CIAM stands for customer identity and access management: the system that handles registration, login, profiles, consent and account recovery for an application's customers and consumers. It is not workforce IAM, which manages employee access, and it is not identity governance or document-based identity verification.

How is CIAM different from workforce IAM?

Workforce IAM secures employees, who must complete whatever login the company requires, and is centered on governance and SSO into internal apps. CIAM secures customers, who abandon a flow with too much friction, so it is built around self-service sign-up, social and passkey login, consent records, fraud defense and pricing per monthly active user.

What features matter most in CIAM?

Passkey and passwordless login with a safe fallback, MFA, bot and account-takeover defense, recovery that is not weaker than login, versioned consent records, standards-based APIs (OIDC and OAuth 2.0), and for B2B SaaS, tenants with per-customer SAML or OIDC SSO and SCIM provisioning.

How much does CIAM cost?

Most developer-focused CIAM platforms publish prices and free tiers. Free tiers verified on 30 October 2026 ranged from 5,000 MAU (SuperTokens managed cloud) to 1,000,000 MAU (WorkOS AuthKit), with Auth0 at 25,000 MAU and Amazon Cognito at 10,000. Enterprise CIAM vendors such as Transmit Security and SAP Customer Data Cloud are quote-only. B2B pricing is often driven by per-connection SSO and SCIM fees rather than users.

Is CIAM HIPAA compliant?

A product is not HIPAA compliant on its own; a covered entity needs a vendor that will sign a business associate agreement (BAA) and configure it correctly. Auth0's compliance documentation, checked 5 November 2026, says it signs a BAA on request for covered entities. Check each vendor's trust center before relying on it.

Do I still need CIAM if customers use digital identity wallets?

Yes. Wallets such as the EU Digital Identity Wallet present verified attributes at sign-up or checkout, but you still need accounts, sessions, recovery and consent. Expect your CIAM platform to accept wallet presentations over OpenID4VP rather than be replaced by them.

What Is Customer Identity and Access Management (CIAM)?

CIAM (customer identity and access management) is the identity layer that handles sign-up, login, profiles, consent and access for an application's customers and consumers, not its employees. It is built for consumer scale and conversion, with self-service registration, social and passkey login, and account recovery. It is not workforce IAM, identity governance, or document-and-selfie identity verification, though it often calls verification vendors at sign-up.

Verdict as of November 2026: buy CIAM rather than build it, choose on standards support, recovery and fraud controls and the pricing unit (MAU, retained users or SSO connections), and make passkeys the default sign-in. For a shortlist, see best CIAM platforms; for the one-line definition, the CIAM glossary entry.

How CIAM differs from workforce IAM

Workforce IAM optimizes for control and governance. CIAM optimizes for conversion, scale and experience: every extra field or friction point in a signup flow costs revenue. CIAM systems also carry privacy and consent obligations that internal systems usually do not. Our CIAM vs IAM article goes deeper.

	Workforce IAM	CIAM
Users	Employees and contractors, known in advance via HR	Customers who register themselves
Scale	Thousands to hundreds of thousands	Up to tens of millions, with spiky traffic
Friction tolerance	High: login is part of the job	Low: users abandon
Core features	SSO to internal apps, governance, access reviews	Registration, social and passkey login, consent, recovery, fraud defense
Typical pricing	Per employee per month	Per monthly active user, or per enterprise connection in B2B
Main threat	Phishing of staff, privilege misuse	Credential stuffing, account takeover, fake sign-ups

B2C vs B2B CIAM

B2C serves individual consumers: high volume, social login, progressive profiling, fraud and bot defense.
B2B / SaaS serves organizations: tenants, enterprise SSO and SCIM for your customers, and delegated administration. Many developer-first platforms specialize here. See B2B vs B2C CIAM and best CIAM for B2B SaaS.

