{"id":90,"date":"2026-10-23T21:07:13","date_gmt":"2026-10-23T19:07:13","guid":{"rendered":"https:\/\/theitlead.com\/blog\/?p=90"},"modified":"2026-10-23T21:07:13","modified_gmt":"2026-10-23T19:07:13","slug":"identity-and-access-management-software","status":"publish","type":"post","link":"https:\/\/theitlead.com\/blog\/identity-and-access-management-software\/","title":{"rendered":"Best Identity and Access Management Software for Small IT Teams"},"content":{"rendered":"\n<div class=\"ok-byline\"><div class=\"ok-who\"><span class=\"ok-avatar\" aria-hidden=\"true\">MB<\/span><div><strong>Reviewed by Max Benz<\/strong><span>Updated <time datetime=\"2026-10-23\">October 23, 2026<\/time> \u00b7 33 min read<\/span><\/div><\/div><ul class=ok-chips><li class=\"ok-chip ok-chip--ok\">Prices read on vendor pages, October 23, 2026<\/li><li class=\"ok-chip ok-chip--ok\">Ratings and review counts from G2<\/li><li class=\"ok-chip ok-chip--ok\">No sponsored placements in this comparison<\/li><\/ul><\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Identity and access management (IAM) software decides who can sign in to which systems, with which factors, and which accounts get created or removed when people join, move or leave. For a small IT team the right pick depends less on the feature list than on three questions: which ecosystem do you already pay for (Microsoft 365 or Google Workspace), who will own provisioning rules once they exist, and whether an auditor will ask for formal access reviews. This page compares nine tools on published price, the plan that unlocks each feature, free tier limits and fit for teams of 5 to 300 people.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Seven of the nine publish a per-user price on their own site. Rippling IT and SailPoint are quote only, so the tables below say \"quote only\" instead of guessing. Our earlier posts go deeper on <a href=\"\/blog\/okta-pricing\/\">Okta pricing<\/a>, <a href=\"\/blog\/jumpcloud-pricing\/\">JumpCloud pricing<\/a> and <a href=\"\/blog\/okta-vs-microsoft-entra-id\/\">Okta vs Microsoft Entra ID<\/a>.<\/p>\n\n\n\n<nav class=\"ok-toc\" aria-label=\"On this page\"><p class=\"ok-toc__h\">On this page<\/p><ol><li><a href=\"#our-picks-by-situation\">Our picks by situation<\/a><\/li><li><a href=\"#identity-and-access-management-software-compared\">Identity and access management software compared<\/a><\/li><li><a href=\"#what-identity-and-access-management-software-does\">What identity and access management software does<\/a><\/li><li><a href=\"#how-we-chose-these-tools\">How we chose these tools<\/a><\/li><li><a href=\"#iam-that-comes-with-your-stack\">IAM that comes with your stack<\/a><\/li><li><a href=\"#independent-identity-platforms\">Independent identity platforms<\/a><\/li><li><a href=\"#a-multifactor-layer-on-top-of-your-directory\">A multifactor layer on top of your directory<\/a><\/li><li><a href=\"#identity-governance-software\">Identity governance software<\/a><\/li><li><a href=\"#which-iam-plan-includes-automated-user-provisioning\">Which IAM plan includes automated user provisioning<\/a><\/li><li><a href=\"#what-iam-software-costs-for-a-small-team\">What IAM software costs for a small team<\/a><\/li><li><a href=\"#how-to-roll-out-iam-without-locking-yourself-out\">How to roll out IAM without locking yourself out<\/a><\/li><li><a href=\"#what-iam-doesn-t-answer-who-owns-your-service-accounts\">What IAM doesn't answer: who owns your service accounts<\/a><\/li><li><a href=\"#which-tool-to-pick\">Which tool to pick<\/a><\/li><li><a href=\"#frequently-asked-questions\">Frequently asked questions<\/a><\/li><\/ol><\/nav>\n\n\n\n<dl class=\"ok-stats ok-wide\"><div class=\"ok-stat\"><dt>IAM tools compared<\/dt><dd>9<\/dd><\/div><div class=\"ok-stat\"><dt>publish a per-user price<\/dt><dd>7<\/dd><\/div><div class=\"ok-stat\"><dt>have a free tier with a user cap<\/dt><dd>4<\/dd><\/div><div class=\"ok-stat\"><dt>lowest published paid price per user per month (Zoho Directory Standard)<\/dt><dd>$2<\/dd><\/div><\/dl>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"our-picks-by-situation\">Our picks by situation<\/h2>\n\n\n\n<ul class=\"ok-picks ok-wide\"><li class=\"ok-pick\"><a href=\"#microsoft-entra-id\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/microsoft-entra-id.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if you already pay for Microsoft 365 Business Premium<\/span><span class=\"ok-pick__name\">Microsoft Entra ID<\/span><span class=\"ok-pick__text\">P1 with Conditional Access is already in that license, so the identity layer costs nothing extra.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">P1 $7\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#google-cloud-identity\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/google-cloud-identity.