SaaSBid.io
Get offers

IT, data and security

Best Identity Governance and Administration (IGA) Software in 2026: 12 Tools Compared by Company Size and Requirements

Updated October 26, 2026 · 12 tools · Facts checked against vendor pages · How we review

For Microsoft-centric mid-size companies, tenfold and Microsoft Entra ID Governance are the practical identity governance and administration software picks, and Okta Identity Governance fits teams already on Okta. SailPoint, Saviynt and Omada Identity serve large regulated enterprises that need certification campaigns and segregation of duties controls across many systems.

This page is for IT, security and compliance leads who are comparing identity governance and administration software and need to know which products fit their size, directory and audit pressure. Tools are grouped by company size and by requirements such as separation of duties, on-premises support and deployment model. Use the checklists below to write a request on SaaSBid, then compare offers from vendors who have seen your systems and audit scope.

Top picks by situation

  • A 400-person Microsoft shop piloting IGA

    tenfold

    A free Community Edition covers up to 150 users, paid editions list $0.90 per managed identity per month, and it targets Microsoft-centric firms of 300 to 10,000 employees.

    From: $0.90 per managed identity per month (Essentials), minimum 100 users…

  • A Microsoft 365 company adding governance

    Microsoft Entra ID Governance

    It costs $7.00 per user per month on top of Entra ID P1 or P2 and adds lifecycle workflows, entitlement management and access reviews.

    From: $7.00 per user per month, paid yearly

  • A mid-market team already on Okta SSO

    Okta Identity Governance

    The add-on bundles access governance, lifecycle management and workflows, with certification campaigns and more than 600 native integrations.

    From: Contact sales

  • A regulated European enterprise wanting private cloud

    Omada Identity

    Omada Identity Cloud Private runs in the customer's own Azure tenant with full feature parity, and the vendor advertises a fixed-cost 12-week accelerator.

    From: Contact sales

  • A global enterprise facing SOX-style audits

    SailPoint

    SoD enforcement blocks toxic access combinations before they are granted, and certification campaigns can auto-certify low-risk access.

    From: Contact sales

  • A tech company tying access to SaaS inventory

    Lumos

    Its AppStore handles access requests, and lifecycle workflows and access reviews sit beside the SaaS inventory the platform grew out of.

    From: Contact sales

Identity Governance and Administration (IGA) Software comparison table

Identity Governance and Administration (IGA) Software compared
ToolBest forStarting priceFree planFree trial
SailPoint Large enterprises with thousands to millions of identities Contact sales Not stated Not stated
Saviynt Large and regulated enterprises replacing legacy IGA Contact sales Not stated Not stated
One Identity Manager Large enterprises with hybrid Active Directory and SAP estates Contact sales Not stated Not stated
Okta Identity Governance Teams already running Okta SSO and Lifecycle Management Contact sales No Yes
Microsoft Entra ID Governance Microsoft 365 and Entra ID estates that want governance without a second vendor $7.00 per user per month, paid yearly No Yes
Omada Identity Regulated and complex organizations, especially in Europe Contact sales Not stated Not stated
Ping Identity Governance Existing PingOne Advanced Identity Cloud customers Contact sales Not stated Not stated
IBM Security Identity Governance and Intelligence Large enterprises with SAP and on-premises systems that need segregation of duties controls and audit reporting Contact sales Not stated Yes
CyberArk Identity Governance Enterprises already using CyberArk for privileged access Contact sales Not stated No
Veza Enterprises that need access reviews based on effective permissions across cloud, data and SaaS Contact sales Not stated Not stated
tenfold Microsoft-centric organizations of roughly 300 to 10,000 employees (analyst-stated segment) $0.90 per managed identity per month (Essentials), minimum 100 users… Yes Yes
Lumos IT teams that want access requests, reviews and offboarding tied to SaaS inventory Contact sales No No

What is identity governance and administration software?

Identity governance and administration (IGA) software decides who should have access to which systems and proves it later. When someone joins, changes roles or leaves, it creates, updates or removes accounts in connected applications. Managers and app owners periodically confirm or revoke access in review campaigns, and the tool keeps the evidence auditors ask for. It also models roles, flags toxic permission combinations and handles access requests. Identity teams run it, while managers, application owners and internal audit take part in reviews and approvals, so a rollout touches several departments.

Core capabilities

  • Joiner, mover and leaver provisioning

    Creates, changes and removes accounts in connected systems when HR data changes, without a ticket for each step.

  • Access reviews and certification

    Sends managers and app owners scheduled campaigns to confirm or revoke access, and records every decision.

  • Access requests and approvals

    Lets employees ask for entitlements through a catalog and routes the request to the right approver.

  • Role management

    Groups entitlements into business roles and supports role-based or policy-based access models.

  • Segregation of duties controls

    Detects and blocks permission combinations that auditors consider a conflict, such as creating and approving payments.

  • Audit evidence and reporting

    Produces reports on who had access, who approved it and when, for audits such as SOX or ISO 27001.

