# Best IAM Tools

> Which IAM tools do you need, by job? A map of 15 identity and access management vendors to the five jobs of an IAM stack (directory and SSO, lifecycle and governance, application coverage, privileged access, identity threat detection), built from the vendors' public pages, with no scores.

## Map and method
- [Home](https://bestiamtools.com/): the five jobs of an IAM stack, the coverage matrix and where to start.
- [IAM stack map](https://bestiamtools.com/iam-stack-map): which vendors document each identity job, with sources.
- [How this works](https://bestiamtools.com/how-this-works): sources, statuses, ordering, limitations and corrections.
- [Stack builder](https://bestiamtools.com/stack-builder): four questions that sort the five jobs into Core, Next and Later for your organization.
- [Side by side](https://bestiamtools.com/stack-compare): compare two to five vendors job by job.

## Jobs
- [Directory and single sign-on](https://bestiamtools.com/job/directory-and-sso): Holds the list of people and their sign-in methods, and signs them in to applications once (SSO) with MFA and access policies.
- [Lifecycle and governance](https://bestiamtools.com/job/lifecycle-and-governance): Grants access when people join, changes it when they move, removes it when they leave, and runs access requests and reviews (identity governance and administration, IGA).
- [Application coverage and identity orchestration](https://bestiamtools.com/job/app-coverage): Finds the applications and accounts the other jobs do not reach (unmanaged, legacy, custom-built and disconnected apps, local accounts) and brings them under control.
- [Privileged access](https://bestiamtools.com/job/privileged-access): Controls admin and other high-risk access: just-in-time grants, credential vaulting and rotation, secrets for machines.
- [Identity threat detection and response](https://bestiamtools.com/job/identity-threat-detection): Watches sign-ins, sessions and directory changes for identity attacks and responds by challenging, blocking or ending sessions (ITDR).

## Tool profiles
- [Apono](https://bestiamtools.com/iam-tool/apono): Just-in-time privileged access: jobs covered, pricing, deployment and limits from its own pages.
- [C1 (formerly ConductorOne)](https://bestiamtools.com/iam-tool/c1): Identity governance: jobs covered, pricing, deployment and limits from its own pages.
- [CyberArk (Idira, Palo Alto Networks)](https://bestiamtools.com/iam-tool/cyberark): Privileged access and secrets: jobs covered, pricing, deployment and limits from its own pages.
- [Google Cloud Identity](https://bestiamtools.com/iam-tool/google-cloud-identity): Identity provider: jobs covered, pricing, deployment and limits from its own pages.
- [JumpCloud](https://bestiamtools.com/iam-tool/jumpcloud): Identity provider and device management: jobs covered, pricing, deployment and limits from its own pages.
- [Lumos](https://bestiamtools.com/iam-tool/lumos): Identity governance: jobs covered, pricing, deployment and limits from its own pages.
- [Microsoft Entra](https://bestiamtools.com/iam-tool/microsoft-entra): Identity provider and suite: jobs covered, pricing, deployment and limits from its own pages.
- [Okta](https://bestiamtools.com/iam-tool/okta): Identity provider and suite: jobs covered, pricing, deployment and limits from its own pages.
- [Orchid Security](https://bestiamtools.com/iam-tool/orchid-security): Identity orchestration and app coverage: jobs covered, pricing, deployment and limits from its own pages.
- [Ping Identity](https://bestiamtools.com/iam-tool/ping-identity): Identity provider: jobs covered, pricing, deployment and limits from its own pages.
- [Push Security](https://bestiamtools.com/iam-tool/push-security): Browser-based identity threat detection: jobs covered, pricing, deployment and limits from its own pages.
- [SailPoint](https://bestiamtools.com/iam-tool/sailpoint): Identity governance: jobs covered, pricing, deployment and limits from its own pages.
- [Saviynt](https://bestiamtools.com/iam-tool/saviynt): Identity governance: jobs covered, pricing, deployment and limits from its own pages.
- [Semperis](https://bestiamtools.com/iam-tool/semperis): Directory threat detection and recovery: jobs covered, pricing, deployment and limits from its own pages.
- [Silverfort](https://bestiamtools.com/iam-tool/silverfort): Identity threat detection and MFA: jobs covered, pricing, deployment and limits from its own pages.
- [Veza](https://bestiamtools.com/iam-tool/veza): Access graph and governance: jobs covered, pricing, deployment and limits from its own pages.

