Skip to content
Best IAM ToolsBest IAM Tools

Stack map · No scores · Sources dated

IAM stack map: which tools cover each identity job

Short answer

Five vendors document directory and single sign-on, seven document lifecycle and governance, two document application coverage, two document privileged access and five document identity threat detection. No vendor here documents all five jobs. Read across a row to see what one vendor covers, or down a column to see who covers a job.

By The Access Desk · Best IAM Tools · Published 2026-10-08

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Editorial profiles, no scores; we did not run the products.

The five jobs of an IAM stack and how many vendors document eachJ1 Directory and single sign-on: 5 documented, 1 partial. J2 Lifecycle and governance: 7 documented, 4 partial. J3 Application coverage and identity orchestration: 2 documented, 6 partial. J4 Privileged access: 2 documented, 7 partial. J5 Identity threat detection and response: 5 documented, 1 partial.PEOPLE AND APPSJ1Directory and single sign-on5 documented · 1 partialJ2Lifecycle and governance7 documented · 4 partialJ3Application coverage2 documented · 6 partialJ4Privileged access2 documented · 7 partialJ5Identity threat detection5 documented · 1 partial
Figure 1. The five jobs this site maps. Squares count vendors whose own pages describe the job (filled) or part of it (half-filled). Counts, not quality.
Read the stack as a list

Which jobs does each vendor document?

  • DocumentedDocumented: the vendor's own pages describe this job.
  • PartialPartial: the pages describe part of the job, or describe it with a stated limit.
  • Not in our sourcesNot in our sources: we found no description on the pages we read. This does not prove the product lacks it.
Coverage as described on each vendor's own pages, read in September 2026 and updated 11 October 2026. Not a score.
VendorJ1Directory and SSOJ2Lifecycle and IGAJ3App coverageJ4Privileged accessJ5Threat detection
AponoNot in our sourcesNot in our sourcesNot in our sourcesDocumentedNot in our sources
C1 (formerly ConductorOne)Not in our sourcesDocumentedPartialNot in our sourcesNot in our sources
CyberArk (Idira, Palo Alto Networks)Not in our sourcesNot in our sourcesNot in our sourcesDocumentedNot in our sources
Google Cloud IdentityDocumentedPartialNot in our sourcesNot in our sourcesNot in our sources
JumpCloudDocumentedPartialNot in our sourcesPartialNot in our sources
LumosNot in our sourcesDocumentedPartialNot in our sourcesNot in our sources
Microsoft EntraDocumentedDocumentedPartialPartialDocumented
OktaDocumentedDocumentedNot in our sourcesPartialDocumented
Orchid SecurityNot in our sourcesPartialDocumentedPartialPartial
Ping IdentityDocumentedPartialNot in our sourcesPartialNot in our sources
Push SecurityNot in our sourcesNot in our sourcesPartialNot in our sourcesDocumented
SailPointNot in our sourcesDocumentedPartialNot in our sourcesNot in our sources
SaviyntNot in our sourcesDocumentedDocumentedPartialNot in our sources
SemperisNot in our sourcesNot in our sourcesNot in our sourcesNot in our sourcesDocumented
SilverfortPartialNot in our sourcesNot in our sourcesPartialDocumented
VezaNot in our sourcesDocumentedPartialNot in our sourcesNot in our sources

Jobs documented per vendor

Who covers each job?

J1

Directory and single sign-on

Holds the list of people and their sign-in methods, and signs them in to applications once (SSO) with MFA and access policies.

Documented:

Partial:

  • Silverfort Partial

    Universal MFA for legacy apps, command-line tools and OT with zero agents and zero code changes; Silverfort is not a directory or SSO provider.

    Source: Silverfort homepage · Read 29 Sep 2026

J2

Lifecycle and governance

Grants access when people join, changes it when they move, removes it when they leave, and runs access requests and reviews (identity governance and administration, IGA).

Documented:

Partial:

J3

Application coverage and identity orchestration

Finds the applications and accounts the other jobs do not reach (unmanaged, legacy, custom-built and disconnected apps, local accounts) and brings them under control.

Documented:

Partial:

J4

Privileged access

Controls admin and other high-risk access: just-in-time grants, credential vaulting and rotation, secrets for machines.

Documented:

  • Apono Documented

    Just-in-time access for humans, machines and AI agents with automatic revocation and zero standing privilege; requests through Slack, CLI or Apono Assist; dynamic roles in AWS, Azure, GCP, Kubernetes and databases; Agent Privilege Guard with intent-based access control; audit logs and AI session summaries; 85+ integrations.

    Source: Apono homepage · Read 11 Oct 2026

  • CyberArk (Idira, Palo Alto Networks) Documented

    Secrets Manager as SaaS or self-hosted, Conjur open source, and Secrets Hub for AWS Secrets Manager and Azure Key Vault; CyberArk says it can centrally rotate and manage credentials. Palo Alto Networks' Idira release names Traditional PAM, Modern PAM (with zero standing privilege and just-in-time access), Workforce Access, and Machine and AI Identity Security licence lines for existing CyberArk SaaS customers.

    Source: CyberArk Secrets Management · Read 29 Sep 2026 · Source: Palo Alto Networks press release: Idira introduced · Read 11 Oct 2026

Partial:

  • JumpCloud Partial

    Privileged Access Management is listed on the pricing page and sold through sales, not as a line item in the plan table; feature detail is not in our sources.

