One Identity
Capability scores
Methodology →- Authentication
- 3.5
- SSO & Federation
- 3.5
- Authorization
- 4.0
- Lifecycle & Provisioning
- 4.5
- MFA & Passwordless
- 3.0
- Governance & Audit
- 4.5
- Developer Experience
- 3.0
- Deployment Flexibility
- 4.0
- Pricing Transparency
- 3.0
- Support & Ecosystem
- 4.0
Scored 0–5 against a published rubric. Independent analysis, no vendor sponsorship.
Overview
One Identity is an identity security company selling a broad identity governance and administration portfolio: Identity Manager for governance and provisioning, Safeguard for privileged access, Active Roles for Active Directory and Entra ID management, and OneLogin for workforce access. Its position is breadth, covering several identity disciplines under one vendor rather than leading any single one, and it says 80 of the Fortune 100 are customers.
The structural picture is changing. On 24 June 2026 One Identity announced it will become an independent company with a new global headquarters in Cork, Ireland, under CEO Praerit Garg, with over 80 percent of engineering based in Europe, separating from Clearlake-backed Quest Software. The transition was described as progressing through 2026, and as of 5 November 2026 we could not confirm it has closed or who the post-separation owners are. Buyers signing multi-year deals should ask which legal entity holds the contract.
What it is good at
Provisioning and lifecycle depth are genuine strengths, with mature role management, certification, and connector coverage for complex estates, including SAP and a generic SCIM 2.0 connector for cloud applications in Identity Manager 9.3. The real advantage is consolidation: governance, PAM, and AD management from one vendor give a unified story for procurement and audit. Active Roles is the differentiator for Active Directory estates, delegating granular rights through role-based templates, and release 8.2 extended that to Entra ID groups and US government GCC High tenants. Identity Manager 8.1 also holds a NIAP Common Criteria certification from April 2020, though for a version well behind current.
Where it falls short
The breadth costs modern polish. Cloud-native organisations used to newer governance tools often find the interface dated, and deployments can be heavy. Teams wanting a single best-of-breed governance product will find more focused depth at SailPoint or Saviynt.
Patch discipline matters on self-managed installs. CVE-2024-56404, a CVSS 9.9 privilege-escalation flaw, affected on-premises Identity Manager 9.x before 9.3, and Safeguard virtual appliances carried CVE-2024-45488 (9.8). None is in the CISA KEV catalog (checked 2026-11-05). Identity Manager 9.3 leaves full support on 5 February 2027, so upgrade planning belongs in the contract. The ownership transition adds procurement uncertainty that most competitors do not carry right now.
Pricing
Quote-based; no list prices published (checked 2026-11-05), even on AWS Marketplace, where Safeguard directs buyers to a separate billing relationship. One reseller SKU suggests Cloud PAM Essentials licenses per managed identity user. Model the all-in cost with the TCO calculator.
Best for, and who should look elsewhere
Choose One Identity when unifying IGA, PAM, and AD management under one vendor in a Microsoft-heavy enterprise is the goal, and you accept the pending separation. For the category leaders, compare SailPoint vs Saviynt; for modern cloud-first governance, see ConductorOne and Lumos; for access visibility, see Veza. More options are in One Identity alternatives.
Bottom line
A broad, consolidation-friendly governance suite for Microsoft-heavy enterprises wanting IGA, PAM, and AD management from one vendor, now carrying the open question of who will own it.
One Identity: frequently asked questions
- What should I check in a One Identity identity governance and administration (IGA) evaluation?
- Start with Identity Manager's version and connector fit. The current line is 9.3, fully supported from 7 January 2025 with limited support from 5 February 2027 and discontinuation on 5 July 2027, so plan the next upgrade into any multi-year deal. Test the connectors you need (SAP, Active Directory, Entra ID, and the generic SCIM 2.0 connector for cloud apps), role mining and certification campaigns, and request workflows. Confirm whether you will self-manage or buy it as a managed service, and patch on-premises installs past CVE-2024-56404 (CVSS 9.9).
- How does One Identity's unified identity platform compare in an IAM company evaluation?
- One Identity is one of few vendors selling governance (Identity Manager), privileged access (Safeguard), Active Directory management (Active Roles), and workforce access management (OneLogin) under one company, which is the core of its unified identity pitch. It says 80 of the Fortune 100 are customers. Against SailPoint or Saviynt it trails on governance mindshare and modern interface polish; against Okta or Microsoft Entra, OneLogin is the smaller access product. Its edge is consolidation for Microsoft-heavy estates. Its open question in 2026 is ownership, after the June 2026 separation announcement from Quest.
