How do I choose an IGA platform?

Define the outcomes you need (access reviews, lifecycle provisioning, separation of duties, roles), prove connectors against your five hardest applications, check who owns the vendor in 2026, get a line-item quote scoped by identity count and modules, and pilot a real certification campaign that measures revocations, not completions.

What should I look for in an IGA tool?

Start with outcomes and connectors. Decide whether you need access reviews, automated provisioning, separation of duties, role management, or all of them, then confirm every target system (HR, cloud, SaaS, on-premises, mainframe) has a supported, maintained connector. Thin connector coverage turns into costly custom work. Then pilot a real certification campaign against your hardest applications rather than the vendor's reference architecture.

What are the best IGA tools in 2026?

For large regulated enterprises, SailPoint and Saviynt lead most shortlists, with Omada and One Identity as alternatives. For SaaS-heavy companies, C1, Lumos and Zluri deploy faster. Veza, now owned by ServiceNow, is strongest at effective-permission visibility. midPoint by Evolveum is the leading open source IGA tool. See SWI's best IGA tools ranking for scores.

Should I choose a cloud-native or a traditional IGA platform?

Match it to your environment. Newer cloud-native governance tools deploy fast and are strongest on SaaS applications, while established suites go deeper on complex legacy estates such as mainframes and older ERP systems. Also check ownership: Veza, C1, Zilla, EmpowerID and Zluri all changed hands or agreed to between 2025 and October 2026.

How much does an IGA platform cost?

Expect a quote. In SWI's Identity Pricing Transparency Index, checked October 30, 2026, none of 20 IGA vendors published a paid price and 17 were quote-only. Vendors price by managed identities and modules. The one public anchor SWI found was Microsoft Entra ID Governance at 7 dollars per user per month, paid yearly. Budget for implementation services on top of the subscription.

Why do IGA implementations take so long?

Usually because of identity data quality, not the product. The HR system, directory, and applications disagree about who exists, which accounts belong to whom, and what each entitlement means, and reconciling that is a project of its own. Measure what share of accounts in your target systems map to an authoritative identity today; if you do not know, that is your first work item.

How do I make access certification campaigns revoke access instead of rubber-stamping it?

Translate entitlements into business language, show usage data next to each grant, such as access not used in 180 days, and make revocation the low-effort default instead of an exception needing justification. Reviewers shown raw names like APP_FIN_GL_RW_PROD approve everything. Ask each vendor to demonstrate all three, because auditors increasingly ask for the revocation rate, not the completion rate.

Do IGA platforms govern service accounts and AI agents?

Most certification campaigns skip them, because service accounts and workloads have no manager to attest for them, even though they outnumber employees in most environments. Ask each vendor how it assigns owners, runs reviews, and handles AI agents. SailPoint bought Entro Security (closed 29 June 2026) and Omada bought EmpowerID (24 September 2026) to close this gap.

Buyer Guides · Intermediate

How to Choose an IGA Platform in 2026

By SWI Community Team · Updated 2026-11-05 · 11 min

To choose an IGA platform, decide which governance outcomes you need, prove connectors against your worst applications, check 2026 ownership and get a comparable quote, then pilot a certification campaign that actually revokes access. Identity governance and administration (IGA) projects succeed or fail on fit, connectors and identity data quality far more than on feature lists.

Shortlist by situation (November 2026)

Your situation	Start with	Read next
Large regulated enterprise, SOX and complex ERP	SailPoint, Saviynt	SailPoint vs Saviynt
EU data residency, faster standard rollout	Omada	Omada vs Saviynt
Microsoft and Active Directory heavy	One Identity, Microsoft Entra ID Governance	One Identity alternatives
SaaS-first company, wants reviews live in weeks	C1, Lumos, Zluri	C1 vs Lumos, Zluri vs Lumos
Need effective permissions across cloud and data	Veza	Veza vs SailPoint
Already standardized on Idira (formerly CyberArk)	Zilla Security	Best IGA tools
Budget or sovereignty requires self-hosting	midPoint by Evolveum, Soffid	Top open source IGA tools

For scored comparisons, see the best IGA tools and compliant IGA platforms rankings. Replacing an incumbent? Start with SailPoint alternatives.

1. Define the outcomes you need

Access reviews and certifications, automated provisioning, separation of duties, role management, or all of the above? A company that only needs quarterly SOC 2 access reviews for 40 SaaS apps is buying a different product from a bank that needs SoD inside SAP. Compliance-driven buyers should map requirements to frameworks first; see the audit preparation guide.

2. Check connector coverage on your five worst applications

IGA lives or dies on integrations. Every platform demos well against Active Directory and a well-behaved SaaS app. Ask each vendor to connect, during the proof of concept, to your five hardest systems: the mainframe, the ERP with no modern API, the homegrown application whose owner left, the SaaS tool with a proprietary permission model, and the cloud account with role chaining. Record for each whether the connection is a maintained connector, a SCIM integration, a flat-file feed or custom code you will own.

3. Check who owns the vendor

Governance is where identity platforms keep buying point tools. As of November 5, 2026: Veza belongs to ServiceNow (closed 2 March 2026); Workday agreed on 13 October 2026 to acquire C1, expected to close by 31 January 2027; Zilla is part of Palo Alto Networks' Idira portfolio; Omada acquired EmpowerID on 24 September 2026; Infotech acquired Zluri on 14 October 2026; One Identity announced in June 2026 that it will become independent. Ask each vendor in writing whether standalone sales and your connectors are committed for your full term. The Identity Consolidation Report 2026 tracks the pattern.