    Source: JumpCloud pricing · Read 27 Sep 2026

  • Microsoft Entra Partial

    Privileged Identity Management (PIM) needs Microsoft Entra ID Governance or Entra ID P2 licences, per Microsoft's licensing page; feature detail is not in our sources.

    Source: Microsoft Learn: Entra ID Governance licensing fundamentals · Read 11 Oct 2026

  • Okta Partial

    Privileged Access is listed in the Essentials suite on the pricing page; feature detail is not in our sources.

    Source: Okta pricing · Read 27 Sep 2026

  • Orchid Security Partial

    Brings discovered applications under PAM control and reports privileged accounts it finds to Idira Privilege Cloud's Discovered Accounts queue, without sending credentials; it is not a credential vault.

    Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026

  • Ping Identity Partial

    Ping announced Privileged Access for Desktop Agents on 27 May 2026, with availability that may vary by product, region or deployment model.

    Source: Ping Identity press release, 27 May 2026 · Read 27 Sep 2026

  • Saviynt Partial

    Privileged access appears in the Saviynt Identity Platform product list, and its 2022 release notes say its cloud PAM auto-discovers Windows service accounts and Azure privileged accounts.

    Source: Saviynt homepage · Read 27 Sep 2026 · Source: Saviynt blog: 2022 release wrap-up · Read 11 Oct 2026

  • Silverfort Partial

    Non-human identity protection for AD and cloud service accounts: a behavioral baseline per account and virtual fences. Its Enterprise package adds Privileged Access Security with just-in-time access.

    Source: Silverfort: non-human identity security · Read 29 Sep 2026 · Source: Silverfort pricing · Read 11 Oct 2026

J5

Identity threat detection and response

Watches sign-ins, sessions and directory changes for identity attacks and responds by challenging, blocking or ending sessions (ITDR).

Documented:

  • Microsoft Entra Documented

    Defender for Identity detects identity-based attacks across on-premises Active Directory, Entra ID and other IAM such as Okta; ID Protection and risk-based Conditional Access come with P2.

    Source: Microsoft Learn: What is Microsoft Defender for Identity · Read 29 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026

  • Okta Documented

    Identity Threat Protection evaluates risk during sessions, offers Universal Logout and shares signals with CrowdStrike, Zscaler, Palo Alto Networks and Jamf.

    Source: Okta Identity Threat Protection · Read 27 Sep 2026

  • Push Security Documented

    Detects adversary-in-the-middle phishing and session hijacking in the browser, with MFA guardrails.

    Source: Push Security homepage · Read 29 Sep 2026

  • Semperis Documented

    Directory Services Protector watches hundreds of indicators of exposure and compromise across AD and Entra ID and can automatically roll back malicious changes; AD Forest Recovery, Disaster Recovery for Entra Tenant and Recovery for Okta cover recovery.

    Source: Semperis: Active Directory security · Read 29 Sep 2026 · Source: Semperis homepage · Read 29 Sep 2026

  • Silverfort Documented

    Detects brute force, password spraying, credential stuffing, Pass-the-Hash, Pass-the-Ticket, Kerberoasting and DCSync, and can block, challenge with MFA or terminate the session inline, before authentication completes.

    Source: Silverfort: identity threat detection and response · Read 29 Sep 2026

Partial:

Which head-to-heads can you read?

Each pair is listed under the first job both vendors cover. Facts only, no scores.

Directory and single sign-on

Lifecycle and governance

Privileged access

Identity threat detection and response

Which vendors are mentioned but not profiled?

  • Idira Identity Governance (Palo Alto Networks)

    Palo Alto Networks says Idira Identity Governance uses robotic process automation to help connect to applications that lack APIs. zillasecurity.com redirects to this page. Palo Alto Networks introduced Idira on 12 May 2026 as its identity platform and the upgrade path for CyberArk customers; see the CyberArk profile. We have only this one page on Idira Identity Governance, so it is not profiled separately.

    Source: Palo Alto Networks: Idira Identity Governance · Read 27 Sep 2026 · Source: Palo Alto Networks press release: Idira introduced · Read 11 Oct 2026

  • Astrix Security

    Astrix says it is now part of Cisco and ended standalone sales of new licenses on 30 June 2026, so it is not profiled as something a new buyer can purchase.

    Source: Astrix Security homepage · Read 29 Sep 2026

  • Oasis Security

    Oasis describes a non-human identity security cloud and says it has been acquired by Cyera. Our sources do not give a date or product changes, so it is not profiled this edition.

    Source: Oasis Security homepage · Read 29 Sep 2026

Frequently asked questions

Why does Orchid Security show as documented for application coverage when it is a client?

Because its own pages describe that job directly: discovering unmanaged and custom-built applications and the accounts inside them. Saviynt is also documented for that job. Orchid is shown as partial or not covered for the other four jobs, and its profile lists its limits, including no price on its own site.

Does 'Not in our sources' mean a product cannot do it?

No. It means the pages we read did not describe it. Vendors change pages often; check with the vendor and tell us through the contact page if we missed something.

How current is the map?

Vendor pages were read on 27 and 29 September 2026, with updates read on 11 October 2026. Each fact on a profile shows its own read date.