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best free start on Google Workspace<\/span><span class=\"ok-pick__name\">Google Cloud Identity<\/span><span class=\"ok-pick__text\">SAML single sign-on and 2-Step Verification are free for the first 50 users.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.3 G2<\/span><span class=\"ok-chip\">Free; Premium $8.40\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#jumpcloud\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for mixed Mac, Windows and Linux fleets<\/span><span class=\"ok-pick__name\">JumpCloud<\/span><span class=\"ok-pick__text\">Directory, SSO, MFA and device management at a public per-user price, with hosted LDAP and RADIUS.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">From $9\/user\/mo annually<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#okta-workforce-identity\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/okta-workforce-identity.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best for many third-party SaaS apps<\/span><span class=\"ok-pick__name\">Okta Workforce Identity<\/span><span class=\"ok-pick__text\">Lifecycle automation and access governance start at the $17 Essentials plan, with a $1,500 annual minimum.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">From $6\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#onelogin\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/onelogin.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best standalone identity provider with public prices<\/span><span class=\"ok-pick__name\">OneLogin<\/span><span class=\"ok-pick__text\">Three packs at $3, $6 and $10 per user per month, with provisioning rules unlocked at $6.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.4 G2<\/span><span class=\"ok-chip\">$3 to $10\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#rippling-it\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/rippling-it.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best if HR data should drive access<\/span><span class=\"ok-pick__name\">Rippling IT<\/span><span class=\"ok-pick__text\">A hire, role change or exit changes app accounts, groups and devices without a ticket, but the price is a quote.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.7 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#zoho-directory\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zoho-directory.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Cheapest credible all-in-one<\/span><span class=\"ok-pick__name\">Zoho Directory<\/span><span class=\"ok-pick__text\">Free for 10 users and $2 to $7 per user per month after that, with only 2 reviews on G2 to back it up.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.0 G2<\/span><span class=\"ok-chip\">Free; $2 to $7\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#cisco-duo\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/duo.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best MFA layer on top of a directory<\/span><span class=\"ok-pick__name\">Cisco Duo<\/span><span class=\"ok-pick__text\">Free for 10 users and $3 for single sign-on and trusted device checks, but it doesn't host your directory.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.5 G2<\/span><span class=\"ok-chip\">Free; $3 to $9\/user\/mo<\/span><\/span><\/a><\/li><li class=\"ok-pick\"><a href=\"#sailpoint\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/sailpoint.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Best when auditors demand access certifications<\/span><span class=\"ok-pick__name\">SailPoint<\/span><span class=\"ok-pick__text\">Formal certification campaigns and separation-of-duties checks, sold to enterprises on a quote.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605<\/span> 4.6 G2<\/span><span class=\"ok-chip\">Quote only<\/span><\/span><\/a><\/li><li class=\"ok-pick ok-pick--ours\"><a href=\"#the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><span class=\"ok-pick__tag\">Our product \u00b7 for the gaps between tools<\/span><span class=\"ok-pick__name\">The IT Lead<\/span><span class=\"ok-pick__text\">Records who owns each service account and when it was last reviewed, from a CSV import.<\/span><span class=\"ok-pick__meta\"><span class=\"ok-chip\">Access code<\/span><\/span><\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"identity-and-access-management-software-compared\">Identity and access management software compared<\/h2>\n\n\n\n<div class=\"ok-compare ok-wide\" data-filter=\"1\"><div class=\"ok-scroll\"><table><thead><tr><th scope=\"col\">Tool<\/th><th scope=\"col\">Type<\/th><th scope=\"col\">What it hands over<\/th><th scope=\"col\">Price as published (USD)<\/th><th scope=\"col\" data-sort=num>G2 rating<\/th><\/tr><\/thead><tbody><tr data-cat=\"Workforce identity and access management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/microsoft-entra-id.