As Oracle Fusion SaaS adoption grows across regions, one question consistently surfaces in customer conversations: how are you achieving identity Governance for Oracle Fusion & SaaS? As I speak with customers across regions about identity challenges in their SaaS environments, identity governance remains a common theme, including strong authentication, visibility into who has what access, and processes that can support audit and compliance efforts.
The percentage of Oracle Fusion SaaS customers adopting Governance, Risk, and Compliance (GRC) modules varies. This reflects the increasing focus on compliance, data security, and risk management in HR processes, finance controls , access controls, audit trails, and processes designed to help address applicable industry and organizational requirements.
I have written about OAG for Cloud & Enterprise applications in the past here .This blog is more focused on Oracle Fusion and SaaS world.As we continually assess the risk and strengthen the security baseline, identities become the important layer that can put organizations at risk. So, how can organizations strengthen identity governance across a continuously evolving on-premises and cloud application landscape? Is having GRC or Oracle Risk module will be sufficient?
Let’s discuss how Oracle Access Governance help address identity governance and compliance-related processes and strengthen identity landscape for Fusion customers.
| The question this blog answers: Whether you have GRC or Oracle Risk Management Cloud or not — how does Oracle Access Governance (OAG) help you govern, automate, and support compliance efforts for your Oracle Fusion/SaaS environment. |
Before OAG vs. After OAG —The Identity Governance Picture
The tables below illustrate possible identity-governance approaches for customer environments.
(Note:The following is an illustrative comparison. Available capabilities and levels of automation depend on the connected application, configuration, and customer environment)
Example identity-governance approaches;
● Without Oracle Access Governance
● With Oracle Access Governance
5 Key Reasons Oracle Fusion/SaaS Customers Need OAG
1 — Identity Management: Automate the Joiner-Mover-Leaver Process
Managing the identity lifecycle manually across Fusion HCM, ERP, OTM, and EPM creates provisioning delays, orphaned accounts, and audit exposure. OAG can use HCM as an authoritative source to help automate joiner, mover, and leaver processes for supported connected systems.
| Illustrative scenario — Employee Transfer( Finance → Procurement): An employee in the Finance team moves to Procurement. In HCM, their assignment changes. OAG detects the change on the next data load, automatically deprovisions their AP Approver role in Fusion ERP, and provisions the correct Procurement role with the right Business Unit security context. The manager receives a notification. |
- Joiner: New HCM hire triggers automatic account creation and role assignment across Fusion apps based on job code and BU
- Mover: Role or department change in HCM triggers automatic access update — old access removed, new access added
- Leaver: Termination in HCM can trigger deprovisioning actions across supported connected systems, helping reduce the risk of orphaned accounts
- Security context & Area of Responsibility: When OAG provisions a Fusion ERP role, it does not stop at the role name. Through outbound transformation rules, OAG simultaneously sets the correct data security context — Business Unit, Ledger, and Data Access Set — helping establish the user’s Assignment of Responsibility with the configured scope
- Orphan detection: flags accounts where the HCM person record is gone but the Fusion/OCI account remains active
Think of it like this:
- Role = What you can do
- Security Context = Where / on which data you can do it
The statement:“Manage provisioning of FA Job-Roles with Security Context”means:
- 👉 OAG doesn’t just assign roles…
👉 It also controls the data scope attached to that role
2 — Access Reviews & Re-certification: Replace Spreadsheets with Automation
Organizations that rely on spreadsheet-based access reviews may face time-consuming manual processes and fragmented review records. Oracle Access Governance provides certification campaigns that can help automate access-review processes.
| Illustrative scenario— Quarterly ERP access review: An organization conducting a periodic access review for a large number of Fusion ERP users can use Oracle Access Governance certification campaigns to help automate review workflows. Managers can review relevant access information and record approval or revocation decisions in Oracle Access Governance. For supported integrations and configurations, remediation actions can be written back to the connected application. Review activity and decisions are recorded to help support audit and compliance processes. |
- Automated campaign creation — scheduled quarterly, monthly, or event-triggered
- Manager, application owner, and CISO reviewer personas in one unified interface
- AI/ML-driven recommendations — OAG flags users whose access differs from their peer group
- Write-back — for supported integrations and configurations, revocation decisions can initiate removal of applicable roles
- Audit trail — records decisions, justifications, and timestamps that can help support audit and compliance processes
- Micro-certifications — targeted reviews triggered by role changes, project go-lives, or policy updates
3 — Enterprise-Wide Browser: Who Has What Access?
