How do I choose an IAM platform?

Map your users, applications and the protocols each app speaks (SAML, OIDC, LDAP, header-based), decide your HR source of truth, then score candidates on authentication, SSO, lifecycle and SCIM provisioning, governance, admin security and pricing. Pilot the top two against your five hardest applications and test the mover case, not just joiners and leavers. Check vendor ownership and document the exit before you sign.

What should I compare when choosing a workforce IAM platform?

Compare authentication and MFA, SSO and federation, lifecycle and SCIM provisioning, authorization, governance and audit, developer experience, deployment flexibility, pricing transparency, and support, weighted for your context. Before demos, record your headcount including contractors, which apps speak SAML or OIDC, your HR system of record, on-premises versus cloud needs, and compliance obligations, then pilot the top two against your real apps.

What is the best IAM for a small business?

For most small businesses the shortlist is JumpCloud (directory, device management and SSO in one), Microsoft Entra ID if you already pay for Microsoft 365, Okta Workforce Starter, OneLogin and miniOrange. On October 30, 2026 SWI read JumpCloud SSO at $11 per user per month billed annually and Okta Starter at $6 per user per month with a $1,500 annual minimum, which matters below about 20 users.

Is Microsoft Entra ID cheaper than Okta?

Only if you compare like for like. On October 30, 2026 SWI read Entra ID P1 at $7 and P2 at $10 per user per month paid yearly, and Okta Workforce Starter at $6 and Essentials at $17 with a $1,500 annual minimum. Entra's free tier comes with Microsoft 365, but conditional access, identity protection and access reviews need P1 or P2. Price Entra at P1 or P2 across the whole workforce against a competitor's realistic bundle including lifecycle management.

How do I test joiner-mover-leaver automation in an IAM pilot?

Name your five hardest applications, usually the ones without a clean SCIM endpoint, and ask each vendor to connect to them during the pilot. Test the mover case explicitly: internal transfers that add new access without removing the old role are the most common audit finding in workforce identity, and they are the case most demos skip.

How should a workforce IAM platform handle non-human identities?

Ask how it assigns ownership, expiry, and review to service accounts, workloads, and AI agents, which outnumber employees in most environments. Check whether agent identities receive short-lived tokens rather than static API keys or client secrets. In November 2026 one actor signed in to Entra ID as applications with stolen client secrets and reached 27 organizations, so this is a current evaluation question.

How do I avoid lock-in with an IAM platform?

Document the exit before you sign. Confirm you can export users, group memberships, and application assignments, find out what happens to enrolled MFA factors and passkeys if you migrate, and prefer standard OIDC and SAML over proprietary extensions. Passkeys are bound to a relying party identifier, so choose that domain early. Also check vendor ownership, since an acquisition can change roadmap and packaging.

Who owns the major IAM vendors in 2026?

Okta and Microsoft are public. Ping Identity, which owns ForgeRock, is held by Thoma Bravo. OneLogin is part of One Identity, which announced a separation from Quest Software in June 2026. CyberArk was acquired by Palo Alto Networks on February 11, 2026 and rebranded as Idira on May 12, 2026. JumpCloud is private.

Buyer Guides · Intermediate

How to Choose an IAM Platform in 2026: A Buyer's Checklist

By SWI Community Team · Updated 2026-11-05 · 11 min

To choose an IAM platform, map your users, applications and their protocols first, then score candidates on lifecycle depth, admin security and honest three-year cost, and pilot the top two against your hardest applications. A workforce IAM platform runs sign-in, SSO, MFA and provisioning for employees and contractors, and it is a multi-year commitment, so the expensive mistakes are made before the demo, not after it.

This checklist is for IT and security teams buying or replacing workforce identity. For customer identity, use the CIAM buyer guide instead; the products and the pricing units differ.

Shortlist by situation (November 2026)

Your situation	Start with	Ranking to read
Microsoft 365 shop, Windows endpoints	Microsoft Entra ID at P1 or P2	Best IAM for enterprises
Mixed SaaS estate, wants neutral integration catalog	Okta Workforce Identity	IAM platforms compared
Complex federation, hybrid or self-hosted needs	Ping Identity (including ForgeRock)	Best IAM for enterprises
Small business, needs directory plus devices	JumpCloud, OneLogin, miniOrange	Best IAM for small business
AWS-only access for engineers	AWS IAM Identity Center federated to your main IdP	Multi-cloud IAM strategy
Full control, open source	Keycloak, Zitadel	Top 10 open source IAM

Vendor profiles: Okta, Microsoft Entra, Ping Identity, ForgeRock, JumpCloud, OneLogin, miniOrange, IBM Verify, AWS IAM Identity Center, Keycloak and Zitadel. The top 10 enterprise IAM platforms in 2026 and the workforce identity platform comparison cover the field.

