Is IAM getting more complex than secure?

Lately, it feels like Identity and Access Management is becoming more complex with every new tool and integration.

Between SSO, MFA, PAM, conditional access policies, non-federated apps, and constant compliance requirements, managing identities is no longer just about provisioning and deprovisioning users.

I am curious how teams here are handling:

• Access reviews without creating audit fatigue
• Managing identities in non-integrated or legacy apps
• Balancing user experience with strict security controls
• Reducing privilege creep over time

Do you feel modern IAM strategies are actually improving security posture, or just adding operational overhead?

Would love to hear real-world insights from people dealing with IAM daily.