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Microsoft Entra ID<\/span><\/th><td><span class=\"ok-job\">Workforce identity and access management<\/span><\/td><td class=\"ok-muted\">Microsoft tenant identities to app access, Conditional Access and provisioning<\/td><td>P1 $7 per user per month and P2 $10 per user per month, paid yearly; included in certain Microsoft 365 plans<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(915)<\/span><\/td><\/tr><tr data-cat=\"Workforce identity and access management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/google-cloud-identity.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Google Cloud Identity<\/span><\/th><td><span class=\"ok-job\">Workforce identity and access management<\/span><\/td><td class=\"ok-muted\">Google directory to SAML sign-in, 2-Step Verification and basic device control<\/td><td>Free edition $0 (starts with a 50-user cap); Premium $8.40 per user per month on the flexible plan, billed through Google Workspace<\/td><td data-v=\"4.3\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.3 <span class=\"ok-muted\">(34)<\/span><\/td><\/tr><tr data-cat=\"Workforce identity and access management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/okta-workforce-identity.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Okta Workforce Identity<\/span><\/th><td><span class=\"ok-job\">Workforce identity and access management<\/span><\/td><td class=\"ok-muted\">HR and directory profile to app assignment, authentication and provisioning<\/td><td>Starter from $6 per user per month, annual billing; $1,500 annual contract minimum<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(1,429)<\/span><\/td><\/tr><tr data-cat=\"Directory-led device management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>JumpCloud<\/span><\/th><td><span class=\"ok-job\">Directory-led device management<\/span><\/td><td class=\"ok-muted\">Directory, SSO and MDM for Apple, Android, Windows and Linux in one console<\/td><td>Device Management $9, SSO $11, Device Identity Management $13 per user per month, billed annually<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(4,121)<\/span><\/td><\/tr><tr data-cat=\"Workforce identity and access management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/onelogin.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>OneLogin<\/span><\/th><td><span class=\"ok-job\">Workforce identity and access management<\/span><\/td><td class=\"ok-muted\">Directory or HR source to role-based app access, MFA and provisioning<\/td><td>Basic $3, Essentials $6, Business $10 per user per month; Enterprise by quote; Workflows add-on $2<\/td><td data-v=\"4.4\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.4 <span class=\"ok-muted\">(291)<\/span><\/td><\/tr><tr data-cat=\"HR-driven identity and device management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/rippling-it.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Rippling IT<\/span><\/th><td><span class=\"ok-job\">HR-driven identity and device management<\/span><\/td><td class=\"ok-muted\">HR record to app accounts, groups, licenses and managed devices<\/td><td>No published IT price; plans start at $8 per employee per month with a monthly base fee, per Rippling&#x27;s pricing page<\/td><td data-v=\"4.7\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7 <span class=\"ok-muted\">(1,204)<\/span><\/td><\/tr><tr data-cat=\"Workforce identity and access management\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zoho-directory.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Zoho Directory<\/span><\/th><td><span class=\"ok-job\">Workforce identity and access management<\/span><\/td><td class=\"ok-muted\">Cloud directory to SSO, MFA, device login and hosted LDAP or RADIUS<\/td><td>Free for 10 users; Standard $2, Professional $7 per user per month billed monthly; 15% off billed yearly<\/td><td data-v=\"4.0\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.0 <span class=\"ok-muted\">(2)<\/span><\/td><\/tr><tr data-cat=\"MFA and single sign-on layer\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/duo.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Cisco Duo<\/span><\/th><td><span class=\"ok-job\">MFA and single sign-on layer<\/span><\/td><td class=\"ok-muted\">Your directory or identity provider to MFA, SSO and device trust checks at every login<\/td><td>Free up to 10 users; Essentials $3, Advantage $6, Premier $9 per user per month<\/td><td data-v=\"4.5\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5 <span class=\"ok-muted\">(590)<\/span><\/td><\/tr><tr data-cat=\"Identity governance and administration\"><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/sailpoint.