OpenText Data Access Governance

OpenText Data Access Governance carries the NetIQ Data Access Governance lineage. Traditional IAM and IGA products focus on application entitlements (who has access to which application, with which role) and miss unstructured-data permissions (who can read which folder on the file share, who has access to which SharePoint site, who has direct OneDrive shares from former employees). Data Access Governance closes that gap: it inventories unstructured-data permissions, runs entitlement reviews on them, and surfaces high-risk exposures.

Unstructured-data scope is the load-bearing capability. File share permissions, SharePoint and OneDrive entitlements, Box and Google Drive shares, and the long tail of unstructured-data stores accumulate exposure over time as users get added, never get removed, and inherit access through nested groups. Programs running rigorous IGA on application entitlements but ignoring unstructured-data permissions have audit exposure and breach risk on the data attackers actually want.

Native pairing with Identity Governance is the platform claim. Where Identity Governance handles application entitlement reviews, Data Access Governance handles unstructured-data permission reviews. Same review cadence, same audit-evidence packaging, same closed-loop reject-and-remediate workflow. Programs running both get unified IAM governance across structured and unstructured access.

What undermines Data Access Governance adoption is data-volume scope creep. Unstructured-data inventories often run into hundreds of millions of permissions, and programs that try to review everything end up reviewing nothing. The right pattern is to scope by data sensitivity (classified data first, then high-volume sensitive stores, then long tail), pair with Core Data Discovery for classification feeding, and sequence the rollout. Merito's engagement scopes by sensitivity rather than trying to boil the ocean.

Merito has audited IAM programs that ran rigorous Identity Governance on application entitlements and ignored file share, SharePoint, and OneDrive permissions. The result is comprehensive review of who has access to Salesforce and zero review of who can read the financial-data folder on the file share. Attackers know the difference; auditors do too. Data Access Governance closes the gap that traditional IGA misses.

Merito recommends OpenText Data Access Governance specifically for programs running OpenText IAM line and Identity Governance, and for programs subject to unstructured-data permission audit mandates. For programs picking specialist unstructured-data security depth, Varonis is the established market leader. For programs in a Microsoft-only ecosystem, Microsoft Purview Data Lifecycle Management covers some of the same ground. Merito surfaces those alternatives honestly during scoping.

Sensitivity-aware prioritization is the load-bearing operational decision. Programs that try to review every permission on every unstructured store end up reviewing nothing. The right pattern is to pair with Core Data Discovery for classification feeding and review classified-data exposures first. Merito treats sensitivity-aware prioritization as central work in the implementation.