How to read an IAM vendor's page: documented, claimed or missing

What are the three bins?

• Documented: a specific capability, described clearly enough to test. Microsoft's description of lifecycle workflows that run before a start date, on a status change and at leave is an example.
• Claimed: a result the vendor reports, usually a number or a speed. Saviynt's "in hours, not weeks" for application onboarding, SailPoint's statement that Application Management "reduced application onboarding time by 45-70%", Saviynt's statement that it passed $300 million in annual recurring revenue, and Orchid's figure that 67% of non-human accounts are created directly within applications are all claims.
• Missing: what the page does not say. Prices are the most common gap: Saviynt, Veza and Lumos publish none, and Orchid Security and Apono list prices only on AWS Marketplace, not on their own sites. Deployment options are another: Orchid's own site does not say whether its platform can run on premises.

What signals a documented capability?

A named feature with a documentation page; stated prerequisites, such as Entra ID Governance requiring P1 or P2; and stated limits, such as JumpCloud's 300-user maximum on Platform Essentials. A vendor that publishes its limits is easier to plan around than one that does not.

What signals a claim?

Percentages and time savings without a described workload or baseline; analyst recognitions, such as CyberArk and Saviynt each citing a KuppingerCole leadership placement; and business figures such as revenue. Claims can be true and useful, but they are the vendor's measurement, not a feature. This site shows them in a "Vendor states" box with the source and the line "Vendor claim. Not measured by Best IAM Tools."

Why does "announced" differ from "available"?

Announcements mix shipped and planned work. Okta's September 2026 release lists Resource Access Certifications as available now and two other items as planned for Q3 2026. Ping's May 2026 release says availability may vary by product, region or deployment model. We record what a page says is available, and we say when something is only announced.

Is Partial a judgement?

No. Partial means the vendor's pages describe part of a job, or describe it with a limit we state. Orchid Security is Partial for lifecycle and governance because it feeds governance tools rather than running provisioning. Silverfort is Partial for directory and single sign-on because it adds MFA without being a directory. Either may do its part well.

How does this site apply the bins?

Each fact on a profile carries its source link and the date we read it. Statuses change only when a vendor's pages change, and readers can send a correction through the contact page. The full rules are on how this works.