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>SailPoint<\/span><\/th><td><span class=\"ok-job\">Identity governance and administration<\/span><\/td><td class=\"ok-muted\">Identity sources to access requests, certification campaigns and lifecycle changes<\/td><td>Quote only; no public price list or minimum<\/td><td data-v=\"4.6\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6 <span class=\"ok-muted\">(258)<\/span><\/td><\/tr><tr data-cat=\"Service account ownership reviews\" class=ok-ours><th scope=\"row\"><span class=\"ok-tcell\"><span class=\"ok-fav ok-fav--sm ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>The IT Lead <span class=\"ok-chip ok-chip--ours\">Our product<\/span><\/span><\/th><td><span class=\"ok-job ok-job--ours\">Service account ownership reviews<\/span><\/td><td class=\"ok-muted\">Collects owner attestations for service accounts and keeps the review trail<\/td><td>Access code<\/td><td data-v=\"0\"><span class=\"ok-muted\">No reviews yet<\/span><\/td><\/tr><\/tbody><\/table><\/div><p class=\"ok-note\">Prices come from each vendor's own pages, read on October 23, 2026. Ratings are G2 with the number of reviews in brackets, read the same day. The SailPoint rating covers all SailPoint products, and Zoho Directory has only 2 reviews.<\/p><\/div>\n\n\n\n<aside class=\"ok-callout ok-callout--tip\"><p><strong>What this list leaves out<\/strong> Customer identity tools such as Auth0 secure sign-ins for an app's own users, and AWS IAM controls access inside a cloud account. Both show up in the same search results, but neither manages your employees' access to business apps, so they aren't compared here. IBM Security Verify, Oracle, Ping Identity and CyberArk Workforce Identity also appear in competing lists; they are generally aimed at larger organizations and were not part of this comparison.<\/p><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-identity-and-access-management-software-does\">What identity and access management software does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Identity and access management software controls who can sign in to which systems and what they can do there. It does that through four jobs: authentication (proving who someone is), authorization (deciding what they may reach), provisioning (creating, changing and removing accounts in each app) and governance (checking that the access people hold is still needed).<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Authentication.<\/strong> Single sign-on (SSO) lets one login open many apps, and multi-factor authentication (MFA) adds a second proof such as an authenticator app or a security key.<\/li><li><strong>Authorization.<\/strong> Rules decide who gets what: role-based access control (RBAC), group membership, and conditions such as device state or location.<\/li><li><strong>Provisioning.<\/strong> When someone joins, changes role or leaves, accounts and licenses in connected apps are created, updated or disabled, usually over SCIM.<\/li><li><strong>Governance.<\/strong> Access requests, approvals and periodic reviews that prove access is still needed.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Most small teams need the first three and can postpone the fourth. The tools differ most in how much of provisioning is automatic and in which plan it sits.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"iam-vs-iga-vs-pam\">IAM vs IGA vs PAM<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Term<\/th><th>What it controls<\/th><th>Typical question it answers<\/th><\/tr><\/thead><tbody><tr><td>Identity and access management (IAM)<\/td><td>Sign-in, MFA, app access and account provisioning<\/td><td>Who can open this app, and is it really them?<\/td><\/tr><tr><td>Identity governance and administration (IGA)<\/td><td>Access requests, approvals and certification campaigns<\/td><td>Does this person still need this access, and who signed off?<\/td><\/tr><tr><td>Privileged access management (PAM)<\/td><td>Admin and break-glass accounts, session limits and recording<\/td><td>Who used the domain admin account, for how long, and what did they do?<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Our <a href=\"\/blog\/privileged-access-management-software\/\">privileged access management comparison<\/a> covers the third row in depth. The governance row has its own section further down.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-we-chose-these-tools\">How we chose these tools<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The list is built for small IT teams and MSPs, so each tool is judged on six points:<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li><strong>Published price.<\/strong> Whether a per-user list price exists on the vendor's own site, and which plan it belongs to.<\/li><li><strong>Plan gates.<\/strong> Which plan unlocks automated provisioning, conditional access and governance.<\/li><li><strong>Free tier.<\/strong> Whether a free plan exists and where its user cap sits.