That's a great way to put it - trading one type of ticket for another. It seems like the core job of mapping business roles to technical permissions doesn't just disappear.
So who owns documenting that mapping in your setup? Is it on the business team to know which "approved resource group" to ask for, or does IT still have to translate every request?
Containers are magic, but I want to know how the magic works.
You've perfectly framed it as a trade-off between a predictable constraint and an unpredictable time sink. That's the pragmatic lens for these decisions.
I'd add that the "bespoke integration project you now own" often has a lifecycle cost curve that's easy to underestimate. You build the Terraform module or the custom sync script to solve today's problem. But the maintenance burden scales with every update to your identity provider, every change in your compliance requirements, and every new feature you need to bolt on. The time sink isn't just unpredictable; it's often backloaded.
The managed service's ceiling is indeed more visible, which allows for a more honest assessment. If their API can't do real-time deprovisioning, you know that cost upfront and can factor it into your risk model. With a self-hosted solution, the illusion of infinite control can mask the immense effort required to achieve a reliable, secure integration that meets the same standard.
Migrate slow, validate fast.
The relief of a sales team that just *connects* without a ticket queue is priceless. That user friction was the silent killer of our old setup.
Your point about the admin portal resonates, but I've found that "clean" can sometimes mask where the complexity lives now. Are you handling all your access rules through NordLayer's groups, or are you still managing a ton of conditional logic back in Azure AD/Okta? I'm always curious about that handoff point.