How to Evaluate Migration Effort When Replacing Legacy IGA Platforms

IGA migration effort is the question that stalls most legacy replacement programmes, because no one can say how hard the move will be until the work is already underway. A legacy IGA migration effort evaluation fixes that by scoring the estate before a platform decision is signed. This guide gives CIOs and Heads of IT a rubric with eight effort dimensions, plain low, medium and high levels for each, and a clear view of how Citadel Identity360 pulls every score down compared with heavier, services-led replacement paths.

The rubric turns a vague sense of migration risk into a scored picture your steering committee can act on. The same estate earns different scores against different destinations, so the target platform belongs in the scoring, and Citadel Identity360 is designed so most dimensions land lower from day one.

Why a single migration estimate hides the real work

A single effort figure hides where the work actually sits. Two estates with the same application count can face very different migrations: one has clean HR feeds and SCIM-ready SaaS, the other has mainframe accounts, scripted approvals and years of exception-heavy reviews. A rubric separates those drivers so each can be owned and reduced.

Our guide to IGA migration calculator inputs explains which raw inputs feed an effort range. This rubric comes next. It grades each input against observable evidence rather than proposal assumptions.

Rubric vocabulary for the scoring workshop

• Effort dimension: One independent driver of migration work, such as connector mix or SoD rule sets, scored on its own.
• Effort level: A low, medium or high grade assigned from evidence, not opinion.
• Weight tier: Whether a dimension is critical or standard, set by regulatory exposure and business impact.
• Account correlation: Matching application accounts to the right person, contractor or non-human owner.
• Disconnected application: A system with no live connector, governed through files, tickets or batch feeds.
• Evidence continuity: The ability to answer an auditor about any period before, during and after cutover without gaps.
• Parallel run: A window where both platforms observe the estate before the new one starts writing changes.

What the rubric grades and what it leaves aside

Graded: the eight effort dimensions below, the low, medium and high level definitions for each, how weight tiers change the reading, and how a target platform raises or lowers each score.

Left aside: licence pricing, single sign-on and access management migration, privileged session tooling, and step-by-step cutover runbooks. For phase-by-phase execution, use our SailPoint migration phases, risks and checklist guide.

Why Citadel Identity360 pulls effort scores down

Citadel Identity360 governs cloud, SaaS and on-premises target systems from one console, matching the identity-centric approach described in the CISA Zero Trust Maturity Model. Every connected source feeds one identity graph holding people, contractors, service accounts and AI agents with their access. Policy, certification, SoD analysis and evidence capture all read from that graph, so no separate analytics store needs rebuilding.

Lifecycle rules, approval chains and review campaigns are built in a no-code designer your IAM team can read and change, rather than as scripts only a partner understands. For the parts of your estate that are genuinely unusual, the subscription carries roughly 400 hours of customization, so awkward legacy feeds become planned work rather than change orders.

Eight effort dimensions to grade on evidence

Score each dimension on evidence. No evidence means a high score.

Dimension: target protocols and connector mix

What to measure: every target system, the protocol it speaks and whether the legacy platform reads only or also writes.

• Low: mostly SCIM and REST targets with documented APIs.
• Medium: a blend of LDAP directories, databases and SaaS, with a few file-based feeds.
• High: mainframe, SFTP drops, batch jobs and home-grown applications with no API.

How Citadel lowers it: Citadel ships connector types for SCIM, REST and SOAP APIs, LDAP directories, JDBC databases, flat-file and SFTP drops, batch jobs, mainframes and custom sources, so a wide protocol mix becomes a setup task rather than a build.

Dimension: role sprawl and entitlement structure

What to measure: role count against headcount, nesting depth, and how many entitlements sit outside any role.

• Low: a compact role model with named owners.
• Medium: overlapping business and technical roles, some without owners.
• High: role explosion, deep nesting and widespread direct assignments.

How Citadel lowers it: the identity graph shows effective access per person before roles are recreated, so teams carry forward only the roles that still match how people work and retire the rest.

