SECURITY ATLAS / EVALUATION BRIEF Oracle OCI IAM / Identity Governance Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/oracle-identity/ THE ATLAS TAKE Atlas judgment: Oracle identity is a practical starting point for organizations whose access problem centers on OCI and Oracle applications. The current identity-domain model provides a defined container for users, federation and application security settings, while Access Governance addresses review of standing access. Those functions should remain distinct in the evaluation. A cloud administrator authenticating successfully does not prove they have only the intended resource permissions, and a governance review does not itself terminate every application session. Scope native OCI IAM, identity-domain type and adjacent governance explicitly, then test the target business role across the actual applications and compartments. SCOPE This profile covers native Oracle Cloud identity domains plus adjacent identity governance. It is not a generic customer-identity suite for non-Oracle applications unless those connections are in scope. Confirm identity-domain versus Identity Governance packaging on the quote. WORTH A LOOK WHEN Oracle-centered estates needing coordinated OCI access and separately scoped governance of application entitlements. THINK TWICE WHEN The project assumes an identity-domain administrator automatically governs every OCI resource or that native IAM includes the full governance portfolio. IMPLEMENTATION 1. Map populations and domain authority Choose the relevant domains, external identity sources and administrators for production and non-production users. 2. Model least privilege in resource policy Translate actual job tasks into scoped OCI permissions and test both authorized and prohibited actions. 3. Add governance deliberately Connect required applications, define entitlement owners and verify that a review decision reaches the target. OPERATING REALITY Identity-domain administration, tenancy resource policies and application entitlement ownership are related but different duties. Atlas would review them together during onboarding and termination, while keeping the administrators distinct where required; errors often occur at the handoff between authenticating a user and authorizing a resource action. COMMERCIAL CONSIDERATIONS Oracle’s domain-type matrix and governance product scope should inform a quote that separates native access needs from premium and review capabilities. - Identity-domain type, features and limits - Access Governance and other selected identity modules - Application integration and policy administration EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Separate identity and resource authority Acceptance evidence: Give a synthetic domain administrator a scoped lab role and prove whether the intended OCI resource action is permitted or denied. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Validate the chosen domain tier Acceptance evidence: Exercise required federation, application and recovery features in the actual selected domain type, recording any limit or upgrade dependency. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Close an access review Acceptance evidence: Revoke a fictional Oracle application entitlement through the selected governance path and verify target-side removal and remaining sessions. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Does the quote cover Oracle Cloud identity domains, Oracle Identity Governance, Access Governance, or a combination, and which tenant uses which? - Which non-Oracle applications will actually federate to the identity domain in the lab? - How does historical Identity Cloud Service naming map to the identity-domain SKU you would operate today? EVIDENCE GAPS - No independent resource-policy, governance-completeness or lifecycle-timing test was performed. - Confirm the tenancy’s identity-domain generation, chosen domain meter and the exact governance product in the agreement. SOURCES OCI IAM with identity domains overview (Documentation) https://docs.oracle.com/en-us/iaas/Content/Identity/getstarted/identity-domains.htm OCI identity-domain types and limits (Documentation) https://docs.oracle.com/en-us/iaas/Content/Identity/sku/overview.htm Oracle Access Governance (Product information) https://www.oracle.com/security/cloud-security/access-governance/ Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.