1. Map your requirements first

Before demos, write down: number of employees and contractors, your apps and how each authenticates (SAML, OIDC, LDAP, header-based or local passwords), your HR system of record, on-premises versus cloud needs, and your compliance obligations. Expect SAML to dominate the list: in SWI's Phishing-Resistant MFA Support Matrix, 83 of 95 business SaaS apps offered SAML and 30 offered OpenID Connect. The legacy protocols decide how much bridging, and which vendor, you need.

2. Score the capabilities that matter to you

Use our published 10-dimension methodology as a checklist: authentication and MFA, SSO and federation, lifecycle and SCIM provisioning, authorization, governance and audit, developer experience, deployment flexibility, pricing transparency, and support. Weight them for your context, then compare candidates in the capability checker and narrow with the vendor selector.

Standards support to require in 2026: WebAuthn for passkeys (Level 3 became a W3C Recommendation on August 25, 2026), SCIM 2.0 both inbound from HR and outbound to apps, and the Shared Signals Framework (SSF, CAEP and RISC reached Final on August 29, 2025) so session revocations reach downstream apps.

3. Price the comparison honestly

Most workforce IAM evaluations are decided on cost, and most cost comparisons are unfair. Only 25% of the 20 IAM platform vendors in the Identity Pricing Transparency Index 2026 publish a paid price, and 65% are quote-only. The published anchors, read on October 30, 2026:

Platform	Published price	Watch for
Okta Workforce	Starter $6, Essentials $17 per user per month	$1,500 annual minimum; Professional and Enterprise are quoted
Microsoft Entra ID	P1 $7, P2 $10, Entra Suite $12, ID Governance $7 per user per month, paid yearly	Conditional access needs P1; risk policies and access reviews need P2 or Governance
JumpCloud	SSO $11 per user per month billed annually	Platform suites quoted; no permanent free tier
AWS IAM Identity Center	No extra charge	Cost sits in the IdP you federate to it
Ping, IBM Verify, ForgeRock	Quote-only	Budget professional services for federation work

Comparing bundled-base Entra against a full Okta quote is not a comparison. Price Entra at P1 or P2 across the whole workforce against a competitor's realistic bundle including lifecycle management, add a separate MDM where the platform lacks one, and add the SSO tax your SaaS vendors charge to enable federation. Model three years with the TCO calculator and see Okta vs Microsoft Entra.

4. Test lifecycle against your worst applications

Single sign-on demos well everywhere. Provisioning is where platforms differ, and the difference only appears against the applications that do not have a clean SCIM endpoint. Name your five hardest targets and ask each vendor to connect to them during the pilot.

Test the mover case specifically, not just joiner and leaver. Internal transfers that add access without removing the old role (mover entitlement accumulation) are the most common audit finding in workforce identity, and they are the case most demos skip. Then test the leaver: the Colonial Pipeline intrusion began on a legacy VPN account that should not have existed (orphaned account abuse).

5. Test the admin and recovery paths

The incidents that hit IAM customers mostly come through the tenant, not the vendor's code:

Help desk resets of admin MFA. In 2023 attackers called service desks to reset Okta super administrator factors at several customers (help desk social engineering). Ask how the platform restricts who can reset admin factors and alerts on it.
Forgotten tenants and over-privileged apps. Midnight Blizzard sprayed a non-production Microsoft tenant account without MFA, then used a legacy OAuth app with elevated access (teardown).
Accounts without MFA on remote access. Change Healthcare was reached through a Citrix portal with no MFA. Require proof that every federated path enforces MFA, and compare factors in the MFA matrix.
Provider-side support systems. The 2023 Okta support system breach took session tokens from customer-uploaded HAR files (teardown).

6. Ask where non-human identities live

Service accounts, workloads, and AI agents outnumber employees in most environments. Ask how the platform handles ownership, expiry, and review for them, and whether agent identities get short-lived tokens rather than static API keys. On November 3, 2026 Todyl reported an actor signing in to Entra ID as applications with stolen client secrets and reaching 27 organizations. A secret is the app, with no MFA step to fail, so ask whether the platform supports workload identity federation instead.

