Top 10 IAM Vendors for 2027: Identity & Access Management

Buyer’s guide · Research checked September 20, 2026

Identity and access management buying decisions can go wrong before a product demo begins: employee sign-in, access reviews, privileged administration and customer registration are different jobs. A broad platform description can hide which products, licenses and integrations you actually need.

This guide compares ten vendors by the problems their products address, their deployment options and the questions a buyer should resolve in a pilot. The profiles are grouped by buying scenario, with source links and practical checks for each choice.

Editorial disclosure: this is an unsponsored editorial selection. Vendors have not paid for inclusion or placement.

Key findings

• Start with the use case. Workforce access, identity governance, privileged access and customer identity overlap, but one category does not replace the others.
• Compare products and entitlements. A capability in a vendor’s portfolio may require another license, connector or operating team.
• Check the 2026 product map. CyberArk is now part of Palo Alto Networks’ Idira platform; Microsoft Entra Permissions Management has retired. The profiles and lifecycle notes below link to the relevant announcements.
• Make the pilot decisive. Test phishing-resistant sign-in, recovery, role changes and revocation in the applications you will actually use.

In this guide

Choose a category · Compare vendors · 2027 evaluation priorities · Costs · Pilot checklist · Methodology · FAQ

First, choose the identity problem

These categories overlap, but they are not substitutes. A company may need a workforce identity provider plus governance and privileged-access products. IGA connects lifecycle and review processes with access decisions; it does not, by itself, replace all authentication or privileged-session controls. IBM’s explanation of IGA and its relationship to other identity controls.

The 2027 shortlist at a glance

The order groups related buying decisions: workforce access first; application and customer identity next; then governance and privileged-access programs. Several portfolios span more than one category. Position in the list is not a security score.

On smaller screens, scroll the table sideways. The vendor column stays visible.

Vendor	Shortlist for	Deployment	Check before buying
1. Microsoft Entra	WORKFORCE Microsoft-centered access and governance	Cloud services; hybrid integration	Existing licenses and external-tenant requirements
2. Okta / Auth0	WORKFORCE · CIAM Mixed app estates and customer identity	Separate workforce and Auth0 products	Connector functions and total package cost
3. JumpCloud	WORKFORCE + DEVICES User access and managed endpoints	Cloud platform with device agents	Device support and recovery workflows
4. Ping Identity	CIAM · HYBRID Complex identity journeys and legacy apps	SaaS and separate self-managed products	Migration scope and operating responsibility
5. Red Hat	SELF-MANAGED IAM Application SSO and federation	Customer-operated build of Keycloak	Subscription eligibility, upgrades and availability
6. Thales OneWelcome	CIAM Customer and partner identity	Modular identity platform	Consent modules, data handling and billing units
7. SailPoint	GOVERNANCE Access reviews and lifecycle management	SaaS or customer-hosted IdentityIQ	Entitlement quality and connector depth
8. Saviynt	GOVERNANCE · PAM Governance and application access controls	Cloud identity platform	Target systems and privileged-access workflows
9. Palo Alto Networks	PAM · IDENTITY SECURITY Privileged access through Idira	Deployment varies by component	CyberArk product mapping and integration scope
10. One Identity	GOVERNANCE · PAM Governance, PAM and Microsoft directories	Multiple products and delivery models	Integration effort, consoles and module costs

Microsoft Entra

• Best for: Microsoft-centered workforce access, with separate governance and customer-identity requirements.
• Core offering: Microsoft Entra is a sensible starting point when Microsoft 365 and Azure are central to the environment. Entra ID provides workforce identity services, while ID Governance and External ID address additional governance and external-identity requirements. They should be evaluated as specific products and entitlements, rather than treated as one all-inclusive license. Microsoft’s current plan comparison distinguishes P1, P2 and Entra Suite; the Suite has a P1 prerequisite. Microsoft Entra plans.
• External identity: For customer applications, distinguish External ID from Azure AD B2C. Microsoft says External ID is not simply a new name for B2C; new customers could no longer purchase Azure AD B2C P1 or P2 from May 1, 2025. Existing B2C customers have a different lifecycle position. External ID FAQ.
• Watchpoint: Existing license entitlements and the boundary between workforce and external tenants.
• Before buying: map existing entitlements to your required policies, lifecycle actions and customer flows. Include critical non-Microsoft applications in the pilot rather than assuming they require a different identity provider.