## Head-to-heads
- [Google Cloud Identity and JumpCloud](https://bestiamtools.com/google-cloud-identity-with-jumpcloud): the two compared job by job, with what each covers alone.
- [JumpCloud and Okta](https://bestiamtools.com/jumpcloud-with-okta): the two compared job by job, with what each covers alone.
- [Microsoft Entra and Okta](https://bestiamtools.com/microsoft-entra-with-okta): the two compared job by job, with what each covers alone.
- [Okta and Ping Identity](https://bestiamtools.com/okta-with-ping-identity): the two compared job by job, with what each covers alone.
- [Microsoft Entra and Ping Identity](https://bestiamtools.com/microsoft-entra-with-ping-identity): the two compared job by job, with what each covers alone.
- [SailPoint and Saviynt](https://bestiamtools.com/sailpoint-with-saviynt): the two compared job by job, with what each covers alone.
- [C1 (formerly ConductorOne) and Lumos](https://bestiamtools.com/c1-with-lumos): the two compared job by job, with what each covers alone.
- [Lumos and Veza](https://bestiamtools.com/lumos-with-veza): the two compared job by job, with what each covers alone.
- [Microsoft Entra and SailPoint](https://bestiamtools.com/microsoft-entra-with-sailpoint): the two compared job by job, with what each covers alone.
- [Okta and SailPoint](https://bestiamtools.com/okta-with-sailpoint): the two compared job by job, with what each covers alone.
- [Orchid Security and SailPoint](https://bestiamtools.com/orchid-security-with-sailpoint): the two compared job by job, with what each covers alone.
- [Orchid Security and Veza](https://bestiamtools.com/orchid-security-with-veza): the two compared job by job, with what each covers alone.
- [Orchid Security and Saviynt](https://bestiamtools.com/orchid-security-with-saviynt): the two compared job by job, with what each covers alone.
- [C1 (formerly ConductorOne) and Orchid Security](https://bestiamtools.com/c1-with-orchid-security): the two compared job by job, with what each covers alone.
- [Lumos and Orchid Security](https://bestiamtools.com/lumos-with-orchid-security): the two compared job by job, with what each covers alone.
- [Microsoft Entra and Orchid Security](https://bestiamtools.com/microsoft-entra-with-orchid-security): the two compared job by job, with what each covers alone.
- [Okta and Orchid Security](https://bestiamtools.com/okta-with-orchid-security): the two compared job by job, with what each covers alone.
- [Apono and CyberArk (Idira, Palo Alto Networks)](https://bestiamtools.com/apono-with-cyberark): the two compared job by job, with what each covers alone.
- [Apono and Okta](https://bestiamtools.com/apono-with-okta): the two compared job by job, with what each covers alone.
- [Semperis and Silverfort](https://bestiamtools.com/semperis-with-silverfort): the two compared job by job, with what each covers alone.
- [Microsoft Entra and Silverfort](https://bestiamtools.com/microsoft-entra-with-silverfort): the two compared job by job, with what each covers alone.
- [Okta and Silverfort](https://bestiamtools.com/okta-with-silverfort): the two compared job by job, with what each covers alone.
- [Push Security and Silverfort](https://bestiamtools.com/push-security-with-silverfort): the two compared job by job, with what each covers alone.