7. Check ownership before a multi-year term

Consolidation reshaped the field in 2025 and 2026. Per SWI's acquisitions data and vendor profiles:

Palo Alto Networks closed its acquisition of CyberArk on February 11, 2026 and rebranded it Idira (formerly CyberArk) on May 12, 2026.
Okta closed its purchase of Permiso Security on August 26, 2026 for ITDR, after Axiom Security in 2025.
Ping Identity added Procyon (now PingOne Privilege) in 2025 and announced the Keyless acquisition on October 30, 2025.
OneLogin's parent One Identity announced a separation from Quest Software in June 2026, not yet confirmed closed.
Rubrik acquired identity orchestration vendor Strata Identity on June 9, 2026.

Ask every vendor whether standalone sales and the current packaging continue for your term, and put a renewal cap in writing. The Identity Consolidation Report 2026 tracks the rest.

8. Plan the exit before you sign

A multi-year identity commitment deserves a documented answer to: can we export users, group memberships, and application assignments; what happens to enrolled MFA factors and passkeys if we migrate; and does the platform speak standard OIDC and SAML rather than proprietary extensions. Passkeys in particular are bound to a relying party identifier, so decide that domain early. Keep break-glass accounts outside the platform and test the identity disaster recovery plan before go-live.

Where to start

Browse IAM platforms, read Okta vs Ping Identity, Okta vs JumpCloud and Microsoft Entra vs Ping Identity, and send every finalist the same scope with the RFP builder.

Frequently asked questions

How do I choose an IAM platform?: Map your users, applications and the protocols each app speaks (SAML, OIDC, LDAP, header-based), decide your HR source of truth, then score candidates on authentication, SSO, lifecycle and SCIM provisioning, governance, admin security and pricing. Pilot the top two against your five hardest applications and test the mover case, not just joiners and leavers. Check vendor ownership and document the exit before you sign.
What should I compare when choosing a workforce IAM platform?: Compare authentication and MFA, SSO and federation, lifecycle and SCIM provisioning, authorization, governance and audit, developer experience, deployment flexibility, pricing transparency, and support, weighted for your context. Before demos, record your headcount including contractors, which apps speak SAML or OIDC, your HR system of record, on-premises versus cloud needs, and compliance obligations, then pilot the top two against your real apps.
What is the best IAM for a small business?: For most small businesses the shortlist is JumpCloud (directory, device management and SSO in one), Microsoft Entra ID if you already pay for Microsoft 365, Okta Workforce Starter, OneLogin and miniOrange. On October 30, 2026 SWI read JumpCloud SSO at $11 per user per month billed annually and Okta Starter at $6 per user per month with a $1,500 annual minimum, which matters below about 20 users.
Is Microsoft Entra ID cheaper than Okta?: Only if you compare like for like. On October 30, 2026 SWI read Entra ID P1 at $7 and P2 at $10 per user per month paid yearly, and Okta Workforce Starter at $6 and Essentials at $17 with a $1,500 annual minimum. Entra's free tier comes with Microsoft 365, but conditional access, identity protection and access reviews need P1 or P2. Price Entra at P1 or P2 across the whole workforce against a competitor's realistic bundle including lifecycle management.
How do I test joiner-mover-leaver automation in an IAM pilot?: Name your five hardest applications, usually the ones without a clean SCIM endpoint, and ask each vendor to connect to them during the pilot. Test the mover case explicitly: internal transfers that add new access without removing the old role are the most common audit finding in workforce identity, and they are the case most demos skip.
How should a workforce IAM platform handle non-human identities?: Ask how it assigns ownership, expiry, and review to service accounts, workloads, and AI agents, which outnumber employees in most environments. Check whether agent identities receive short-lived tokens rather than static API keys or client secrets. In November 2026 one actor signed in to Entra ID as applications with stolen client secrets and reached 27 organizations, so this is a current evaluation question.
How do I avoid lock-in with an IAM platform?: Document the exit before you sign. Confirm you can export users, group memberships, and application assignments, find out what happens to enrolled MFA factors and passkeys if you migrate, and prefer standard OIDC and SAML over proprietary extensions. Passkeys are bound to a relying party identifier, so choose that domain early. Also check vendor ownership, since an acquisition can change roadmap and packaging.
Who owns the major IAM vendors in 2026?: Okta and Microsoft are public. Ping Identity, which owns ForgeRock, is held by Thoma Bravo. OneLogin is part of One Identity, which announced a separation from Quest Software in June 2026. CyberArk was acquired by Palo Alto Networks on February 11, 2026 and rebranded as Idira on May 12, 2026. JumpCloud is private.

Last reviewed November 5, 2026By SWI Community TeamSuggest a correction How we research