4. Get a quote you can compare

In the Identity Pricing Transparency Index 2026, IGA scored 5 out of 100: none of 20 vendors published a paid price. SailPoint, Saviynt, Lumos, Veza and C1 all sent SWI to sales on October 30, 2026. Send every vendor the same scope sheet: identity counts by type (employees, contractors, service accounts), the target app list and connector type for each, and modules in year one versus later. The one public anchor is Microsoft Entra ID Governance at 7 dollars per user per month paid yearly. Model three years including implementation services in the TCO calculator, and use the RFP builder.

5. Budget for identity data quality

The reason IGA implementations run long is almost never the product. The HR system, the directory and the applications disagree about who exists, which accounts belong to whom, and what an entitlement means. Ask: what percentage of accounts in your target systems can be matched to an authoritative identity today? If you do not know, that is your first work item, and it is independent of vendor selection.

6. Design certification so it produces revocations

A campaign that shows reviewers raw entitlement names produces approvals. APP_FIN_GL_RW_PROD means nothing to a manager, so they approve everything. Campaigns that produce real revocations translate entitlements into business language, show usage data alongside the grant ("not used in 180 days"), and make revocation the low-effort default. Ask each vendor to demonstrate all three. See access certification and access review best practices.

7. Test movers and leavers, not just joiners

Joiners are easy to demo. Ask the vendor to show a transfer from finance to sales removing the finance grants, and a termination that disables every account and revokes active sessions and tokens, not just the directory account. Watch the timing.

8. Ask about non-human identities and AI agents

Service accounts and workloads outnumber employees in most environments and appear in almost no campaign, because they have no manager to attest for them. Ask how each platform assigns owners, reviews machine access and handles AI agents. SailPoint closed its Entro Security acquisition on 29 June 2026 for this reason. See what is non-human identity.

9. Score and pilot

Use the methodology and capability checker to compare governance and lifecycle depth, then run one real certification campaign on a live application. As a planning estimate, not a measured figure, allow 6 to 10 weeks for a pilot that includes two hard connectors and one campaign.

Failure modes your pilot should test

Failure mode	Real incident	What the platform must show
Leaver keeps access	Cash App former employee	Termination disables every connected account
Account left open "to finish work"	CrowdSec departing engineer token	Exceptions expire on a date and tokens are revoked
Forgotten legacy account	Colonial Pipeline legacy VPN	Reconciliation flags accounts with no owner (orphaned account abuse)
Role changes pile up access	Mover entitlement accumulation	Transfers remove prior-role grants
Service accounts never reviewed	Chilean Microsoft 365 spraying	Machine accounts have owners and appear in campaigns

Where to start

Browse all IGA platforms, read the top 7 identity governance platforms, and compare SailPoint vs Saviynt.

Frequently asked questions

How do I choose an IGA platform?: Define the outcomes you need (access reviews, lifecycle provisioning, separation of duties, roles), prove connectors against your five hardest applications, check who owns the vendor in 2026, get a line-item quote scoped by identity count and modules, and pilot a real certification campaign that measures revocations, not completions.
What should I look for in an IGA tool?: Start with outcomes and connectors. Decide whether you need access reviews, automated provisioning, separation of duties, role management, or all of them, then confirm every target system (HR, cloud, SaaS, on-premises, mainframe) has a supported, maintained connector. Thin connector coverage turns into costly custom work. Then pilot a real certification campaign against your hardest applications rather than the vendor's reference architecture.
What are the best IGA tools in 2026?: For large regulated enterprises, SailPoint and Saviynt lead most shortlists, with Omada and One Identity as alternatives. For SaaS-heavy companies, C1, Lumos and Zluri deploy faster. Veza, now owned by ServiceNow, is strongest at effective-permission visibility. midPoint by Evolveum is the leading open source IGA tool. See SWI's best IGA tools ranking for scores.
Should I choose a cloud-native or a traditional IGA platform?: Match it to your environment. Newer cloud-native governance tools deploy fast and are strongest on SaaS applications, while established suites go deeper on complex legacy estates such as mainframes and older ERP systems. Also check ownership: Veza, C1, Zilla, EmpowerID and Zluri all changed hands or agreed to between 2025 and October 2026.
How much does an IGA platform cost?: Expect a quote. In SWI's Identity Pricing Transparency Index, checked October 30, 2026, none of 20 IGA vendors published a paid price and 17 were quote-only. Vendors price by managed identities and modules. The one public anchor SWI found was Microsoft Entra ID Governance at 7 dollars per user per month, paid yearly. Budget for implementation services on top of the subscription.
Why do IGA implementations take so long?: Usually because of identity data quality, not the product. The HR system, directory, and applications disagree about who exists, which accounts belong to whom, and what each entitlement means, and reconciling that is a project of its own. Measure what share of accounts in your target systems map to an authoritative identity today; if you do not know, that is your first work item.
How do I make access certification campaigns revoke access instead of rubber-stamping it?: Translate entitlements into business language, show usage data next to each grant, such as access not used in 180 days, and make revocation the low-effort default instead of an exception needing justification. Reviewers shown raw names like APP_FIN_GL_RW_PROD approve everything. Ask each vendor to demonstrate all three, because auditors increasingly ask for the revocation rate, not the completion rate.
Do IGA platforms govern service accounts and AI agents?: Most certification campaigns skip them, because service accounts and workloads have no manager to attest for them, even though they outnumber employees in most environments. Ask each vendor how it assigns owners, runs reviews, and handles AI agents. SailPoint bought Entro Security (closed 29 June 2026) and Omada bought EmpowerID (24 September 2026) to close this gap.

Last reviewed November 5, 2026By SWI Community TeamSuggest a correction How we research