IAM tools FAQ

The set of tools that together decide who someone is, what they can reach and whether that is still right. This site splits it into five jobs: directory and single sign-on, lifecycle and governance, application coverage, privileged access and identity threat detection. See what an IAM stack is.

Usually directory and single sign-on, because every other job reads from the directory. The sequencing lesson gives a default order and the signals that change it.

For a small company with mostly SaaS apps, often for a while. It stops being enough when you need access reviews and evidence, have applications it cannot connect to, or need to control admin credentials.

IAM is the whole field. IGA, identity governance and administration, is the part that decides who should have access, runs requests and reviews and keeps evidence. See identity governance explained.

Our name for the job of finding applications and accounts that the identity provider and governance tool do not reach, such as legacy, custom-built and disconnected apps and the local accounts inside them. See the job page.

Yes. Service accounts, keys, tokens and AI agents need owners, reviews, rotation and monitoring. The OWASP NHI Top 10 lesson maps each risk to a job.

Microsoft (every Entra tier), Okta (Starter, Core Essentials and Essentials), Ping Identity (PingOne for Workforce), JumpCloud (modules), Google (Cloud Identity) and Push Security (Standard plan). Orchid Security and Apono list prices on AWS Marketplace only. C1 and SailPoint publish structure without prices; Silverfort publishes packages priced by organization size. See licensing an IAM stack.

Okta has a $1,500 annual minimum contract, PingOne for Workforce has a 5,000-user annual minimum, and JumpCloud's Platform Essentials tier has a 300-user maximum.

Not always. Microsoft ID Governance is $7.00 per user per month but requires Entra ID P1 or P2. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on. Compare the full cost including the prerequisite.

Do not compare them on one scale. Decide which jobs you need with the stack builder, then compare vendors within each job, using the side-by-side tool or a head-to-head page.

Which of your top applications it connects to today, how it handles applications with no connector, what evidence it exports, what it costs including prerequisites and minimums, and how it is deployed.

None of the 16 vendors here documents all five jobs. Microsoft Entra and Okta each document three. Most stacks combine an identity provider with one or two specialist tools.

Google Cloud Identity, JumpCloud, Microsoft Entra, Okta and Ping Identity. Silverfort covers part of the job by adding MFA to systems that cannot take it natively. See the job page.

C1 (formerly ConductorOne), Lumos, Microsoft Entra, Okta, SailPoint, Saviynt and Veza. Google Cloud Identity, JumpCloud, Orchid Security and Ping Identity cover part of it. See the job page.

Orchid Security and Saviynt. C1 (formerly ConductorOne), Lumos, Microsoft Entra, Push Security, SailPoint and Veza cover part of it.See the job page.

Apono and CyberArk (Idira, Palo Alto Networks) in our sources, which are thinner for this job than for the others. JumpCloud, Microsoft Entra, Okta, Orchid Security, Ping Identity, Saviynt and Silverfort cover part of it. See the job page.

Microsoft Entra, Okta, Push Security, Semperis and Silverfort. Orchid Security covers part of it as an incident response use case. See the job page.

It does not sign people in, provision access or run certification campaigns. It publishes no price on its own site (AWS Marketplace lists $250,000.00 per 12 months for 30 applications) and does not say whether the platform can run on premises. It discovers applications and the identity inside them and feeds that to the tools that do. See its profile.

ServiceNow completed its acquisition of Veza (announced 2 March 2026), SailPoint completed its acquisition of Entro Security (29 June 2026), and Astrix says it is now part of Cisco and ended standalone sales of new licenses on 30 June 2026. Apono says on its home page that it is now part of 1Password.

The vendors do different jobs, so one score would rank things that should be combined. We record what each vendor's pages describe for each job. See how this works.

Documented: the vendor's pages describe the job. Partial: they describe part of it, or describe it with a limit we state. Not in our sources: we found no description on the pages we read, which does not prove the product lacks it.

Alphabetically everywhere. The stack builder groups vendors by status within each job and then lists them alphabetically.

Use the contact page with the topic Correction and a link to the vendor page. We check it against that page and update the data.