The 12 best identity governance and administration software, reviewed

1

SailPoint

Contact sales

SailPoint is the large-enterprise name in identity governance, sold on quote as the cloud Identity Security Cloud and the on-premises IdentityIQ. It has been publicly listed again since a February 2025 IPO. It offers SoD enforcement and AI-assisted certifications.

  • 1-10: poor fit
  • 11-50: poor fit
  • 51-500: workable
  • 500+: strong fit

Best for

  • Large enterprises with thousands to millions of identities
  • Regulated organizations needing certification campaigns and SoD enforcement

Look elsewhere if

  • Small teams wanting published prices or fast self-serve setup
  • Buyers seeking a lightweight SaaS access tool

Key features

Provisioning automation
Automatic provisioning that adapts and corrects access
Access reviews and certification
AI-driven certifications that auto-certify low-risk access
Role management
Access Modeling recommends roles by comparing peer groups
Segregation of duties controls
SoD enforcement blocks toxic access combinations before they are granted
Integrations and connectors
Connectivity product; connector count not stated
Compliance and audit reporting
Audit-ready reports on demand; Compliance Management module
Pricing model
Quote; suites compared on vendor site
Target company size
Scales from thousands to millions of identities; 53% of the Fortune 500 are customers
How you buy
Through sales

Full SailPoint profileRequest an offer

2

Saviynt

Contact sales

Saviynt is a cloud-native IGA platform with cross-application segregation of duties, aimed at large and regulated enterprises replacing older systems. It raised $700M in December 2025.

  • 1-10: poor fit
  • 11-50: poor fit
  • 51-500: no data
  • 500+: strong fit

Best for

  • Large and regulated enterprises replacing legacy IGA
  • Buyers who want IGA plus application access governance and PAM in one vendor

Look elsewhere if

  • Small teams needing public pricing or quick setup
  • Buyers who need lightweight SaaS access reviews only

Key features

Provisioning automation
Automates the identity lifecycle from onboarding access to revocation at exit
Access reviews and certification
Automation can decide up to 75% of access review items; AI recommendations
Segregation of duties controls
Cross-application SoD
Integrations and connectors
Integration logos include AWS, Microsoft, SAP, ServiceNow, Oracle, Salesforce; count not stated
Compliance and audit reporting
Unified identity and compliance data with continuous audit documentation workflows
Pricing model
Quote
Target company size
Enterprise; over 600 customers including over 20% of the Fortune 100 per vendor
How you buy
Through sales

Full Saviynt profileRequest an offer

3

One Identity Manager is an enterprise suite with attestation, business roles and policy-based provisioning, offered as SaaS or self-managed software by One Identity, part of Quest Software. SAP connectivity is included in standard licensing. Cloud applications need the separate Starling Connect add-on.

  • 1-10: poor fit
  • 11-50: poor fit
  • 51-500: no data
  • 500+: strong fit

Best for

  • Large enterprises with hybrid Active Directory and SAP estates
  • Teams that need a self-managed or fully managed deployment choice
  • Organizations that want attestation and business-role governance in one suite

Look elsewhere if

  • Small teams wanting public pricing and self-serve signup
  • Buyers who want a fast, no-consultant rollout

Key features

Provisioning automation
Automated provisioning for on-premises, cloud and hybrid resources; cloud applications use the separate Starling Connect add-on
Access reviews and certification
Attestation policies define what is attested, how often and by whom; business-role and application-role attestation are covered in the 9.2 admin guide
Role management
Business roles and application roles with attestation; role mining detail not confirmed by the vendor
Segregation of duties controls
SoD controls documented for SAP (R/3 and S/4HANA); behavior-driven governance for SoD violations is vendor-described
Integrations and connectors
SAP connectivity included in standard licensing; cloud apps via Starling Connect; connector count not published on pages opened
Compliance and audit reporting
Compliance rules with violation reports, attestation and an auditor role in the web portal
Pricing model
Quote only; subscription or tiered per-user licensing with modules, per vendor pages
Target company size
Global enterprises; no SMB tier described
How you buy
Through sales

Full One Identity Manager profileRequest an offer

4

Okta Identity Governance is an add-on to Okta Workforce Identity that bundles access governance, lifecycle management and no-code workflows. It cannot be bought alone, and the vendor's product page does not describe segregation of duties, which matters for SOX-driven buyers.

