JOB J1 · DIRECTORY AND SSO
Directory and single sign-on tools: who covers the identity provider job
Short answer
Five of the 16 vendors document this job: Google Cloud Identity, JumpCloud, Microsoft Entra, Okta and Ping Identity. It is the job most organizations fill first, because every other job relies on knowing who a person is and signing them in. The choice often follows the productivity suite you already pay for and how many applications need SAML or OpenID Connect sign-in.
What does this job include?
- A directory of people and groups, which other tools read as the source of who works here.
- Single sign-on to applications over SAML or OpenID Connect (OIDC).
- Multi-factor authentication, including phishing-resistant methods such as passkeys and FIDO2 security keys.
- Access policies that use device, location and risk signals: Conditional Access in Microsoft's terms, Adaptive MFA in Okta's.
- Basic provisioning to apps over SCIM, which overlaps with the lifecycle job.
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
Who documents this job?
Free and Premium editions; thousands of pre-integrated SAML 2.0 and OIDC apps; MFA including Titan Security Keys; passkeys; Context-Aware Access in Premium.
Source: Google Cloud Identity · Read 27 Sep 2026 · Source: Google Cloud Identity editions · Read 27 Sep 2026
Listed at $7.2 per user per month on the product page; a Free edition is also offered.
Cloud directory, SSO, MFA, passwordless and conditional access, plus cloud LDAP and RADIUS.
Source: JumpCloud platform · Read 27 Sep 2026
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Entra ID Free includes MFA and SSO; the app gallery lists thousands of applications; Conditional Access comes with P1; phishing-resistant methods include passkeys and FIDO2 security keys.
Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Microsoft Learn: Entra application gallery · Read 27 Sep 2026 · Source: Microsoft Learn: Conditional Access overview · Read 27 Sep 2026 · Source: Microsoft Learn: Entra authentication methods · Read 27 Sep 2026
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Universal Directory, SSO and MFA from the Starter suite; 8,000+ pre-built integrations in the Okta Integration Network; FastPass passwordless; Adaptive MFA.
Source: Okta pricing · Read 27 Sep 2026 · Source: Okta Integration Network · Read 27 Sep 2026 · Source: Okta FastPass · Read 27 Sep 2026 · Source: Okta Adaptive MFA · Read 27 Sep 2026
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
PingOne for Workforce Essential covers SSO, directory, OAuth 2.0, OIDC, SAML, SCIM, LDAP, Kerberos and a RADIUS gateway; Plus adds adaptive MFA and passwordless; PingFederate is an enterprise federation server.
Source: Ping Identity pricing · Read 27 Sep 2026 · Source: PingFederate · Read 27 Sep 2026
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.
Who covers part of it?
Universal MFA for legacy apps, command-line tools and OT with zero agents and zero code changes; Silverfort is not a directory or SSO provider.
Source: Silverfort homepage · Read 29 Sep 2026
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.
How do all 16 vendors read for this job?
| Vendor | J1Directory and SSO |
|---|---|
| Apono | Not in our sources |
| C1 (formerly ConductorOne) | Not in our sources |
| CyberArk (Idira, Palo Alto Networks) | Not in our sources |
| Google Cloud Identity | Documented |
| JumpCloud | Documented |
| Lumos | Not in our sources |
| Microsoft Entra | Documented |
| Okta | Documented |
| Orchid Security | Not in our sources |
| Ping Identity | Documented |
| Push Security | Not in our sources |
| SailPoint | Not in our sources |
| Saviynt | Not in our sources |
| Semperis | Not in our sources |
| Silverfort | Partial |
| Veza | Not in our sources |
Which vendors publish a price for this job?
Five of the vendors that document this job publish per-user prices. Microsoft lists Entra ID Free, P1 at $7.00 and P2 at $10.00 per user per month, paid yearly. Okta lists Starter at $6 with a $1,500 annual minimum. Ping Identity lists PingOne for Workforce Essential at $3 and Plus at $6, with a 5,000-user annual minimum. JumpCloud lists its SSO module at $11 on annual billing. Google lists Cloud Identity at $7.2 and offers a Free edition. Minimums and bundles change the real cost more than the headline price, so read the licensing lesson.
Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Okta pricing · Read 27 Sep 2026 · Source: Ping Identity pricing · Read 27 Sep 2026 · Source: JumpCloud pricing · Read 27 Sep 2026 · Source: Google Cloud Identity editions · Read 27 Sep 2026
Where does this job stop?
A directory signs people in to the applications connected to it. By itself it does not find applications that were never connected, check whether access is still needed, control admin credentials or watch for attacks on the directory. Those are jobs J2 to J5. Microsoft's own documentation for applications that do not support provisioning describes exporting users to CSV and matching them by hand, which shows where the sign-in job ends and the application coverage job begins.
Source: Microsoft Learn: applications that do not support provisioning · Read 27 Sep 2026
What about MFA for systems the identity provider cannot reach?
Older systems such as command-line tools, legacy applications and operational technology often cannot redirect to an identity provider. Silverfort describes Universal MFA for these systems with no agents and no code changes, which is why it shows as Partial here: it adds MFA without being a directory.
Source: Silverfort homepage · Read 29 Sep 2026
Frequently asked questions
Is Microsoft Entra ID free?
Entra ID Free comes with Microsoft cloud subscriptions and includes MFA and single sign-on. Conditional Access needs P1 at $7.00 per user per month, and risk-based Conditional Access needs P2 at $10.00, both paid yearly.
Does Silverfort replace an identity provider?
No. Silverfort adds MFA to systems that cannot take it natively and detects identity attacks; its pages do not describe a directory or single sign-on. It runs alongside an identity provider.
Which identity provider should a small company start with?
The one that matches the tools you already pay for and your size. JumpCloud's Platform Essentials tier has a 300-user maximum and Okta has a $1,500 annual minimum; Google Cloud Identity and Microsoft Entra ID both have free editions. The stack builder shows the size notes for each.
Read next