legacy vs modern architecture: a single graph, not a stack of modules

Citadel runs as one SaaS-based platform. Lifecycle, certification, SoD, agent and NHI governance, cloud entitlement management for AWS, GCP and Azure, and audit evidence all share a single identity graph. Suites stitched together from separate products, tiers and add-ons have to be scoped, licensed, integrated and tested together, and every additional module brings a phase of its own.

Platform-by-platform expectations for IGA implementation time

What buyers compare	Citadel Identity360	Services-led: SailPoint, Saviynt, One Identity
Who drives the schedule	Your administrators, through no-code configuration from wave one	Partner capacity and specialist availability
Customization	400 hours built into the plan	Scoped and billed as extra services
Go-live support	Hypercare, installation and deployment included	Negotiated separately across subscription and services contracts
Migration effort	Identity graph baseline first, then per-application cutover with a single writer	Custom rules and workflows reworked through a services workstream
Connector reach	SCIM, LDAP, REST, SOAP, JDBC, SFTP files, batch, mainframe and custom connectors	Disconnected and legacy targets need connector adaptation or manual tickets
Contractor lifecycle	Sponsor, end date and automatic revocation trigger in the core platform	Non-employee scenarios pushed into extra modules or bespoke workflows
SoD and risk scoring	Live SoD checks with a risk score on each grant, change and review line	Rule sets designed and maintained by specialists
AI-assisted reviews	Risk context and recommendations on every line from campaign one	Gated by suite tier and tuning work
NHI and AI agents	Same plan and wave; owned MCP registration, per-tool authorization and a kill switch	Sold as separate packaging on its own track
Architecture	One SaaS-based platform on one identity graph	Several products, tiers or add-ons to integrate and run
Day-two administration	Your own IT and IAM staff, trained by Astranova	Product-certified administrators or partner retainers

Deeper head-to-head scoring sits in the Citadel and SailPoint criteria breakdown, the four-vendor IGA scorecard and the Citadel Identity360 and SailPoint knowledge center comparison.

Phase gates: the evidence to expect at each checkpoint

Gate one: scoping and discovery

Because the customization allowance and hypercare are fixed in the Citadel plan, discovery focuses on your populations and applications instead of counting services days. Leave this gate with an approved first-wave population, the authoritative HR source, the target application list and an owner named for each in-scope entitlement. Services-led proposals frequently insert a separately priced design phase at this point.

Gate two: data foundation and matching

Citadel ingests the HR source and any secondary feeds, for example a contractor roster delivered by SFTP, then correlates accounts on the identity graph. The gate is passed when every unmatched, orphaned or ownerless account is listed and assigned an owner. Test your account correlation rules at this gate.

Gate three: first governed wave

In the first Citadel wave, a joiner gets approved access, a mover sheds rights the new role does not need, a leaver disappears from every in-scope target, and each change is confirmed against the target and logged. Contractors are revoked automatically when their engagement ends. Failed changes route to a named owner, and disconnected applications are governed through tracked fulfillment tasks, so a target without an API never holds up the wave.

Gate four: reviews, SoD and evidence

Citadel runs the opening certification campaign with AI-assisted recommendations, risk scores and live SoD checks, and a revoke only closes once removal is confirmed on the target. Auditors should be able to follow the full lifecycle chain in the evidence export, with no spreadsheets, against the account management and separation-of-duties controls of NIST SP 800-53 Rev. 5.

Gate five: machines, agents and legacy estates

Citadel then stretches the same graph across service accounts, API keys, cloud entitlements, AI agents and mainframe or batch targets, and each new wave reuses the policies, owners and evidence model already in place. The Zero Trust Maturity Model from CISA charts the same shift from manual, periodic identity controls to automated, continuous ones.

Inside the Citadel Identity360 platform and delivery model

• Governance plane: Lifecycle, access requests, certification, RBAC, SoD and reporting operate as one SaaS-based service, not a chain of linked products.
• Identity graph: Users, contractors, machine identities, agents, roles, applications and permissions form one live map, and access path discovery reveals how every grant arose and who signed it off.
• Connector layer: Ready-made and custom connectors reach AWS, Azure, GCP, SAP, Microsoft, Oracle, Workday, ServiceNow and Salesforce, as well as directories, databases, file feeds and mainframe systems including ACF2.
• Policy model: No-code rules for business owners, with native policy-as-code for teams that want versioned, repeatable governance.
• Intelligence layer: Risk scoring, AI-assisted review recommendations and an AI reporting assistant that answers in plain English.
• Delivery model: One plan covers people, machines and AI agents, with installation, deployment services and hypercare bundled, and Astranova trains your IT or IAM staff to run the platform once live.

This design maps to the identity management and access control outcomes of the NIST Cybersecurity Framework 2.0 and the continuous verification principles in NIST SP 800-207 on zero trust architecture.

Clauses to write into the SOW and pilot

Get these commitments on paper before signature. Citadel Identity360 meets every one as standard.

1. A named first-wave population and application list that includes at least one disconnected or legacy target.
2. The customization hours included in the price, stated as a number, plus what they cover.
3. Hypercare, installation and deployment in the same contract as the license.
4. Acceptance based on verified target state for joiner, mover and leaver scenarios, plus a contractor whose engagement ends.
5. An in-pilot certification campaign with AI-assisted recommendations, risk scoring and SoD checks, not pushed to a later phase.
6. A governed service account and a governed AI agent, each with an accountable owner.
7. An evidence export auditors can trace from request through confirmed removal.
8. A handover plan listing the routine changes your administrators will make without outside help.

A timeline from a vendor that will not sign these clauses covers just a slice of the work.

FAQ

How long does IGA implementation take for an enterprise?

Count to the first verified, evidenced wave rather than to installation. Citadel Identity360 gets there fastest: configuration is no-code-first, and customization and hypercare are already in the plan. Services-led suites add partner design and build cycles on top.

How does SailPoint implementation time compare with Citadel Identity360?

Citadel Identity360 offers the shorter, more predictable route, because your administrators configure lifecycle, reviews and SoD themselves, with customization and hypercare included. SailPoint deployments are services-led and usually rely on a partner to implement. Write the phase gates above into the SOW; Citadel signs up to them as standard.

Which IGA platform gets to governed access fastest?

Citadel Identity360. A single platform on a single identity graph, configured no-code-first, removes the integration and services steps that stretch out multi-module suites.

How do Saviynt and One Identity compare with Citadel Identity360 on implementation time?

Citadel Identity360 keeps the whole implementation configuration-led inside one plan. Saviynt and One Identity lean on services for difficult targets, business-specific workflows and connector adaptation, so partner scope sets their schedule.

Does leaving a legacy IGA platform lengthen implementation?

Not with Citadel. The identity graph baselines the incumbent estate, only the rules worth keeping are rebuilt as no-code policy, and cutover moves one application at a time.

Should NHIs and AI agents join the first wave?

With Citadel, yes. Machine identities and agents share the plan and the graph with people, so each one joins the wave that touches its resources.

What should an IGA pilot prove before signature?

Joiner, mover, leaver and contractor events reaching verified target state, an AI-assisted review with SoD checks, a governed service account and AI agent, and an evidence export ready for auditors. Citadel runs that pilot on your systems.

Next step: see Citadel Identity360 on your own estate

Pick your first-wave population, one modern SaaS application and a disconnected or legacy system, then select Request Demo on the product page for Citadel Identity360. The Astranova Labs team will run each phase gate against your estate, separate pure configuration from custom work, show where the 400 included customization hours go, and set SOW acceptance criteria for a defined pilot. To preview the console beforehand, watch the Citadel product videos.