- What should I check in a One Identity Active Directory management evaluation?
- Active Roles is the product to test. It delegates granular rights in Active Directory and Entra ID through role-based access templates, so help desk and regional admins work through an approved proxy rather than holding native Domain Admin. Version 8.2 added Entra ID group management and support for US government GCC High tenants, and 8.3.x became fully supported on 14 May 2026, with 8.1.x discontinued from 1 July 2026. Check hybrid AD and Entra coverage, the REST and SCIM interfaces, and how its delegation model maps to your current tiering.
- Is One Identity still part of Quest Software?
- Not for much longer. On 24 June 2026 One Identity announced it will operate as an independent company with a new global headquarters in Cork, Ireland, led by CEO Praerit Garg, with more than 80 percent of its engineering organisation in Europe. It said milestones would be shared as the transition progresses through 2026. As of 5 November 2026 we could not confirm the separation has legally closed, and no investor, valuation, or deal structure has been published. Quest Software, the parent, describes itself as backed by Clearlake Capital.
- How much does One Identity cost?
- Quote-based; no list prices published for any product (checked 2026-11-05). Even the Safeguard listing on AWS Marketplace states that pricing is handled through a separate billing relationship with the vendor. One reseller SKU for Cloud PAM Essentials is priced per managed identity user rather than per managed account, a weak but useful signal about the licensing basis. Treat per-user figures from procurement aggregators as unsourced; they disagree with each other.
- Are there known One Identity security vulnerabilities?
- Yes. The most serious recent one is CVE-2024-56404 (CVSS 9.9, published January 2025), an insecure direct object reference allowing privilege escalation in on-premises Identity Manager 9.x before 9.3. CVE-2024-45488 (9.8) hit Safeguard for Privileged Passwords virtual appliances before 7.5.2. OneLogin had CVE-2025-59363 (7.7), where the Apps API v2 returned OIDC client secrets, fixed in 2025.3.0, and Password Manager had CVE-2025-27582 (7.6). No One Identity, OneLogin, or Quest identity product CVE appears in the CISA KEV catalog (checked 2026-11-05).
- Is OneLogin still supported or has it been discontinued?
- OneLogin is still a live product. One Identity acquired it in October 2021, and it continues to ship versioned releases: 2025 CVE records reference fixes in OneLogin 2025.2.0 and 2025.3.0, including CVE-2025-59363, where the Apps API v2 returned OIDC client secrets. We found no end-of-life notice (checked 2026-11-05). Evaluate it as the workforce access management piece of the One Identity portfolio, alongside Identity Manager for governance, and compare it with larger access management vendors before assuming the bundle is the best fit.
- What are the best One Identity alternatives?
- SailPoint and Saviynt are the category leaders for pure identity governance depth. ConductorOne and Lumos are the strongest modern cloud-first options if the dated interface is the objection. Veza is the choice when access visibility rather than lifecycle is the real problem. For the privileged access half of the portfolio, compare Safeguard against Idira (formerly CyberArk), Delinea, and BeyondTrust rather than against IGA vendors.
More IGA vendors
All IGA →- SailPoint4.6/5
- Saviynt4.4/5
- Omada4.2/5
- Veza4.2/5
- C1 (formerly ConductorOne)4.1/5
Related on Start with Identity
- VendorBravura Security
niche
- VendorClear Skye
strong
- Comparisonconductorone-vs-lumos
C1 (formerly ConductorOne) scores 4.1 to Lumos's 4.0 and the two tie on governance at 4.5. The pending Workday acquisition of C1 is now the biggest variable in
- VendorEmpowerID
niche
- Comparisonomada-vs-saviynt
Omada sells a fixed-scope, 12-week IGA rollout with European data residency; Saviynt sells a broader converged platform with ERP-grade separation of duties and
- Comparisonveza-vs-sailpoint
SailPoint is the IGA program of record for provisioning, access requests, certifications and separation of duties. Veza answers who can actually reach which dat
By SWI Community Team · Last evaluated 2026-11-05
Independent, community-driven analysis. No vendor sponsorship. Compiled from public research and community input and verified on a best-effort basis, so details may be incomplete or out of date. Scores are opinions, not advice. Trademarks belong to their owners; mention does not imply affiliation or endorsement. See the full disclaimer, or send corrections to community@startwithidentity.com.