Organizations may need a consolidated view of access across multiple Oracle applications and cloud services. OAG provides enterprise-wide visibility across supported connected systems. OAG provides this through the Enterprise-Wide Browser.
| Illustrative scenario — CISO visibility across Fusion application: A CISO wants a consolidated view of Finance users with potentially high-risk Fusion ERP access. Using the Enterprise-Wide Browser, authorized reviewers can examine relevant access information across supported connected systems and identify accounts or access that may warrant further review. |
- Single consolidated view of all user access across Fusion HCM, ERP, OTM, WMS, OCI, and more
- Filter by application, role, business unit or last access date
- Dormant account identification — identify potentially dormant accounts based on configured criteria, such as a defined period without login activity
- Peer group analysis — compares each user’s access to colleagues in the same role and BU
4 — Segregation of Duties: Preventive Guardrails Across Oracle Apps
RMC has been instrumental in handling SoD within Fusion — but what about OTM, EPM, WMS, and OCI? And what about preventing conflicts at request time, not detecting them after the fact?
| Illustrative scenario — Preventive SoD at request time: A Finance team member requests the ‘Create Supplier’ role in Fusion ERP. What happens next illustrates one of OAG’s most important architectural decisions. OAG integrates out-of-the-box with Oracle Risk Management Cloud — rather than maintaining a separate SoD ruleset, OAG reads conflict definitions directly from RMC, helping keep the applicable governance and risk rules aligned. The Guardrails engine evaluates the request against the applicable configured rules. the user already holds ‘Approve Supplier Invoices’ — a classic Procure-to-Pay SoD violation. The request is blocked before it reaches any approver. The user sees a clear explanation. And for organisations without RMC? OAG’s native guardrails engine steps in with rules configuration. |
- Must Have / Must Not Have guardrails: Define mandatory or prohibited role/permissions combinations for supported connected applications
- Preventive SoD at request time: Configured guardrails can identify and prevent applicable conflicting access from being provisioned
- Cross-application SoD: OAG evaluates conflicts spanning Fusion ERP AND OCI simultaneously
- Violation dashboard: CISO view of all active SoD violations ranked by risk with one-click remediation workflow
- RMC integration: For customers with RMC,
- Preventive Segregation of Duties (SOD) scans in Oracle Access Governance
- SOD scans are executed when an access request is raised for FA ERP or HCM job role
- Leverages SOD rules defined in FA Risk Management Cloud
- Approver can decide to approve, revoke or reassign access
5 — Supporting Audit and Compliance Processes with Access Governance
Organizations may need records of access requests, approvals, and review decisions as part of their audit and compliance processes. Oracle Access Governance can capture this information for supported identity-governance workflows
| Illustrative scenario — audit preparation: An organization needs records showing who requested access, who approved it, when the decision occurred, and the recorded business justification. Oracle Access Governance can capture relevant access-governance activity and make that information available for reporting and review.OAG allows to export event data via OCI Object Storage and OCI Streaming into analytics engines like Oracle Analytics Cloud (OAC) or external analytics tools. |
- Self-service access request catalog — business-friendly role names, not technical codes
- Multi-level approval workflows with mandatory justification at every step
- Audit trail — who requested, who approved, when, with what justification
- Separation between access requestors, approvers, and provisioning — helping organizations implement separation-of-duties and four-eyes control processes
Do You Have Oracle Risk Management Cloud? OAG Works Either Way
One of the most common questions: “We already have RMC — do we still need OAG?” The answer is yes. RMC and OAG provide complementary capabilities that address different aspects of risk and identity governance.
| Capability | Without RMC — OAG fills the gap | With RMC — OAG complements |
| Preventive SoD | OAG Guardrails block toxic role combinations at request time across supported connected applications | RMC handles Fusion SoD rules. OAG extends enforcement to OTM, EPM, WMS, OCI, and non-Oracle apps |
| Access Reviews | OAG runs automated certification campaigns — no more spreadsheet-based reviews | RMC covers Fusion only. OAG adds access reviews for supported Oracle and non-Oracle connected systems |
| Identity Lifecycle (JML) | HCM as authoritative source drives automated joiner/mover/leaver across supported connected applications | Shared foundation — HCM feeds both. OAG governs provisioning for apps beyond Fusion scope |
| Access Requests | OAG self-service catalog with approval workflows for supported connected applications | Complements RMC — self-service for apps outside Fusion scope with SoD pre-check at request time |
| Risk Analytics | OAG AI identifies peer group anomalies, privilege creep, dormant accounts for supported connected applications | RMC detects transaction-level financial risk. OAG detects identity and access risk — a different layer |
OAG Integration Landscape for Oracle Applications
Oracle Access Governance supports integrations with a range of Oracle and third-party applications and services. The table below shows the breadth of supported integrations:
https://docs.oracle.com/en/cloud/paas/access-governance/integrate.html
Plus non-Oracle targets: Microsoft Entra ID, Active Directory, SAP S/4HANA, SAP Ariba, Workday, ServiceNow, Atlassian Jira, Palo Alto Prisma Cloud, and more.
Conclusion
Oracle Access Governance provides identity governance capabilities designed to help organizations manage access across supported Oracle and third-party applications — whether you have RMC or not.
- No RMC? OAG gives you SoD guardrails, access reviews, and identity governance across supported Oracle applications
- Have RMC? OAG provides Preventive SOD checks for identity provisioning, extends governance beyond Fusion to OTM, EPM, WMS, OCI, and your non-Oracle supported third-party applications
- Fusion only today? OAG grows with you — connect new Oracle and non-Oracle supported systems without replacing your tool
- Cloud-native: No infrastructure to manage — activate on OCI
To learn more about Access Governance, review the product documentation. To get started with Oracle Cloud Infrastructure, why not explore the Oracle Cloud Free Tier with a 30-day free trial?