Okta and Auth0

• Best for: Workforce access across mixed applications; Auth0 for a separate customer-identity evaluation.
• Core offering: Okta is worth evaluating for workforce access across a mixed application estate. Its Integration Network currently advertises more than 8,000 integrations. That count is a discovery aid: an integration offering SSO does not necessarily support provisioning, entitlement management or logout. Check the functions listed for each application. Okta Integration Network.
• Governance: Governance should also be part of the evaluation. Okta Identity Governance documents access requests, certifications, entitlement management and separation-of-duties controls. Evaluate those governance functions alongside the workforce access products. Okta governance documentation.
• Customer identity: For application developers, Auth0 is a separate customer-identity buying decision. Its pricing distinguishes B2C and B2B requirements and scales with monthly active users and feature limits. Auth0 pricing.
• Watchpoint: Connector functions and the combined cost of workforce, governance and customer products.
• Before buying: obtain a quote for the actual combination of workforce, governance and customer products. Test deprovisioning and customer-organization isolation, not just the first successful login.

JumpCloud

• Best for: IT teams coordinating user access and managed devices.
• Core offering: JumpCloud is worth considering when a small or midsize IT team wants to coordinate user access and device administration. Its packages combine different identity and device capabilities, so compare the package against your device inventory and support workflow. JumpCloud packages.
• Passwordless access: JumpCloud Go offers phishing-resistant, device-bound authentication with prerequisites. Its documentation specifies managed accounts and devices, a running agent, supported browser extensions and hardware requirements. Current desktop support includes qualifying macOS, Windows and Linux devices; biometric support differs by operating system. JumpCloud Go requirements.
• Watchpoint: Endpoint compatibility, recovery and the depth of any required governance workflow.
• Before buying: test the devices, browsers, remote workers and recovery scenarios you actually support. A smooth demonstration on one managed laptop does not establish compatibility with every endpoint. If complex access certifications are a central requirement, evaluate that workflow separately instead of inferring it from the directory and SSO feature set.

Ping Identity

• Best for: Complex customer or workforce identity journeys and hybrid architectures.
• Core offering: Ping is a candidate when identity journeys, legacy applications and deployment control make the architecture more complex. PingOne Advanced Identity Cloud is the current name for the former ForgeRock Identity Cloud. Ping also offers self-managed software that can work alongside the cloud service. Choose the cloud service and self-managed components separately when designing a hybrid deployment. PingOne Advanced Identity Cloud.
• Operating fit: Ping deserves consideration for complex CIAM or hybrid access programs; the purchasing question is whether your team can operate the proposed design over its lifetime.
• Watchpoint: Product boundaries, migration dependencies and responsibility for operations.
• Before buying: diagram the target products, directories, connectors and environments. Ask who maintains custom journeys, how configuration moves into production, and how rollback works. For an existing ForgeRock deployment, require a product-specific migration plan. A shared vendor name does not establish automatic feature parity or a migration-free upgrade.

Red Hat build of Keycloak

• Best for: Teams that want to operate application identity themselves with commercial support for an open-source-based platform.
• Core offering: Red Hat build of Keycloak adds a commercially supported, self-managed option to this shortlist. Its upstream Keycloak project provides application SSO, identity brokering and directory federation using standards including OpenID Connect and SAML. Evaluate it for application authentication and federation; assess specialized access-governance and privileged-session requirements separately. Keycloak capabilities, Red Hat product documentation.
• Commercial model: The commercial model matters. Red Hat lists entitlement through qualifying Runtimes and OpenShift subscriptions and says the product is not sold as a separate standalone offering. Even in the listed managed OpenShift environments, Keycloak remains customer-installed software that Red Hat supports but does not operate for you. Subscription and operating responsibilities.
• Watchpoint: Subscription entitlement, supported configurations and responsibility for availability, upgrades and recovery.
• Before buying: check the support matrix for your database, runtime and deployment platform. Test upgrades, backups, failover, authenticator recovery and any custom extensions. Distinguish community Keycloak releases from the supported Red Hat build when planning patches and migration. Budget for the team that will operate the service, alongside the relevant subscription. Supported configurations, support lifecycle.

