8 Best Identity and Access Management (IAM) Solutions

Microsoft: Best for Windows-based Enterprises

If the business runs almost exclusively on Microsoft tools and Windows operating systems, Active Directory is a no-brainer. It stands as the foundation for Windows-based identity management. To extend its reach beyond local networks, Microsoft Entra tools are needed for multi-cloud and multi-network needs running Microsoft Azure.

Pricing

• Active Directory is included as part of many Microsoft subscriptions.
• Azure AD and Entra pricing starts at $6 per user per month with premium versions costing $9.

Features

• Azure AD includes centralized, cloud-based IAM and governance
• Multi-cloud
• Options for SSO, MFA, passwordless, and conditional access
• Privileged access management
• Continuous permissions monitoring

Pros

• Mature product that has been decades in development and broad use.
• Entra Verified ID treats apps and workloads as users to be verified
• Basic identity management is included with many Microsoft subscriptions
• Manages over a billion identities

Cons

• Microsoft AD alone does not reach outside of local networks.
• Multiple tools needed to achieve basic IAM in the cloud.
• The full Entra suite of tools may be needed by many users
• Can be complex to use and difficult to troubleshoot

JumpCloud: Best for SMBs

JumpCloud’s zero trust approach to identity offers granular policies to manage identities, devices and locations suites. Its vendor-independent approach is enhanced by its comfort with multiple protocols. It is used by large and small organizations alike, but is particularly user friendly for small businesses that don’t have a strong grounding in IT.

Pricing

• JumpCloud is complex as there are so many ways to bundle services and so many add-ons.
• It is free for up to 10 users and 10 devices.
• Paid versions are in the $15 to $20 range per user per month with extra fees for parts of the suite, depending on what the user needs.

Features

• Active Directory, Google and Microsoft productivity suite integration
• Device and patch management tools are available as part of a larger toolset.
• Zero-trust policy implementation options.

Pros

• Centralized identity control and lifecycle management through its Cloud Directory tool
• Cloud-based LDAP and RADIUS services
• MFA, SSO, conditional access, and password management
• API services for workflow customization
• Mobile device management and patch management for Windows, macOS and Linux endpoints.

Cons

• Pricing is complex and difficult to gauge.
• Users may think they are getting IAM for one price when they actually need to pay more for tools like Cloud Directory and other services.
• Some users complain of occasional customer support response times delays.

SEE: JumpCloud vs Okta review 

CyberArk: Best for IDaaS

Identity-as-a-Service is a way to take the effort out of IAM. CyberArk is one of several vendors offering IDaaS. The company is also big in the privileged identity management (PAM) market. It has steadily added to its initial PAM offerings with IAM, IDaaS and analytics capabilities.

Pricing

• Pricing for individual products appears to range between $2 to $5 per user but it is unclear which elements a user must purchase and what other fees are included.

Features

• The company offers a wide-ranging portfolio covering IAM, PAM, secrets management, endpoint security, cloud privilege, and workforce/customer access.
• Marries PAM with IDaaS.
• Comes with SSO and endpoint MFA
• Includes passwordless and self-service options.

Pros

• Strong analytics capabilities can be integrated with overall security analytics and metrics programs.
• Risk-based authentication helps administrators determine IAM risk tolerances.
• Can cope with multi-cloud environments.

Cons

• Pricing is above average for some use cases.
• Some users note occasional performance issues.
• Confusing price structure that isn’t openly available.
• Those only needing IAM may end up buying far more than they need.

SEE: CyberArk vs BeyondTrust review

OneLogin: Best for Social Media

Those organizations that are social media centric will appreciate how OneLogin’s IAM product integrates with social media logins as well as regular enterprise logins for endpoints. It takes a narrower focus than others. But those wanting a good IAM tool should consider OneLogin.

Pricing

• Like many vendors in IAM, pricing gets a little complex based on the version and features.
• Different versions and capabilities vary from around $2 to $8 per user per month.
• Some are bundled with a collection of offerings, others enable you to pay for specific features only.

Features

• Offers a dedicated identity and access management solution for workforce and customers.
• Some versions include single sign-on, advanced directory and multi-factor authentication and others add identity lifecycle management and HR identity features.
• Centralized management.

Pros

• OneLogin has a narrower IAM focus than competitive offerings so is a good option for those that don’t need PAM and other related capabilities.
• Support for developers integrating IAM into applications.
• Social media login support.

