EDITION 2026.10 · VENDOR FACTS UPDATED 11 OCTOBER 2026

Best IAM tools by job: build an identity stack that covers the gaps

Short answer

An IAM stack does five jobs: directory and single sign-on, lifecycle and governance, application coverage, privileged access, and identity threat detection. Most organizations start with an identity provider and add the other jobs as headcount, audit pressure and the share of applications outside that provider grow. This site maps 16 vendors to those jobs from their own public pages, with no scores, so you can see which jobs you still need and who covers them.

By The Access Desk · Best IAM Tools · Published 2026-10-08

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Editorial profiles, no scores; we did not run the products.

What are the five jobs of an IAM stack?

Figure 1. The five jobs this site maps. Squares count vendors whose own pages describe the job (filled) or part of it (half-filled). Counts, not quality.

Read the stack as a list

J5 Identity threat detection and response: 5 documented, 1 partial
J4 Privileged access: 2 documented, 7 partial
J3 Application coverage and identity orchestration: 2 documented, 6 partial
J2 Lifecycle and governance: 7 documented, 4 partial
J1 Directory and single sign-on: 5 documented, 1 partial

Directory and single sign-on

Holds the list of people and their sign-in methods, and signs them in to applications once (SSO) with MFA and access policies.

Documented by 5 vendors · Partial for 1

Lifecycle and governance

Grants access when people join, changes it when they move, removes it when they leave, and runs access requests and reviews (identity governance and administration, IGA).

Documented by 7 vendors · Partial for 4

Application coverage and identity orchestration

Finds the applications and accounts the other jobs do not reach (unmanaged, legacy, custom-built and disconnected apps, local accounts) and brings them under control.

Documented by 2 vendors · Partial for 6

Privileged access

Controls admin and other high-risk access: just-in-time grants, credential vaulting and rotation, secrets for machines.

Documented by 2 vendors · Partial for 7

Identity threat detection and response

Watches sign-ins, sessions and directory changes for identity attacks and responds by challenging, blocking or ending sessions (ITDR).

Documented by 5 vendors · Partial for 1

Which jobs do you need first?

Directory and single sign-on usually comes first. The other four jobs depend on how many people you have, how many applications sit outside your identity provider and how much audit pressure you face.

Four questions about your company size, applications, audit pressure and current identity provider. The stack builder shows which jobs matter now and which vendors' pages document them.

Open the stack builder

Who covers what?

DocumentedDocumented: the vendor's own pages describe this job.
PartialPartial: the pages describe part of the job, or describe it with a stated limit.
Not in our sourcesNot in our sources: we found no description on the pages we read. This does not prove the product lacks it.

Alphabetical order. A matrix of what vendors describe, not a ranking.

Coverage as described on each vendor's own pages, read in September 2026 and updated 11 October 2026. Not a score.
Vendor	J1Directory and SSO	J2Lifecycle and IGA	J3App coverage	J4Privileged access	J5Threat detection
Apono	Not in our sources	Not in our sources	Not in our sources	Documented	Not in our sources
C1 (formerly ConductorOne)	Not in our sources	Documented	Partial	Not in our sources	Not in our sources
CyberArk (Idira, Palo Alto Networks)	Not in our sources	Not in our sources	Not in our sources	Documented	Not in our sources
Google Cloud Identity	Documented	Partial	Not in our sources	Not in our sources	Not in our sources
JumpCloud	Documented	Partial	Not in our sources	Partial	Not in our sources
Lumos	Not in our sources	Documented	Partial	Not in our sources	Not in our sources
Microsoft Entra	Documented	Documented	Partial	Partial	Documented
Okta	Documented	Documented	Not in our sources	Partial	Documented
Orchid Security	Not in our sources	Partial	Documented	Partial	Partial
Ping Identity	Documented	Partial	Not in our sources	Partial	Not in our sources
Push Security	Not in our sources	Not in our sources	Partial	Not in our sources	Documented
SailPoint	Not in our sources	Documented	Partial	Not in our sources	Not in our sources
Saviynt	Not in our sources	Documented	Documented	Partial	Not in our sources
Semperis	Not in our sources	Not in our sources	Not in our sources	Not in our sources	Documented
Silverfort	Partial	Not in our sources	Not in our sources	Partial	Documented
Veza	Not in our sources	Documented	Partial	Not in our sources	Not in our sources

Open the full stack map

From the column

2026-10-08
IAM acquisitions in 2026: what changed hands and what it means for your stack
MarketVendors
ServiceNow and Veza, SailPoint and Entro, Cisco and Astrix, Cyera and Oasis: which jobs each deal touches and what to ask.
3 min read
2026-10-08
AI agents reach every IAM job: what seven vendors announced in 2026
AgentsVendors
Microsoft, Okta, SailPoint, Saviynt, Lumos, C1 and Ping all shipped or announced agent features. They land in different jobs.
3 min read
2026-10-08
Suite or specialist: what Microsoft and Okta include in each tier
PricingVendors
The published tier tables of the two largest identity suites, which jobs they cover, and when a specialist tool makes sense.
3 min read

All posts in the column

What does this site not do?

We do not score, rank or pick a single vendor. Each profile states what the vendor's own pages describe, what they do not, and the price where one is published. We did not run the products.

How this works

Frequently asked questions

What are the best IAM tools?

It depends on which job you need done. Google Cloud Identity, JumpCloud, Microsoft Entra, Okta and Ping Identity document directory and single sign-on; C1 (formerly ConductorOne), Lumos, Microsoft Entra, Okta, SailPoint, Saviynt and Veza document lifecycle and governance; Microsoft Entra, Okta, Push Security, Semperis and Silverfort document threat detection. The stack map shows all five jobs side by side.

Do I need more than an identity provider?

Often yes, once you pass a few hundred people or face access audits. An identity provider signs people in; it does not always remove access from apps it is not connected to, run access reviews or control admin credentials. The stack builder shows which extra jobs matter for your situation.

Why are there no scores on this site?

Because the vendors here do different jobs, a single score would compare things that do not compete. We show which jobs each vendor's own pages describe, with sources and dates, and leave the weighting to you.