Thales OneWelcome

• Best for: Customer and partner identity, including consent and delegated administration.
• Core offering: Thales OneWelcome is worth evaluating for customer and partner identity programs that need registration, delegated administration and consent controls. Its platform includes multiple identity capabilities, and the consent-and-preference module can be purchased separately. Avoid assuming every Thales authenticator or identity product is included in a OneWelcome subscription. OneWelcome platform, consent and preference management.
• Commercial terms: Request an explicit commercial definition of the billable identity or activity, together with the modules included. A generic “MAU-based” label is not enough to establish how your proposed deployment will be charged.
• Watchpoint: Module scope, billable usage definitions and customer-data handling.
• Before buying: demonstrate a customer changing consent, recovering access and requesting account deletion. For B2B access, test a partner administrator assigning and removing permissions without crossing organization boundaries. Verify where identity data and backups are stored and who can access them for support.

SailPoint

• Best for: Identity governance, access certification and lifecycle programs.
• Core offering: SailPoint belongs on a governance-focused shortlist: access requests, lifecycle processes, certification campaigns and entitlement decisions. Identity Security Cloud is its SaaS offering. IdentityIQ remains a customer-hosted option, so the deployment decision depends on the product selected. Identity Security Cloud, SailPoint’s fiscal 2026 product description.
• Operating requirements: Do not select governance software solely from a demonstration of AI recommendations. Your implementation still needs reliable identity records, accountable application owners and a process for handling exceptions. Compare the governance product alongside the authentication and PAM systems it must coordinate with.
• Watchpoint: Entitlement-data quality and whether revocation reaches each target application.
• Before buying: ask reviewers to work with a sample of your real entitlement data. Can they understand access descriptions, identify an inappropriate permission and verify that revocation reached the application? Also test an employee changing roles and a contractor reaching an end date.

Saviynt

• Best for: Cloud governance, application access controls and privileged-access programs.
• Core offering: Saviynt’s current portfolio includes identity governance, application access governance, privileged access management and other identity-security products. Its PAM materials describe discovery, governance and just-in-time access. Validate that advertised scope against your target systems in the pilot. Saviynt products, Saviynt PAM.
• Implementation: A common platform can be attractive, but consolidation should be measured through supported workflows and operating effort. It should not be assumed from the platform label.
• Watchpoint: Supported targets and the application-level rules or PAM functions you need.
• Before buying: verify connector behavior for your important business applications and the rules needed to prevent incompatible access combinations. For PAM, require demonstrations against your actual server, database and cloud targets, including approval, credential handling, session control and access expiry where those functions are requirements.

Palo Alto Networks Idira

• Best for: Privileged access and a broader identity-security program built on CyberArk.
• Core offering: Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026. Its current identity-security platform is presented as Idira, built on CyberArk’s foundation. Buyers may still encounter CyberArk names in existing contracts and documentation, making product mapping an important part of a new purchase or renewal. Acquisition announcement, Idira platform.
• Portfolio scope: Privileged access remains a relevant reason to shortlist the portfolio. Current product pages also cover workforce SSO, adaptive MFA and identity governance, which should be scoped and priced separately in a proposal. Idira IAM, Idira governance.
• Watchpoint: Current product names, integration availability and separately licensed components.
• Before buying: request a mapping between the products quoted, existing CyberArk deployments and current Idira names. Confirm which integrations are available now, which are separately licensed and which are roadmap commitments. Test the privileged-access controls you need independently of the broader platform story.

One Identity

• Best for: Governance and PAM programs involving Microsoft directory administration.
• Core offering: One Identity brings together Identity Manager for governance, Safeguard for privileged access, OneLogin for cloud access management and Active Roles for Microsoft environment administration. Its current identity-fabric description presents these as related parts of a broader offering. One Identity portfolio.
• Deployment: Safeguard’s product family includes privileged credential and session controls, with a SaaS-delivered Safeguard On Demand option. Deployment decisions therefore need to be made at product level. Safeguard products.
• Operating fit: The portfolio is a relevant candidate for governance and PAM programs involving substantial Microsoft directory administration. Whether it simplifies operations depends on the integration you deploy and the skills available to maintain it.
• Watchpoint: Integration effort, multiple administrative consoles and module costs.
• Before buying: ask the vendor to demonstrate the complete joiner, mover and leaver process across the proposed components. Identify every administrative console, integration dependency and support boundary. Include module subscriptions and implementation services in the cost comparison.