Cons

• Doesn’t venture into PAM.
• Users with multiple roles may end up with too many logins.
• Opaque pricing with multiple options that can soon add up.

SEE: OneLogin vs Okta review 

Ping Identity: Best for Financial Services

Ping Identity is another largely pure-play IAM vendor. But within that, it delivers a range of identity and access solutions that can be bought together or separately. It has traditionally had a strong user base among financial services companies though doesn’t specialize only in that market.

Pricing

• Ping is one of the few companies directly citing numbers on its website such as a starting price of $20,000 for its Essential package (includes identity orchestration engine, SSO,
• authentication policies, and more) and $40,000 for the Plus package (adds features like adaptive MFA, embedded MFA for mobile apps, device management, API management, LDAP and
• passwordless authentication).
• But it isn’t clear what the limits here are in terms of users etc.

Features

• Highly scalable IAM
• SSOs, MFA and dynamic authorization
• Monitors risk and API traffic

Pros

• No-code, drag & drop workflows and pre-built templates for ease of use.
• Many pre-built integrations
• Detection of anomalous behavior
• Hosted, container, on-premises and private cloud versions available.

Cons

• Some complexity apparent in role management and entitlement creation
• Multiple licenses required for IAM.
• Pricing structure means it may be too expensive for SMBs.

SEE: Ping vs Okta review 

Oracle: Best for Multi-Cloud Environments

Oracle offers a range of  cloud infrastructure identity and access management and access governance tools to help manage identity and access in cloud and on-premises. These can either be self-managed or managed by Oracle. Oracle’s enterprise cloud experience and capabilities make it a good choice for those with multi-cloud environments

Pricing

• Oracle posts pricing on its website, but there are so many products, tools and options that it is difficult to follow.
• Approximate pricing is a cent or two per user for IAM but it isn’t clear what else has to be purchased such as Oracle Cloud Infrastructure services and governance capabilities for additional fees.

Features

• Cloud-native access management that supports hybrid and multi-cloud needs
• Strong governance features
• Oracle owned a network of dozens of data centers around the world for ease of scalability and low latency.

Pros

• Embedded IAM for Oracle Fusion Application Cloud users which simplifies provisioning and role management.
• Strong automation capabilities
• Delegation of provisioning to user segments to lessen the IT workload.
• Zero Trust
• OCI customers will find this add-on easy to implement with attractive pricing bundles available.

Cons

• SMBs may find it too much and too complex
• Steep learning curve.
• Integration is focused across Oracle tools and platforms and is spotty elsewhere.

Okta: Best for Ease of Management

Okta’s single pane of glass approach helps to simplify deployment,management and administration. They are also made easier as Okta integrates with thousands of applications. It comes. Okta integrates well, too, with Microsoft products, making it a good choice for Office 365, Azure Active Directory, Sharepoint, Intune and Windows-based access.

Pricing

• Pricing goes from a couple of dollars a month per user for one feature to $15 or so per server per month.
• But there is a long list of options and capabilities and the total soon adds up.
• There are also plans for large organizations that bundle capabilities together. These tend to favor larger deployments in terms of cost per user.

Features

• Automated provisioning and deprovisioning.
• Password-less authentication
• PAM options are available
• No-code and low-code options

Pros

• Massive library of pre-set integrations available
• Centralizes all administration
• One directory manages all users, groups, apps, devices, and policies
• SSO and MFA
• SaaS platform

Cons

• Limited customization
• No direct on-premises option
• Complex licensing and pricing to achieve full IAM capabilities
• May be expensive for SMBs

ManageEngine: Best for in-house IAM

Several of the products included here can be run in-house. But ManageEngine is probably the best – and it can also run in the cloud. The company offers a set of tools that once assembled provided comprehensive IAM.

Pricing

• Standard and professional tiers start at around $3000 and $5000 respectively, based on domains, number of help desk users, domain controllers, file servers, workstations and users.
• It gets a little complex and is quite different in terms of structure to other vendors so apples to apples comparisons are impossible.

Features

• Automated IAM
• Includes MFA and SSO
• Threat protection
• Behavioral analytics are available to spot IAM-related anomalies.

Pros

• On-premises capabilities keep local administrators in control of access.
• Fast installation and relatively smooth implementation.
• Also offers PAM active directory management and key management.

Cons

• Occasional performance and uptime issues commented on by some users.
• Demands in-house experienced administration.
• Several tool installations are required to provide complete IAM capabilities.