## IAM basics
- [IAM basics](https://bestiamtools.com/iam-basics): eleven short lessons on building an identity stack.
- [What is an IAM stack? The five jobs identity tools do](https://bestiamtools.com/iam-basics/what-is-an-iam-stack): Why identity and access management is a set of jobs, not one product, and how the jobs connect.
- [Directory, single sign-on and MFA: the identity provider job explained](https://bestiamtools.com/iam-basics/directory-sso-and-mfa): What an identity provider does, which protocols it speaks, and what phishing-resistant MFA means.
- [Identity governance explained: what IGA adds to an identity provider](https://bestiamtools.com/iam-basics/identity-governance-explained): Requests, approvals, reviews and lifecycle: the work governance does that sign-in does not.
- [Privileged access basics: standing access, just-in-time grants and secrets](https://bestiamtools.com/iam-basics/privileged-access-basics): What counts as privileged, why standing admin rights are the problem, and where machine secrets fit.
- [Identity threat detection and response explained](https://bestiamtools.com/iam-basics/itdr-explained): What ITDR watches, how it responds, and how it differs from the protections in your identity provider.
- [The application coverage gap: why IAM tools miss some apps and accounts](https://bestiamtools.com/iam-basics/application-coverage-gap): Connectors, local accounts and custom apps: where the stack's reach ends and how to extend it.
- [In what order should you add IAM jobs? A sequencing guide](https://bestiamtools.com/iam-basics/order-to-add-iam-jobs): A practical order for building an identity stack, and the signals that move a job up the list.
- [IAM stack by company size: what changes at 300 and 5,000 people](https://bestiamtools.com/iam-basics/iam-stack-by-company-size): How minimums, caps and audit pressure shape an identity stack for small, mid-size and large organizations.
- [Licensing an IAM stack: add-ons, prerequisites and minimums](https://bestiamtools.com/iam-basics/licensing-an-iam-stack): Why the per-user price on a vendor page is rarely the price of the job, with published examples.
- [SAML, OIDC, SCIM and Shared Signals: the protocols that join an IAM stack](https://bestiamtools.com/iam-basics/protocols-that-join-the-stack): Which standard carries which job between tools, and what each one does not do.
- [The OWASP Non-Human Identities Top 10, mapped to IAM jobs](https://bestiamtools.com/iam-basics/owasp-nhi-top-10-by-job): Ten risks for service accounts, tokens and agents, and which job in the stack addresses each.

## Reference
- [IAM glossary](https://bestiamtools.com/iam-glossary): plain definitions of IAM terms, each tagged with its job.
- [IAM tools FAQ](https://bestiamtools.com/iam-faq): short answers on the stack, buying and pricing, vendors and method.

## The column
- [The column](https://bestiamtools.com/column): dated analysis from The Access Desk.
- [IAM acquisitions in 2026: what changed hands and what it means for your stack](https://bestiamtools.com/column/iam-acquisitions-2026): ServiceNow and Veza, SailPoint and Entro, Cisco and Astrix, Cyera and Oasis: which jobs each deal touches and what to ask.
- [AI agents reach every IAM job: what seven vendors announced in 2026](https://bestiamtools.com/column/ai-agents-across-iam-jobs): Microsoft, Okta, SailPoint, Saviynt, Lumos, C1 and Ping all shipped or announced agent features. They land in different jobs.
- [Suite or specialist: what Microsoft and Okta include in each tier](https://bestiamtools.com/column/suite-or-specialist-microsoft-okta): The published tier tables of the two largest identity suites, which jobs they cover, and when a specialist tool makes sense.
- [Five questions to map your current IAM stack before you buy](https://bestiamtools.com/column/map-your-current-iam-stack): Where people come from, which apps are connected, how leavers are removed, where admin access lives, and who watches sign-ins.
- [Where Orchid Security fits in an IAM stack, and where it does not](https://bestiamtools.com/column/where-orchid-security-fits): One documented job, three partial ones, and the limits a buyer should know, from Orchid's own pages.
- [NIST IR 8587 and the token problem: what it means for the threat detection job](https://bestiamtools.com/column/nist-ir-8587-token-security): Guidance on protecting tokens and assertions, published in September 2026, moves attention from sign-in to the whole session.
- [Active Directory is still in the stack: detection and recovery options](https://bestiamtools.com/column/active-directory-detection-recovery): Microsoft, Semperis and Silverfort describe three different ways to watch AD, and recovery is a separate question.
- [How to read an IAM vendor's page: documented, claimed or missing](https://bestiamtools.com/column/reading-iam-vendor-pages): The three kinds of statement on vendor pages, and how this desk turns them into statuses.

## Site
- [Contact](https://bestiamtools.com/contact): questions, corrections, privacy requests and copyright notices.
- [Privacy Policy](https://bestiamtools.com/privacy-policy): what personal data the site handles and your rights.
- [Cookie Policy](https://bestiamtools.com/cookie-policy): the site sets no cookies; details of the font request.
- [Terms of Use](https://bestiamtools.com/terms-of-use): terms for using the site and its content.
- [Copyright and DMCA Policy](https://bestiamtools.com/dmca): how to send a copyright notice or counter-notification.