Matt,
Just to expand upon this, what about non-human accounts and the groups that go along with them. I have service accounts and other accounts that aren't represented in my HR database. Also, I have groups that will never have a role defined in HR or IdM. Does IdM take over management of those user accounts as well? And if so, for what purpose?
Thanks,
Paul