  • 1-10: no data
  • 11-50: workable
  • 51-500: strong fit
  • 500+: strong fit

Best for

  • Teams already running Okta SSO and Lifecycle Management
  • Mid-market and enterprise IT wanting governance without a separate IGA vendor

Look elsewhere if

  • Buyers who need segregation-of-duties controls (not mentioned on the product page)
  • Teams not on Okta, since the add-on requires the Okta platform

Key features

Provisioning automation
Okta Lifecycle Management automates onboarding and offboarding between directories and cloud apps; Okta Workflows adds no-code orchestration
Access reviews and certification
Admins schedule certification campaigns; managers confirm team permissions with context such as sign-in frequency and last access date
Role management
Resource collections model roles; entitlement bundles grouped for self-service requests
Segregation of duties controls
Not mentioned on the product page
Integrations and connectors
600+ native integrations plus thousands of pre-built integrations in the Okta Integration Network
Compliance and audit reporting
Auditable record of access requests and certification decisions
Pricing model
Per user per month add-on to a workforce plan; no published add-on price
Target company size
IT and security teams across mid-market and enterprise
How you buy
Online or through sales
Free trial
30 days
Single sign-on
Starter and above

Full Okta Identity Governance profileRequest an offer

5

Microsoft Entra ID Governance

$7.00 per user per month, paid yearly

Microsoft Entra ID Governance adds lifecycle workflows, entitlement management and access reviews to Entra ID P1 or P2 for $7.00 per user per month, paid yearly. Lifecycle workflows are capped at 50 per tenant, and Microsoft says new IGA features will go only to this add-on, not to P2.

  • 1-10: no data
  • 11-50: no data
  • 51-500: strong fit
  • 500+: strong fit

Best for

  • Microsoft 365 and Entra ID estates that want governance without a second vendor
  • Organizations already on Entra ID P1 or P2 that need lifecycle workflows and advanced access reviews

Look elsewhere if

  • Companies not on Entra ID, since an active P1 or P2 subscription is a prerequisite
  • Buyers needing flexible audit and compliance reporting

Key features

Provisioning automation
HR-driven inbound provisioning from Workday and SuccessFactors, lifecycle workflows, and SCIM, LDAP and SQL provisioning to hundreds of apps
Access reviews and certification
Recurring access reviews with machine-learning assisted recommendations, inactive-user reviews and catalog access reviews
Role management
Entitlement management access packages with auto-assignment policies; docs describe migrating an organizational role model, no role mining
Segregation of duties controls
Incompatible access packages enforce separation of duties on requests (listed from Entra ID P2)
Integrations and connectors
Connectors to hundreds of cloud and on-premises apps via SCIM, LDAP, SQL, SOAP and REST; SAP IAG business roles in preview
Compliance and audit reporting
Governance dashboard (P1 and up); audit logs
Pricing model
$7.00 per user per month on top of Entra ID P1 or P2; guests billed per monthly active user
Target company size
Microsoft-centric organizations from mid-market to enterprise
How you buy
Online up to Microsoft Entra ID Governance (with an Entra ID P1 or P2 prerequisite), sales above

Full Microsoft Entra ID Governance profileRequest an offer

6

Omada Identity

Contact sales

Omada Identity is a Copenhagen-based platform sold as a cloud service, a private cloud in the customer's Azure tenant, or on-premises software. It offers cross-system certification campaigns, SoD policies and more than 50 audit report templates.

  • 1-10: poor fit
  • 11-50: poor fit
  • 51-500: workable
  • 500+: strong fit

Best for

  • Regulated and complex organizations, especially in Europe
  • Buyers who want a private cloud deployment inside their own Azure tenant

Look elsewhere if

  • Small teams wanting public pricing
  • Buyers who want deep public peer review evidence (few public reviews)

Key features

Provisioning automation
Automated provisioning and deprovisioning, self-service access requests
Access reviews and certification
Certification campaigns, including cross-system campaigns
Role management
Role management for users with multiple roles, with AI-assisted role assignment
Segregation of duties controls
SoD and least-privilege policies
Integrations and connectors
Connectivity Framework, Cloud Application Gateway and Connectivity Directory; connector count not stated on page
Compliance and audit reporting
Access compliance dashboards and 50+ audit report templates
Pricing model
Quote only; fixed-cost option for the 12-week accelerator
Target company size
Regulated and complex organizations
How you buy
Through sales
SOC 2
Type II
EU data hosting
Available

Full Omada Identity profileRequest an offer

7

Ping Identity Governance is an add-on to PingOne Advanced Identity Cloud, the former ForgeRock Identity Cloud, covering access requests, certification campaigns and SoD policies. It is added by contacting Ping, and the recommendations feature must be enabled by Ping Support.

  • 1-10: no data
  • 11-50: poor fit
  • 51-500: no data
  • 500+: strong fit

Best for

  • Existing PingOne Advanced Identity Cloud customers
  • Regulated organizations needing certification campaigns on the Ping platform

Look elsewhere if

  • Teams not on PingOne Advanced Identity Cloud
  • Buyers who need a mature governance product with deep peer evidence

Key features

Provisioning automation
Lifecycle management of users and entitlements
Access reviews and certification
Scheduled certification campaigns where managers approve or revoke their team's access; ML governance recommendations compare peer access
Segregation of duties controls
SoD policies block conflicting permission combinations
Integrations and connectors
Governs SaaS, cloud and on-premises apps; examples include Salesforce, Snowflake, Google Workspace
Compliance and audit reporting
Audit record of who requested, approved and used access; certification campaigns
Pricing model
Quote only; add-on to PingOne Advanced Identity Cloud
Target company size
Enterprise, regulated industries
How you buy
Through sales
SOC 2
Type II
EU data hosting
Available

Full Ping Identity Governance profileRequest an offer

8

Note: Renamed IBM Security Verify Governance with version 10.0

IBM's governance suite was renamed Security Verify Governance with version 10.0 in December 2020, and IBM Security Identity Manager was folded into it. It covers provisioning, certification, role mining and SoD risk controls, including for SAP. IBM publishes no price, and charges follow usage.