<\/li><li><strong>Directory or layer.<\/strong> Whether the tool hosts the user directory or sits on top of one.<\/li><li><strong>Effort to run.<\/strong> Who has to own rules, sync and offboarding tests.<\/li><li><strong>Evidence.<\/strong> G2 rating and review count, read on October 23, 2026.<\/li><\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Tools are grouped by the layer they occupy, because a small team usually picks one directory and then decides whether it needs an MFA layer or a governance layer on top.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"iam-that-comes-with-your-stack\">IAM that comes with your stack<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If the company already runs Microsoft 365 or Google Workspace, the first thing to check is what the identity layer in that license already does.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"microsoft-entra-id\">Microsoft Entra ID<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"microsoft-entra-id-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/microsoft-entra-id.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"microsoft-entra-id-2\">Microsoft Entra ID<\/h3><p class=\"ok-card__sub\">Microsoft identity platform for tenant administration, SSO, Conditional Access and app provisioning. P2 and separate governance licensing determine advanced coverage.<\/p><\/div><span class=\"ok-job\">Workforce identity and access management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 915 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">If the company already pays for Microsoft 365 Business Premium, E3 or E5, the identity layer is largely paid for: Entra ID P1 with Conditional Access is included.<\/p><p>Entra ID is the directory behind Microsoft 365 and Azure. The Free tier covers single sign-on and MFA through security defaults, which are all or nothing: users can register only the Authenticator app, and you can't exclude accounts. P1 at $7 per user per month, paid yearly, adds Conditional Access, passwordless and phishing-resistant sign-in, group provisioning and provisioning logs. P2 at $10 adds risk-based Conditional Access and Privileged Identity Management.<\/p><p>Governance is licensed separately. Microsoft lists Entra ID Governance at $7 per user per month and the Entra Suite at $12, and the suite needs P1 underneath. Microsoft's pricing page says Entra ID Free is included with a Microsoft 365 or Azure subscription.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>Microsoft 365 identity and access policies are already the operating foundation<\/li><li>existing E3, E5 or Business Premium licenses cover the required tier<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>an independent identity control plane is a formal architecture requirement<\/li><li>the required governance workflow is not included in current entitlements and no upgrade is budgeted<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>MFA, single sign-on and an intuitive layout, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>complex licensing across Free, P1, P2, Governance and Suite, and a single point of failure for Microsoft 365 sign-in, per Capterra reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/microsoft-entra-id\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 915 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-microsoft-entra-id-screenshot.png\" alt=\"Microsoft Entra admin center Conditional Access Policies page listing eight policies with their state, creation date and modified date, plus a What If button in the toolbar.\" width=\"1400\" height=\"784\" loading=\"lazy\" decoding=\"async\"><figcaption>Conditional Access policies list in the Entra admin center, from Microsoft Learn<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>A Conditional Access policy is built in the Entra admin center under Entra ID, Conditional Access: pick users or groups, the apps, and conditions such as location, device state or risk, then choose block or require MFA. Report-only mode shows what a policy would have done before it is enforced, which is the safest way to avoid locking out admins.<\/p><p>App provisioning connects to an application's SCIM 2.0 endpoint. The first cycle queries all in-scope users and creates matching accounts, and later cycles use delta queries. A user who leaves scope or is disabled in Entra is disabled in the target app, and the hard delete is sent 30 days after a soft delete. Nested groups can't define scope, and dynamic groups slow provisioning because membership must be evaluated first.