What matters in a 2027 evaluation

Phishing resistance includes enrollment and recovery

Ask which authentication methods are supported and which policies enforce their use. CISA recommends moving toward phishing-resistant MFA, including FIDO/WebAuthn. NIST SP 800-63B-4 requires a phishing-resistant option at AAL2 within its assurance framework; this is not a claim that every organization is legally required to use that framework. CISA guidance, NIST assurance levels.

For a pilot, include enrollment, a lost device, replacement credentials and administrator recovery. Treat the complete recovery path as part of the security design. A passkey checkbox alone does not answer those operational questions.

Give non-human identities an owner and an end date

For service accounts, workloads and AI agents, require a named owner, an inventory of permissions and a way to revoke access. Test whether the system can distinguish a person’s approval from the automated activity performed under that approval.

Ask vendors to demonstrate the specific identity types and systems you use. Separate generally available controls from previews and roadmap presentations. A feature that summarizes permissions is different from one that can enforce a narrower scope or terminate access.

Verify lifecycle changes in the applications themselves

An identity provider showing an account as disabled is not sufficient evidence that every application session and credential stopped working. Design the pilot to check downstream accounts, existing sessions, API credentials and local exceptions. Record what happens automatically and what requires application-specific configuration or manual action.

Check product lifecycle and ownership before signing

Microsoft Entra Permissions Management retired on November 1, 2025, following an extension. The retirement concerned that product, not the whole Entra portfolio or CIEM as a category. Review the lifecycle notices for the exact products in any proposal. Microsoft retirement notice.

Make trust an evidence request

Ask for current assurance reports with the relevant product and hosting region in scope, incident-notification terms, recent incident disclosures, support-access controls, data-processing terms, log retention and export options. Review how the vendor handles outages and customer recovery.

These checks are purchasing questions, not a claim that every vendor provides the same evidence or satisfies the same requirements. A product’s compliance features also do not make a customer deployment automatically compliant.

Compare the complete cost

Request comparable proposals for the same population, applications, environments and support requirements. Include subscriptions, add-ons, implementation, connector work, migration, hardware authenticators where needed, operational staffing and exit costs.

Published prices can help establish a starting point, but compare their units carefully. Microsoft’s Entra page distinguishes products and license prerequisites. Okta’s workforce pricing has suite conditions and contract terms. Auth0 separates B2C and B2B plans, active-user volumes and feature limits. A workforce seat and a monthly active customer are different billing units. Microsoft pricing, Okta pricing, Auth0 pricing.

Ask the vendor to show how the bill changes when your organization grows, adds an application or requires a previously optional security control. For quote-based products, use “contact vendor” until there is a dated, scoped quotation; do not invent a starting price.

A practical pilot before the final decision

Agree on acceptance criteria with the people who will operate the system. Use a small but representative set of applications and users, including one difficult integration.

For a CIAM project, add registration abandonment, accessibility, account recovery, consent changes and B2B tenant-isolation tests. Set pass/fail thresholds around business needs; do not let the vendor’s default demonstration define success.

How we prepared this guide

We compared public product documentation, deployment descriptions, pricing pages and lifecycle announcements from the ten vendors, alongside CISA and NIST guidance on authentication. The review date above applies to the research for this edition; product terms can change after that date. Source links sit next to the claims they support.

The selection covers common workforce, governance, privileged-access and customer-identity buying scenarios, including a commercially supported option based on open source for teams that want to operate application identity themselves. It is a shortlist, not an exhaustive market survey. We did not assign numerical scores because these products address different jobs and were not tested under a common benchmark.

Evidence limits: this is a documentation-based comparison. We did not conduct hands-on performance testing, penetration testing, a comprehensive incident-history review or an independent audit of vendor security claims. Recommendations about fit are editorial judgments. Vendor documentation establishes advertised capabilities; buyers still need to verify edition, availability, integration behavior and contractual scope.

Security due diligence: review current incident disclosures and remediation, assurance-report scope, privileged support access, recovery procedures and audit-log access for the proposed product and hosting region. A certification or a feature list alone does not establish the security of your deployment.

Edition note: this edition checks product names and ownership, distinguishes SaaS from self-managed offerings, and separates workforce access, IGA, PAM and CIAM. Logos identify the vendors and products discussed; they do not indicate endorsement.

Frequently asked questions