  • 1-10: no data
  • 11-50: poor fit
  • 51-500: poor fit
  • 500+: strong fit

Best for

  • Large enterprises with SAP and on-premises systems that need segregation of duties controls and audit reporting
  • Existing IBM Security customers with Identity Manager deployments

Look elsewhere if

  • Small and mid-size companies looking for a quick, light SaaS app governance tool
  • Buyers who need published per-identity prices

Key features

Provisioning automation
Automates onboarding and offboarding, self-service requests, password synchronization; connectors include Enterprise Connectors, CSV connectors and Identity Brokerage Adapters
Role management
Role administration, custom hierarchies for role consolidation, and role mining in Access Optimizer
Segregation of duties controls
Access risk controls with SoD risk definitions, mitigation controls and external SoD; SAP SoD controls
Integrations and connectors
Enterprise and CSV connectors, Active Directory agent, IBM product integrations; connector count not published
Compliance and audit reporting
Closed-loop compliance, GDPR-specific controls, report sections and access analytics
Pricing model
Usage-based, quote
Target company size
Enterprise
How you buy
Online or through sales

Full IBM Security Identity Governance and Intelligence profileRequest an offer

9

CyberArk Identity Governance is a SaaS IGA built on Zilla Security, bought in February 2025, and CyberArk now belongs to Palo Alto Networks. It automates access reviews, provisioning and audit evidence for human and non-human identities. Pricing is by quote and no free trial is offered.

  • 1-10: no data
  • 11-50: no data
  • 51-500: no data
  • 500+: strong fit

Best for

  • Enterprises already using CyberArk for privileged access
  • Teams that want access reviews and audit evidence automated

Look elsewhere if

  • Buyers wanting public pricing or a free trial
  • Teams unsure of product roadmap after the Palo Alto Networks integration

Key features

Provisioning automation
Automated provisioning and deprovisioning; browser plugins and gateway for apps without APIs (G-Cloud listing)
Access reviews and certification
AI-driven access reviews; Zilla Comply automates review campaigns and auditor evidence
Role management
Policy-based role management (G-Cloud listing)
Segregation of duties controls
Monitors entitlements and alerts on SoD violations; enforces SoD policies for SOX and PCI DSS
Integrations and connectors
Out-of-the-box connectors; reseller listings claim 1,000+ cloud and on-premises apps
Compliance and audit reporting
Real-time reporting and automatic audit evidence
Pricing model
Quote only
Target company size
Enterprise
How you buy
Through sales

Full CyberArk Identity Governance profileRequest an offer

10

Veza

Contact sales

Note: ServiceNow announced its intent to acquire Veza on 2025-12-02

Veza is an access-graph platform for access reviews and joiner-mover-leaver provisioning across SaaS, cloud, data and on-premises systems. ServiceNow announced its intent to buy Veza in December 2025. New contracts may therefore run on ServiceNow paper.

  • 1-10: no data
  • 11-50: poor fit
  • 51-500: no data
  • 500+: strong fit

Best for

  • Enterprises that need access reviews based on effective permissions across cloud, data and SaaS
  • Teams that want agentless connectors and an API to build custom reviews

Look elsewhere if

  • Small teams that need public pricing or a self-serve start
  • Buyers who want classic SSO and MFA from the same vendor

Key features

Provisioning automation
Lifecycle Management product automates joiner, mover and leaver changes with birthright access, dry run and safety limits; drives workflows from HR, payroll, ITSM and identity provider sources
Role management
Access Profile Intelligence finds birthright entitlements
Segregation of duties controls
Reviews prioritize separation-of-duties violations and toxic combinations; SoD status can gate bulk certification
Integrations and connectors
Over 325 integrations listed; thousands of SCIM apps and native connectors for Microsoft, AWS, Google, Salesforce, Oracle and Okta; custom apps via Veza OAA
Compliance and audit reporting
Vendor states audit-ready access reports; provisioning and deprovisioning events and policy changes are logged
Pricing model
Quote only
Target company size
Enterprise (customer base described as about 150 global enterprises at acquisition announcement)
How you buy
Through sales

Full Veza profileRequest an offer

11

tenfold

$0.90 per managed identity per month (Essentials), minimum 100 users…

tenfold is a no-code, on-premises IGA suite from Vienna for Microsoft-centric organizations, installed on Windows Server with SQL Server or Oracle. A free Community Edition covers up to 150 users, and paid editions start at $0.90 per managed identity per month with a 100-user minimum.

