Overview#
A SaaS platform serving forty enterprise customers runs Zitadel as its cloud IAM layer. Over six months, service account counts have grown from forty to over two hundred as development teams add automation jobs without centralised review. Nobody has a complete picture of which service accounts are active, what they can access, or whether some have silently accumulated more permissions than they should. Zitadel Cloud IAM Integration surfaces that picture: organisation state, project scope, service account posture, and provider health are all visible and manageable from one governed workspace.
Cloud-native identity brings unique governance challenges that traditional on-premises tooling was never built to handle. Technology companies, digital government services, and financial technology platforms running Zitadel in multi-environment deployments need the same operational discipline that legacy IAM administrators apply to on-premises systems.
Key Features#
- Organisation and Project Governance: Manage external identity organisations and the projects that shape their access model. Changes are tracked with timestamps and operator attribution so governance reviews can reconstruct the history of access decisions.
- Service Account Oversight: Review machine-user posture alongside human identity state to reduce hidden persistence risk. Service account growth trends and permission scope are surfaced before they become hidden pathways for lateral movement.
- Provider Health and Trust Monitoring: Track the readiness of external identity connections and related token-validation posture. Degraded provider health is flagged before user-facing authentication failures emerge.
- Role and Group Alignment: Keep organisation structure and entitlement logic aligned to local operational roles. Alerts fire when external changes introduce mapping gaps that would affect user access.
- Administrative Visibility: Surface the key state, growth, and drift signals identity teams need for cloud IAM control, without requiring direct Zitadel console access for routine oversight.
- Multi-Environment Governance: Manage separate environments (development, staging, production) with consistent identity administration rather than isolated manual review per environment.
- Operational Access Assurance: Detect unhealthy trends or unusual changes before they become access disruptions or security incidents.
Use Cases#
- Cloud IAM Governance: Run Zitadel-backed identity operations with clearer control over organisations, projects, and service accounts across the full estate.
- Service Account Review: Monitor machine-user growth and permission posture in environments where service accounts accumulate without sufficient oversight.
- Tenant Identity Oversight: Maintain visibility into identity posture across multiple customer or organisational environments from a single administrative workspace.
- Access Drift Detection: Identify unusual shifts in provider state before user-facing access failures emerge, catching configuration drift early.
Integration#
- Identity Administration Workspace and enterprise authentication services
- SCIM, SAML, OIDC, and tenant-governance workflows
- Access-review, analytics, and health-monitoring systems
- Role and permission management backed by PostgreSQL as the primary store
Open Standards#
- OpenID Connect (OIDC): Zitadel is an OIDC-native IAM platform; this module monitors and governs the OIDC identity provider connections that Zitadel federates, including their readiness and token-validation posture.
- OAuth 2.0 / Bearer Token (RFC 6749 / RFC 6750): All calls to the Zitadel Management API are authenticated with an OAuth 2.0 Bearer access token supplied as a service account credential or Personal Access Token.
- SAML 2.0: The module surfaces and monitors SAML-based external identity providers configured within Zitadel, tracking their health and mapping alignment alongside OIDC providers.
- SCIM (System for Cross-domain Identity Management): SCIM workflows are listed as a direct integration point for tenant-governance operations, enabling machine-readable identity provisioning alongside the managed sync.
- JSON Web Token (RFC 7519): Service account and Personal Access Tokens issued by Zitadel are JWTs; the module handles these tokens for API authentication and records their provenance in the audit trail.
- GraphQL: The entire query and mutation surface for organisations, statistics, and sync operations is exposed as a typed GraphQL API via Strawberry, consumed by the Identity Administration Workspace.
- JSON (RFC 8259): All data exchanged with the Zitadel Management API is serialised as JSON; the module parses and persists these payloads as the canonical record of identity state.
Last Reviewed: 2026-03-25 Last Updated: 2026-04-14