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>P1 $7 per user per month and P2 $10 per user per month, paid yearly; included in certain Microsoft 365 plans<\/dd><\/div><div><dt>Free<\/dt><dd>SSO and MFA<\/dd><\/div><div><dt>P1<\/dt><dd>Conditional Access<\/dd><\/div><div><dt>P2<\/dt><dd>Risk-based Conditional Access and PIM<\/dd><\/div><div><dt>Governance<\/dt><dd>$7 per user per month add-on<\/dd><\/div><div><dt>Included in<\/dt><dd>Microsoft 365 Business Premium, E3 and E5 (P1)<\/dd><\/div><div><dt>Entra Suite<\/dt><dd>$12 per user per month, needs P1<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<div class=\"ok-ladder\"><div class=\"ok-ladder__head\"><span class=\"ok-fav ok-fav--sm\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/microsoft-entra-id.png\" alt=\"\" width=\"18\" height=\"18\" loading=\"lazy\" decoding=\"async\"><\/span>Microsoft Entra ID<\/div><ol><li><span class=\"ok-ladder__tier\">Free<\/span><span class=\"ok-ladder__text\">SSO and security defaults MFA with the Authenticator app only<\/span><\/li><li class=ok-on><span class=\"ok-ladder__tier\">P1, $7<\/span><span class=\"ok-ladder__text\">Conditional Access, passwordless sign-in, group and on-premises app provisioning, provisioning logs<\/span><\/li><li><span class=\"ok-ladder__tier\">P2, $10<\/span><span class=\"ok-ladder__text\">Risk-based Conditional Access, Privileged Identity Management, basic access reviews and entitlement management<\/span><\/li><li><span class=\"ok-ladder__tier\">ID Governance, $7 add-on<\/span><span class=\"ok-ladder__text\">Lifecycle Workflows (up to 50 per tenant), expanded access reviews, account discovery<\/span><\/li><\/ol><\/div>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"google-cloud-identity\">Google Cloud Identity<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"google-cloud-identity-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/google-cloud-identity.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"google-cloud-identity-2\">Google Cloud Identity<\/h3><p class=\"ok-card__sub\">Google's standalone identity layer: a cloud directory with SAML single sign-on, 2-Step Verification, groups and basic device management for free, with automated app provisioning, context-aware access and Secure LDAP on Premium.<\/p><\/div><span class=\"ok-job\">Workforce identity and access management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.3<span class=\"ok-muted\"> \u00b7 34 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">For a team on Google Workspace, or one that wants a free directory with SAML SSO, Cloud Identity Free covers more than most people expect.<\/p><p>Cloud Identity Free costs $0 and starts with a cap of 50 user licenses. It includes SAML single sign-on for pre-built and custom apps, 2-Step Verification, security keys, groups, organizational units, Google Cloud Directory Sync for Active Directory and basic device management. Premium is billed through a Google Workspace subscription at $8.40 per user per month on the flexible plan; Google's help pages don't show an annual Premium price. It adds automated user provisioning to third-party apps, Context-Aware Access, Secure LDAP, Windows device management and log export to BigQuery.<\/p><p>The plan gate to remember is provisioning: sign-in is free, but creating and removing accounts in other SaaS apps automatically needs Premium.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>your team already lives in Google Workspace or you want a free directory with SAML SSO and 2-Step Verification for up to 50 users<\/li><li>you can stay on the Free edition and only pay for Premium when automated provisioning or context-aware access becomes the gap<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you run mainly Microsoft 365 and Windows, where Entra ID gives you Conditional Access and device compliance in one place<\/li><li>you need automated provisioning to many SaaS apps but have more than 50 users and no Workspace or Premium licenses<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>the admin console, Google integration, and SSO and MFA, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>confusing setup for small teams, advanced policies that need technical skill, and limited native reporting, per G2's summary of reviewer themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/google-cloud-identity\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 34 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-google-cloud-identity-screenshot.png\" alt=\"Google Admin console Web and mobile apps page listing apps with platform, SAML or OAuth authentication, user access scope and certificate details, with Add App and Settings menus above.\" width=\"1280\" height=\"796\" loading=\"lazy\" decoding=\"async\"><figcaption>Web and mobile apps list in the Google Admin console, from the Google Workspace Updates blog<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>A custom SAML app is added in the Admin console under Apps, Web and mobile apps. A super administrator copies Google's SSO URL, entity ID and certificate into the service provider, enters the app's ACS URL and entity ID, maps attributes and groups, and turns the app on for everyone or for specific organizational units. Test SAML login confirms it before rollout.