  • 1-10: no data
  • 11-50: strong fit
  • 51-500: strong fit
  • 500+: workable

Best for

  • Microsoft-centric organizations of roughly 300 to 10,000 employees (analyst-stated segment)
  • Teams that want published per-identity prices and a free Community Edition to pilot

Look elsewhere if

  • Buyers who want a SaaS-hosted IGA (the product is installed on Windows Server with SQL Server or Oracle)
  • Large multi-vendor enterprises that need broad SAP and legacy connector depth out of the box

Key features

Provisioning automation
User lifecycle management for onboarding and offboarding with no-code provisioning workflows
Access reviews and certification
Periodic and event-based user access reviews with recertification of access rights
Role management
Role-based access: access assigned and revoked by user role
Segregation of duties controls
Automated separation-of-duties enforcement
Integrations and connectors
No-code plugins for Microsoft on-premises, Microsoft 365, HR, ITSM and ERP systems plus a Generic Connector and REST API; SAP, Workday and HCL Notes on Enterprise
Compliance and audit reporting
Auditing with IT event monitoring and real-time log analysis; no named compliance frameworks on the product page
Pricing model
Per managed identity per month; Enterprise by quote
Target company size
Mid-sized organizations of roughly 300 to 10,000 employees (KuppingerCole)
How you buy
Online or through sales
Free trial
30 days

Full tenfold profileRequest an offer

12

Lumos

Contact sales

Lumos grew out of SaaS management and now positions itself as an identity platform with an app store for access requests, access reviews and joiner-mover-leaver workflows. Customers listed include Pinterest, MongoDB and GitHub. It has no public pricing, and its pricing page only offers an assessment.

  • 1-10: no data
  • 11-50: no data
  • 51-500: strong fit
  • 500+: workable

Best for

  • IT teams that want access requests, reviews and offboarding tied to SaaS inventory
  • Mid-size and larger tech companies (customers listed: Pinterest, MongoDB, GitHub)

Look elsewhere if

  • Finance-only buyers wanting card-based spend control
  • Buyers who need published prices

Key features

Provisioning automation
Joiner, mover, leaver events flow from the HRIS; leavers offboarded automatically
Access reviews and certification
Agents scope reviews, certify routine items and assemble auditor-ready evidence
Role management
Proposes roles from observed access patterns to enforce least privilege
Compliance and audit reporting
Exports audit evidence, for example for SOX access reviews
Pricing model
Contact sales
How you buy
Through sales
SOC 2
Type II

Full Lumos profileRequest an offer

How to choose identity governance and administration software

Provisioning automation

This measures how well joiner, mover and leaver changes reach connected applications without manual tickets. Strong tools react to HR data, offer birthright access and let you test a change before it runs. Weak ones need administrators to trigger each change or support only a few apps.

Access reviews and certification

Access reviews are the campaigns in which managers and owners confirm or revoke access. Strong tools schedule campaigns, show context such as last sign-in, support bulk decisions and log every outcome. Weak ones produce long spreadsheets that reviewers approve without reading.

Role management

Role management covers how entitlements are grouped into roles and kept accurate. Strong tools support business roles, role mining and policy-based assignment. Weak ones leave admins managing entitlements one by one, which makes reviews longer.

Segregation of duties controls

This covers the detection and prevention of permission combinations that create fraud or compliance risk. Strong tools check conflicts when access is requested and across systems such as ERP. Weak ones only report conflicts after the fact, or do not describe the feature.

Integrations and connectors

Connectors determine whether the tool can reach your directories, cloud apps, ERP and on-premises systems. Strong products offer many ready connectors plus a way to build custom ones. Weak ones sell connectors as add-ons or cover only their own platform.

Compliance and audit reporting

This describes how easily the tool produces evidence of who had access, who approved it and when. Strong tools offer ready reports for common frameworks and a complete decision log. Weak ones require exports and manual assembly before an audit.

Pricing model

This criterion covers how the product is billed, usually per identity or user, by add-on or by quote, and what prerequisites exist. Strong models state the unit and what is included. Weak ones hide prices, require a base platform subscription or add connector fees.

Target company size

This shows the organization size and complexity the tool was built for. Lighter products suit mid-size firms with a few key systems, while enterprise suites handle global estates with ERP and legacy systems. Picking too large means long deployments, and picking too small means missing controls.

Identity Governance and Administration (IGA) Software FAQ

What is identity governance and administration (IGA) software?

IGA software manages the lifecycle of user accounts and decides who should have access to which systems. It automates provisioning for joiners, movers and leavers, runs access reviews, manages roles and enforces separation of duties. The result is lower access risk and audit evidence.

What is the difference between IGA and IAM?

Identity and access management mostly handles authentication, such as sign-in and multifactor checks. IGA sits on top and handles who should have access, how it is approved and how it is reviewed over time. Many companies run both, and some vendors sell governance as an add-on to IAM.

Which IGA tools suit small and mid-size businesses?

Among the listed products, tenfold targets Microsoft-centric firms of roughly 300 to 10,000 employees and offers a free edition for up to 150 users. Okta Identity Governance and Microsoft Entra ID Governance suit mid-size companies already on those platforms. Most others are built for enterprises.

