In most enterprises, the person who provisions a new employee's laptop login is not the same person who issues their door badge, and the two systems rarely talk to each other. That gap feels administrative until an employee leaves the company: IT disables the network account the same day, but the physical badge - managed by a different team, on a different system - can stay active for weeks. Our identity and access management approach exists specifically to close that gap.

In this article
  1. The problem with siloed IT and physical security
  2. What "unified" or "converged" IAM actually means
  3. The joiner-mover-leaver risk
  4. How convergence works technically
  5. Getting started

Key takeaways

  • Siloed IT and physical access teams commonly leave "orphaned" credentials active after someone leaves or changes roles - a direct security gap, not a hypothetical one.
  • Unified IAM means one identity record drives both the login and the badge, through a shared joiner-mover-leaver process.
  • Convergence is primarily an integration and process change, not a full hardware replacement.
  • The security benefit compounds with scale: a single-site office feels this gap rarely, a multi-site enterprise feels it constantly.

1The Problem with Siloed IT and Physical Security

Physical security and IT security evolved as separate disciplines, run by separate teams, buying separate systems, and reporting up separate chains. That separation made sense when a badge only opened a door and a login only opened a laptop. It makes far less sense now that both are, functionally, the same thing: a credential that grants an identified person access to a resource. When the systems stay siloed, the processes around them stay siloed too - and deprovisioning is where that shows up first.

2What "Unified" or "Converged" IAM Actually Means

Converged IAM means an employee's digital login and physical badge draw from the same identity record, managed through the same lifecycle. When HR marks someone as terminated in the source system, both the network account and the badge deactivate from that single event - not from two separate manual steps performed by two separate teams on two separate timelines. Our HID access control platform is built to integrate with standard identity providers for exactly this reason.

3The Joiner-Mover-Leaver Risk

"Joiner-mover-leaver" is the standard IAM term for the three moments access needs to change: someone joins, someone changes role, someone leaves. Orphaned access - a credential still active after it should have been revoked - is one of the most common findings in any access control audit, and it is almost always a joiner-mover-leaver process failure rather than a technology failure. A badge that should have been deactivated when someone transferred departments, or a login that should have been downgraded when someone changed roles, is exactly the kind of gap that stays invisible until an incident forces a review.

4How Convergence Works Technically

In practice, convergence means connecting your access control platform to your identity provider (Active Directory, Azure AD, or an equivalent HR-driven system) so that a single employee record controls both systems. Our Honeywell Pro-Watch and HID Amico integration is one example of this pattern in practice - biometric access control tied to the same identity governance as IT systems, rather than running as a disconnected front-desk tool. This does not typically require replacing existing door hardware; it requires an integration layer and a governance process change.

Getting Started

Audit first: before integrating systems, run a joiner-mover-leaver audit to find how many currently active badges and logins belong to people who have left or changed roles. That number is usually the strongest internal case for convergence.

Start with the highest-risk sites: data halls, executive floors, and any facility with regulated access should be the first to move to a unified identity source, not the last.

Involve both teams from day one: convergence fails when it is treated as an IT project imposed on facilities, or a facilities project IT is not consulted on. Our security integration team typically starts by getting both teams in the same room before touching either system.

Frequently Asked Questions

What does "converged" or "unified" IAM actually mean?

It means an employee's IT login and their physical badge are managed through the same identity record and the same joiner-mover-leaver process, rather than as two separate systems maintained by two separate teams that can drift out of sync.

What is orphaned access, and why is it a risk?

Orphaned access is a credential - a badge, a login, or both - that remains active after someone leaves the organisation or changes roles, because the deprovisioning step was missed. It is one of the most common findings in security audits and a direct route for unauthorized access, physical or digital.

Do we need new hardware to unify IAM and physical access control?

Not necessarily. Convergence is primarily an integration and process change - connecting your existing access control platform to your identity provider so both draw from one employee record - rather than a full hardware replacement.

Close the Gap Between IT and Physical Access

Tektronix Technologies designs converged identity and access management for enterprises across Saudi Arabia, connecting physical access control to your existing identity provider. Browse our identity and access management approach, see it in practice with our Honeywell Pro-Watch & HID Amico integration, or talk to a specialist about auditing your current joiner-mover-leaver process.