Dimension: scripted workflows and custom code

What to measure: scripted rules, custom approval logic and bespoke provisioning code in the legacy platform.

• Low: standard request and approval flows.
• Medium: a moderate library of custom rules, mostly documented.
• High: large volumes of undocumented code written by departed staff or partners.

How Citadel lowers it: Citadel swaps most scripted behaviour for designer-built workflows, and its bundled customization time handles the remainder. Code debt is retired, not ported.

Dimension: certification history and revocation proof

What to measure: campaign types, reviewer populations, open remediation items and how revocations were confirmed.

• Low: a few campaign types with closed-loop revocation.
• Medium: many campaign variants with partial revocation tracking.
• High: rubber-stamped reviews and revocations that were never verified.

How Citadel lowers it: Citadel campaigns show reviewers AI-assisted recommendations and risk context for each item, and revocations are tracked to confirmed removal, so the new programme starts cleaner than the history it inherits.

Dimension: SoD rules and identity risk scoring

What to measure: the number of toxic-combination rules, where they live and whether they span applications. Separation of duties is a named control (AC-5) in NIST SP 800-53, so auditors will test it.

• Low: a short, documented rule set inside one or two systems.
• Medium: cross-application rules maintained in spreadsheets.
• High: rules buried in code, ERP-specific tools and auditor memory.

How Citadel lowers it: SoD conflict detection and identity risk scoring run on the graph across every connected system, so rules are defined once and evaluated everywhere in real time.

Dimension: contractors, machine accounts and agents

What to measure: contractors outside HR, service accounts, API keys, workload identities and AI agents without owners. The OWASP Non-Human Identities Top 10 ranks improper offboarding as the leading machine-identity risk.

• Low: contractors sourced from one system and few machine accounts.
• Medium: several contractor sources and a partial service-account inventory.
• High: sponsor-less contractors, orphaned machine accounts and unregistered AI agents.

How Citadel lowers it: Citadel governs contractor lifecycle with sponsors and end dates, manages non-human identities from creation to decommissioning, and brings AI agents under agent and MCP governance where each agent is registered with an owner, authorized tool by tool and can be shut off instantly with a kill switch. Citadel’s AI governance produces a config file that Claude, OpenAI and Cursor MCP clients can use.

Dimension: continuity of audit evidence

What to measure: how long legacy evidence must be retained and which controls auditors test each cycle, mapped to a framework such as the NIST Cybersecurity Framework.

• Low: short retention and a small set of tested controls.
• Medium: multi-year retention across several frameworks.
• High: overlapping regulatory regimes with open audit findings.

How Citadel lowers it: Citadel captures verified deprovisioning and review decisions as audit-ready evidence from the first day it observes the estate, so the evidence trail continues while legacy archives are retained.

Dimension: cutover tolerance and parallel observation

What to measure: which applications cannot tolerate a missed joiner or leaver, and how long both platforms must observe together.

• Low: few critical systems with tolerant business owners.
• Medium: a handful of regulated or revenue systems.
• High: round-the-clock operations with no tolerance for access gaps.

How Citadel lowers it: Citadel observes in read mode, reconciles against legacy decisions and takes over writing one wave at a time. Our safer legacy IGA migration plan covers how waves are sequenced.

Effort scorecard: Citadel Identity360 versus services-heavy suites

Use this sheet in the evaluation workshop.

Effort dimension	Citadel Identity360 effect on the score	Services-led platforms (SailPoint, Saviynt, One Identity)
Connector reach	SCIM, REST, SOAP, LDAP, JDBC, file, SFTP, batch, mainframe and custom sources feeding one graph	Legacy and disconnected targets often require partner-built connectors or manual tasks
Role and entitlement model	Effective access visible in the identity graph before roles are rebuilt	Role redesign typically scoped as a separate services workstream
Custom workflow and code debt	Designer-built workflows, with roughly 400 customization hours in the subscription	Custom rules and scripts often carried forward and maintained by partners
Certification history	AI-assisted recommendations and revocations tracked to confirmed removal	Campaign rebuilds commonly depend on implementation services
SoD and risk scoring	Cross-system SoD detection and identity risk scores in real time	Cross-application SoD frequently needs add-on modules or extra configuration effort
Contractor lifecycle	Sponsors, end dates and verified removal for non-employees	Contractor sources often handled through custom onboarding work
Non-human and AI-agent identities	NHI lifecycle, MCP server registry, per-tool agent permissions and an instant kill switch	Machine and agent governance typically added as separate scope
Audit evidence continuity	Verified deprovisioning and review evidence captured from first observation	Evidence continuity usually assembled across tools during cutover
Cutover and parallel run	Read-mode observation, reconciliation and wave-by-wave takeover	Big-bang or long partner-led cutovers are common