Can I use Entra ID Governance or Okta Identity Governance instead of a standalone IGA tool?

Often yes, if you already use that platform. Both are add-ons that need the base subscription. Okta's product page does not describe segregation of duties, so check that point if your audits require it. Entra covers it through incompatible access packages.

How long does an IGA rollout take?

It varies widely. tenfold says a full deployment can take as little as two weeks with consultant help, and Omada advertises a 12-week accelerator. Connector count, legacy systems and role cleanup drive the timeline.

What should I include in a request for IGA offers?

Give your identity count, directory, HR source, key applications, audit drivers, deployment preference and go-live date. Say whether you need SoD checks and which reports your auditors expect. This lets vendors scope connectors and licensing properly.

The SaaSBid view: fit, buying and security

How you buy each identity governance and administration tool

Can you start online, or do you need a demo and a quote first? Taken from each vendor's pricing page. A dash means the vendor does not publish it. Quote-only vendors are where a request on SaaSBid saves the most time.

ToolHow you buyFree trialContractOnboarding fee
SailPointThrough sales–––
SaviyntThrough sales–––
One Identity ManagerThrough sales–––
Okta Identity GovernanceOnline or through sales30 daysSuites billed annually; $1,500 annual contract minimum for Workforce Identity–
Microsoft Entra ID GovernanceOnline up to Microsoft Entra ID Governance (with an Entra ID P1 or P2 prerequisite), sales above–Annual subscription that auto-renews–
Omada IdentityThrough sales–––
Ping Identity GovernanceThrough sales–––
IBM Security Identity Governance and IntelligenceOnline or through sales–––
CyberArk Identity GovernanceThrough sales–––
VezaThrough sales–––
tenfoldOnline or through sales30 daysYearly subscription, minimum 100 users–
LumosThrough sales–––

Security and data protection compared

What your IT and legal team will ask, from each vendor's trust center, security page and legal documents. A dash means we found nothing public, which is a question for your request.

ToolSOC 2ISO 27001Public DPAEU hostingSSO fromSCIM fromAudit logs from
Okta Identity GovernanceNot publishedYesNot publishedNot publishedStarter and above––
Microsoft Entra ID GovernanceNot publishedNot publishedNot publishedNot published–Automated user provisioning to SaaS apps from the Free tier; group provisioning from P1–
Omada IdentityType IIYesNot publishedEU (Microsoft Ireland, when selected)–––
Ping Identity GovernanceType IIYesNot publishedUS, Canada (Montreal), Brazil (Sao Paulo), Europe, Middle East (Doha, Dammam), Asia (Singapore, Jakarta, Hong Kong), Australia (Sydney)–––
CyberArk Identity GovernanceNot publishedYesNot publishedNot published–––
VezaNot publishedYesNot publishedNot published–––
tenfoldNot publishedNot publishedNot publishedNot published––All paid editions (auditing in governance toolset)
LumosType IINot publishedNot publishedNot published–––

Which identity governance and administration tool fits your company size

Fit of each tool by company size
Tool1-10 people11-50 people51-500 people500+ people
SailPointPoor fitPoor fitWorkableStrong fit
SaviyntPoor fitPoor fitNo dataStrong fit
One Identity ManagerPoor fitPoor fitNo dataStrong fit
Okta Identity GovernanceNo dataWorkableStrong fitStrong fit
Microsoft Entra ID GovernanceNo dataNo dataStrong fitStrong fit
Omada IdentityPoor fitPoor fitWorkableStrong fit
Ping Identity GovernanceNo dataPoor fitNo dataStrong fit
IBM Security Identity Governance and IntelligenceNo dataPoor fitPoor fitStrong fit
CyberArk Identity GovernanceNo dataNo dataNo dataStrong fit
VezaNo dataPoor fitNo dataStrong fit
tenfoldNo dataStrong fitStrong fitWorkable
LumosNo dataNo dataStrong fitWorkable

Strong fitWorkablePoor fitNo data from the vendor

Ratings reflect each vendor's stated audience, deployment model, prerequisites such as an existing Okta or Entra subscription, and whether SoD and audit controls are described. Cells stay empty when the vendor is silent about a size.

  • 1-10 people

    Dedicated IGA software is rarely needed at this size, and most listed vendors state they serve larger organizations. Teams that must pilot something can try the free tenfold Community Edition, which covers up to 150 users but needs a Windows Server and database.

  • 11-50 people

    Governance here usually means access reviews and offboarding for a handful of apps. tenfold is the only listed product with published per-identity prices, though paid editions need 100 users, and Okta Identity Governance works for teams already on Okta.

  • 51-500 people

    Auditors begin asking for review evidence, so lifecycle automation and campaigns pay off. tenfold, Okta Identity Governance, Microsoft Entra ID Governance and Lumos fit well. Match the choice to your directory, because Okta and Entra require their own platforms.

  • 500+ people

    Segregation of duties, connectors to ERP and on-premises systems, and deployment choice become decisive. SailPoint, Saviynt, One Identity Manager, Omada Identity, IBM Security Verify Governance, Ping and Veza target this size. Plan for a long rollout and consultant help.