The standards underneath

A CIAM platform should speak open protocols so you can change vendors later:

OpenID Connect and OAuth 2.0 (moving to OAuth 2.1) for sign-in and API access tokens.
WebAuthn and FIDO2 for passkeys.
SAML 2.0 and SCIM 2.0 in B2B, where your customers bring their own IdP and expect automated provisioning.
FAPI for banking and other high-value APIs.

Common capabilities

Passwordless and passkeys, social login, MFA, bot and account-takeover defense, consent capture, hosted or embeddable login UI, user migration tools, and APIs and SDKs for developers.

What makes CIAM hard

The hard problems are not login. They are the ones that only appear at consumer scale:

Fraud and account takeover. Consumer accounts are attacked continuously with credential stuffing from unrelated breaches and real-time relay kits that capture a valid session. Rate limiting alone will not stop distributed attempts from residential proxies. See CIAM account takeover prevention.
Recovery at scale. Every recovery path is an attack path. Email-based reset makes the account exactly as strong as the mailbox, and knowledge-based questions are answerable from public data.
Consent as a data problem. Regulators ask what a specific user was shown and agreed to at a specific moment. That needs versioned consent records tied to policy text, not a boolean column. See consent management.
Migration. Moving an existing user base means transferring password hashes, invalidating sessions and re-enrolling MFA, usually with a dual-run period rather than a switch. See the CIAM migration guide.
Cost curves. Per-MAU pricing that is reasonable at 50,000 users can dominate unit economics at 5 million.

What CIAM costs in 2026

CIAM is one of the more transparent identity categories. In our Identity Pricing Transparency Index, 55.2% of the 29 CIAM vendors publish a paid price and 24.1% are quote-only. Free tiers checked live on 30 October 2026:

Vendor	Free tier	Paid entry point
WorkOS AuthKit	1,000,000 MAU	$125 per SSO or Directory Sync connection (1 to 15)
Clerk	50,000 monthly retained users per app	Pro $25/month
Microsoft Entra External ID	50,000 MAU	Pay-as-you-go
Auth0 (Okta)	25,000 MAU	Essentials from $35/month (B2C) or $150/month (B2B)
Amazon Cognito	10,000 MAU	Essentials $0.015 per MAU
Stytch (Twilio)	10,000 MAU	Pay as you go

Two traps: "active user" is defined differently by each vendor (Clerk counts retained users, Stytch counts AI agents alongside users), and in B2B the per-connection SSO and SCIM fees can exceed the user fees. Enterprise-focused vendors such as Transmit Security are quote-only. See CIAM pricing models explained.

Compliance: what to ask for

Certifications belong to the vendor's service, not your deployment. Ask for the current SOC 2 Type II report, the ISO/IEC 27001 certificate and its edition, and, if you handle US health data, a signed HIPAA business associate agreement. As one example, Auth0's compliance documentation, checked 5 November 2026, lists an annual SOC 2 Type 2 audit, ISO 27001, 27017 and 27018 certification, and a BAA on request for covered entities. Our compliant CIAM platforms and CIAM for healthcare rankings track this per vendor.

Where CIAM is heading

Two shifts are visible in 2026. First, passkeys are mainstream in consumer sign-in. The FIDO Alliance's Passkey Index 2026 reports that 36% of successful sign-ins at participating services now use a passkey, up from 26% in 2025, and that passkey sign-ins succeed 93% of the time against 78% for traditional MFA. Amazon said on 20 October 2026 that more than 500 million customers have enabled passkeys. The gain only holds once the password fallback and weak recovery go.

Second, regulation is pushing toward holder-presented credentials. Under eIDAS 2.0, EU member states must offer an EUDI Wallet by the end of 2026, and private relying parties that are legally or contractually required to use strong user authentication, including banks, must accept it on user request within 36 months of the December 2024 implementing acts. That changes identity verification at the front of the funnel; it does not replace the customer account.

Where to start

Compare CIAM vendors, read how to evaluate CIAM, check segment rankings such as best CIAM for startups and best CIAM for enterprises, or see head-to-head comparisons like Auth0 vs Clerk.