For the full vendor head-to-head beyond migration, see our Citadel, SailPoint, Saviynt and One Identity side-by-side comparison.

Weighting each dimension by business impact

Assign each dimension a weight tier before scoring, so the reading is not skewed by whichever is easiest to measure.

• Critical tier: dimensions tied to regulators, auditors or revenue systems. For a bank this is usually SoD and audit evidence continuity. For a manufacturer with plants, it is often connector reach and cutover.
• Standard tier: dimensions that add work but do not threaten compliance or operations if they slip.

Then read the rubric with three rules:

1. Any critical dimension scored high sets the shape of the whole programme and should be addressed in the first wave.
2. Several standard dimensions scored medium usually point to setup work that the bundled Citadel customization time absorbs.
3. A dimension you cannot evidence stays high until the inventory proves otherwise.

Score the estate twice, once against Citadel Identity360 and once against the services-led alternative. The gap shows how much effort the platform choice itself removes.

A single facilitated scoring workshop

Score in a single facilitated session with the owners of each dimension.

1. Invite the IAM lead, the owner of your hardest application, internal audit, vendor management and the cloud team.
2. Bring the connector list, role export, code inventory, last campaign report, SoD rule register and audit calendar.
3. Score each dimension low, medium or high and record the evidence behind each grade.
4. Agree the weight tiers and flag every critical dimension scored high.
5. Grade again assuming Citadel Identity360 as the destination and note which levels drop and why.

If you are moving off SailPoint specifically, pair this session with our SailPoint to Citadel planning considerations so role and policy translation is scored with the right context.

Migration scoring questions from CIOs

Where should a legacy migration effort assessment start?

Score eight dimensions, from connector mix and custom code to SoD rules and cutover needs. Grade each low, medium or high on evidence, weight them by business impact, then grade the estate again assuming Citadel Identity360 as the destination.

Which signals push a migration score toward high?

High scores come from undocumented code, deep role nesting, spreadsheet SoD rules, disconnected systems and unowned machine accounts. Citadel lowers each of these through no-code configuration, broad connector reach and graph-based analysis.

Should the rubric run before a vendor shortlist is final?

Yes, and you should. Score the current estate first, then re-score against each shortlisted platform. Citadel Identity360 drops the most dimensions because its connectors, workflows and SoD analysis are configured rather than coded.

In what ways does Citadel cut legacy replacement effort?

Citadel brings one identity graph, no-code workflows, connectors from SCIM to mainframe, contractor and non-human identity lifecycle, cross-system SoD and risk scoring, plus roughly 400 customization hours in every subscription.

Should the effort score include bots, keys and agents?

Yes. Service accounts, API keys and AI agents rarely have owners in legacy platforms. Citadel gives each one an accountable owner, scoped permissions and an instant off switch, which turns a high-scoring dimension into a governed one.

Can audit evidence survive the move off a legacy platform?

Retain legacy archives for their required period and capture evidence in Citadel from the first day it observes the estate, so verified deprovisioning and review records continue without a gap.

Bring your estate to a Citadel scoring session

Bring your connector list, hardest legacy application and last certification report, then select Request Demo. Astranova Labs will walk your team through the eight-dimension rubric live, re-score each dimension against Citadel Identity360 and show where the effort drops. Want a first look? Preview the console in the Citadel Identity360 videos.