Feature coverage at a glance

Documented features by tool
ToolProvisioning automationAccess reviews and certificationRole managementSegregation of duties controlsIntegrations and connectorsCompliance and audit reportingShare
SailPointDocumented: Automatic provisioning that adapts and corrects accessDocumented: AI-driven certifications that auto-certify low-risk accessDocumented: Access Modeling recommends roles by comparing peer groupsDocumented: SoD enforcement blocks toxic access combinations before they are grantedDocumented: Connectivity product; connector count not statedDocumented: Audit-ready reports on demand; Compliance Management module100%
SaviyntDocumented: Automates the identity lifecycle from onboarding access to revocation at exitDocumented: Automation can decide up to 75% of access review items; AI recommendationsNot documentedDocumented: Cross-application SoDDocumented: Integration logos include AWS, Microsoft, SAP, ServiceNow, Oracle, Salesforce; count not statedDocumented: Unified identity and compliance data with continuous audit documentation workflows83%
One Identity ManagerDocumented: Automated provisioning for on-premises, cloud and hybrid resources; cloud applications use the separate Starling Connect add-onDocumented: Attestation policies define what is attested, how often and by whom; business-role and application-role attestation are covered in the 9.2 admin guideDocumented: Business roles and application roles with attestation; role mining detail not confirmed by the vendorDocumented: SoD controls documented for SAP (R/3 and S/4HANA); behavior-driven governance for SoD violations is vendor-describedDocumented: SAP connectivity included in standard licensing; cloud apps via Starling Connect; connector count not published on pages openedDocumented: Compliance rules with violation reports, attestation and an auditor role in the web portal100%
Okta Identity GovernanceDocumented: Okta Lifecycle Management automates onboarding and offboarding between directories and cloud apps; Okta Workflows adds no-code orchestrationDocumented: Admins schedule certification campaigns; managers confirm team permissions with context such as sign-in frequency and last access dateDocumented: Resource collections model roles; entitlement bundles grouped for self-service requestsDocumented: Not mentioned on the product pageDocumented: 600+ native integrations plus thousands of pre-built integrations in the Okta Integration NetworkDocumented: Auditable record of access requests and certification decisions100%
Microsoft Entra ID GovernanceDocumented: HR-driven inbound provisioning from Workday and SuccessFactors, lifecycle workflows, and SCIM, LDAP and SQL provisioning to hundreds of appsDocumented: Recurring access reviews with machine-learning assisted recommendations, inactive-user reviews and catalog access reviewsDocumented: Entitlement management access packages with auto-assignment policies; docs describe migrating an organizational role model, no role miningDocumented: Incompatible access packages enforce separation of duties on requests (listed from Entra ID P2)Documented: Connectors to hundreds of cloud and on-premises apps via SCIM, LDAP, SQL, SOAP and REST; SAP IAG business roles in previewDocumented: Governance dashboard (P1 and up); audit logs100%
Omada IdentityDocumented: Automated provisioning and deprovisioning, self-service access requestsDocumented: Certification campaigns, including cross-system campaignsDocumented: Role management for users with multiple roles, with AI-assisted role assignmentDocumented: SoD and least-privilege policiesDocumented: Connectivity Framework, Cloud Application Gateway and Connectivity Directory; connector count not stated on pageDocumented: Access compliance dashboards and 50+ audit report templates100%
Ping Identity GovernanceDocumented: Lifecycle management of users and entitlementsDocumented: Scheduled certification campaigns where managers approve or revoke their team's access; ML governance recommendations compare peer accessNot documentedDocumented: SoD policies block conflicting permission combinationsDocumented: Governs SaaS, cloud and on-premises apps; examples include Salesforce, Snowflake, Google WorkspaceDocumented: Audit record of who requested, approved and used access; certification campaigns83%
IBM Security Identity Governance and IntelligenceDocumented: Automates onboarding and offboarding, self-service requests, password synchronization; connectors include Enterprise Connectors, CSV connectors and Identity Brokerage AdaptersNot documentedDocumented: Role administration, custom hierarchies for role consolidation, and role mining in Access OptimizerDocumented: Access risk controls with SoD risk definitions, mitigation controls and external SoD; SAP SoD controlsDocumented: Enterprise and CSV connectors, Active Directory agent, IBM product integrations; connector count not publishedDocumented: Closed-loop compliance, GDPR-specific controls, report sections and access analytics83%
CyberArk Identity GovernanceDocumented: Automated provisioning and deprovisioning; browser plugins and gateway for apps without APIs (G-Cloud listing)Documented: AI-driven access reviews; Zilla Comply automates review campaigns and auditor evidenceDocumented: Policy-based role management (G-Cloud listing)Documented: Monitors entitlements and alerts on SoD violations; enforces SoD policies for SOX and PCI DSSDocumented: Out-of-the-box connectors; reseller listings claim 1,000+ cloud and on-premises appsDocumented: Real-time reporting and automatic audit evidence100%
VezaDocumented: Lifecycle Management product automates joiner, mover and leaver changes with birthright access, dry run and safety limits; drives workflows from HR, payroll, ITSM and identity provider sourcesNot documentedDocumented: Access Profile Intelligence finds birthright entitlementsDocumented: Reviews prioritize separation-of-duties violations and toxic combinations; SoD status can gate bulk certificationDocumented: Over 325 integrations listed; thousands of SCIM apps and native connectors for Microsoft, AWS, Google, Salesforce, Oracle and Okta; custom apps via Veza OAADocumented: Vendor states audit-ready access reports; provisioning and deprovisioning events and policy changes are logged83%
tenfoldDocumented: User lifecycle management for onboarding and offboarding with no-code provisioning workflowsDocumented: Periodic and event-based user access reviews with recertification of access rightsDocumented: Role-based access: access assigned and revoked by user roleDocumented: Automated separation-of-duties enforcementDocumented: No-code plugins for Microsoft on-premises, Microsoft 365, HR, ITSM and ERP systems plus a Generic Connector and REST API; SAP, Workday and HCL Notes on EnterpriseDocumented: Auditing with IT event monitoring and real-time log analysis; no named compliance frameworks on the product page100%
LumosDocumented: Joiner, mover, leaver events flow from the HRIS; leavers offboarded automaticallyDocumented: Agents scope reviews, certify routine items and assemble auditor-ready evidenceDocumented: Proposes roles from observed access patterns to enforce least privilegeNot documentedNot documentedDocumented: Exports audit evidence, for example for SOX access reviews67%

A check means the vendor documents the capability publicly (hover for the detail). A dash means we found no public documentation, which is a question to put in your request, not proof the feature is missing.

Identity Governance and Administration (IGA) Software requirements checklist

Use this list to write down what your team actually needs. Sorting requirements into must-have, should-have and nice-to-have is what lets vendors quote accurately instead of pitching their biggest plan.

Must have

  • Automatic account creation and removal driven by our HR systemHR-driven triggers are what make joiner, mover and leaver changes happen without tickets.
  • Scheduled access review campaigns for managers and app ownersCampaign features differ in reminders, delegation and bulk decisions.
  • Audit trail of every request, approval and review decisionAuditors ask for evidence, and manual exports raise internal effort.
  • Connectors for our directory and the business applications we runMissing connectors turn into custom work that changes cost and timeline.
  • Self-service access requests with approval workflowsEmployees and approvers should not use email or tickets for access.

Should have

  • Detection of conflicting access combinations before they are grantedPrevention is stronger than finding conflicts in a later review.
  • Business role modeling with role-based and policy-based assignmentRoles reduce the number of individual entitlements to review.
  • Reports prepared for SOX, ISO 27001 or HIPAA auditsReady-made reports shorten audit preparation.
  • Support for both cloud and on-premises systemsHybrid estates need connectors for each side.

Nice to have

  • Governance for service accounts and other non-human identitiesMachine accounts are a growing share of access risk.
  • Choice between SaaS and self-managed deploymentSome regulated buyers need the platform inside their own tenant or data center.
  • AI-assisted review recommendationsSuggested decisions can speed up large campaigns.

Turn this checklist into a request

Questions vendors ask before quoting

Have answers ready for these, and your first conversation with a vendor starts at pricing instead of discovery.

  1. How many identities, including contractors and service accounts, need to be governed?Most vendors price per identity, and the count sets the tier.
  2. Which directory and identity provider do you use today?Okta, Entra and Ping add-ons only work on their own platforms.
  3. Which business applications and on-premises systems must be connected?Connector coverage drives implementation effort and may require extra licenses.
  4. Which audits or regulations drive this project?SOX or similar rules make separation-of-duties controls a requirement.
  5. Do you want SaaS, a private cloud or software run in your own data center?Deployment model changes price, timeline and staffing.
  6. What is your target go-live, and do you have identity engineers in-house?It decides whether a partner or accelerator program is needed.

Example request

What a strong identity governance and administration software request looks like
We are a 900-person manufacturing and services company with about 1,100 identities including contractors. We run Microsoft Entra ID, Workday for HR and SAP for finance. Today access is granted by tickets, and last year's audit found leavers who kept accounts for weeks. We need automatic joiner, mover and leaver changes from Workday, quarterly access review campaigns for managers and application owners, and segregation of duties checks on SAP roles. Reports must be ready for our external auditors. We prefer a SaaS delivery but would consider a private cloud. We want a first phase live within six months, and the budget is in the mid five figures per year.

Write your own request

More vendors listed on SaaSBid

  • The IT LeadService account ownership reviews for small IT teams and MSPs

The bottom line

Begin with your directory and audit drivers. If you already run Okta or Entra, check whether the add-on covers your needs, including segregation of duties. If you hold large ERP and legacy estates, shortlist the enterprise suites. A precise list on SaaSBid gives vendors your identity count, systems and deployment preference, so offers include the right connectors and timelines.

Related categories