<\/p><p>Two limits matter at scale: a custom SAML app supports up to 75 groups, and changes can take up to 24 hours to apply.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Free edition $0 (starts with a 50-user cap); Premium $8.40 per user per month on the flexible plan, billed through Google Workspace<\/dd><\/div><div><dt>Free edition<\/dt><dd>SAML SSO, 2-Step Verification, groups, basic device management<\/dd><\/div><div><dt>Premium adds<\/dt><dd>Automated provisioning, Context-Aware Access, Secure LDAP<\/dd><\/div><div><dt>User cap<\/dt><dd>Free starts at 50 users<\/dd><\/div><div><dt>Custom SAML app limit<\/dt><dd>75 groups per app<\/dd><\/div><div><dt>Free user cap<\/dt><dd>Starts at 50 users<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"independent-identity-platforms\">Independent identity platforms<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Independent identity platforms replace or sit beside the directory in your productivity suite. They make sense when the app estate is mixed, when users are on both Microsoft and Google, or when the identity provider should not depend on one suite.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"okta-workforce-identity\">Okta Workforce Identity<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"okta-workforce-identity-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/okta-workforce-identity.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"okta-workforce-identity-2\">Okta Workforce Identity<\/h3><p class=\"ok-card__sub\">Independent workforce identity platform with Universal Directory, SSO and MFA. Lifecycle and access governance capabilities depend on suite or add-ons.<\/p><\/div><span class=\"ok-job\">Workforce identity and access management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 1,429 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Okta fits companies with many third-party SaaS apps and someone who will own provisioning rules, because its lifecycle automation is mature and its price rises with the plan.<\/p><p>Okta publishes three plans, billed annually: Starter at $6 per user per month (single sign-on, MFA, Universal Directory and 5 Workflows), Core Essentials at $14 and Essentials at $17. Essentials adds Adaptive MFA, Lifecycle Management, Access Governance and 50 Workflows. Professional and Enterprise are quote only, and Workforce Identity has a $1,500 annual contract minimum, which matters below about 20 users. Okta's pricing page gives no clear feature list for Core Essentials, so ask before choosing it.<\/p><p>The practical gate is $17: automated joiner, mover and leaver changes and access reviews sit in Essentials, not in the $6 plan that most price comparisons quote.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>identity administration should remain independent of the Microsoft productivity tenant<\/li><li>a mixed app portfolio needs explicit directory and lifecycle ownership<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>existing Microsoft licenses already cover the necessary access controls and a second IdP adds no tested value<\/li><li>the team cannot support federation and provisioning ownership across systems<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>reliable SSO and MFA and quick implementation, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>onboarding time, occasional configuration issues and pricing, per G2 reviewers' themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/okta\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 1,429 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-okta-workforce-identity-screenshot.png\" alt=\"Okta Workflows console home page showing introductory templates and a Lifecycle Management template tab with cards such as identify inactive users, suspend inactive users and onboard with Office365.\" width=\"973\" height=\"780\" loading=\"lazy\" decoding=\"async\"><figcaption>Okta Workflows console template gallery, from Okta Help Center<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Lifecycle Management treats the HR system as the source of truth. When a record changes in Workday, BambooHR or SuccessFactors, Okta creates, updates or deactivates accounts in connected apps over SCIM. Okta Workflows adds no-code flows built from event and action cards, with execution history and an API endpoint to start a flow.<\/p><p>Okta's own documentation warns that mixing standard lifecycle provisioning with custom provisioning actions in a flow can produce conflicting changes, and downstream app rate limits can interrupt flows. Test an offboarding end to end before trusting it. Our <a href=\"\/blog\/okta-review\/\">Okta review<\/a> and <a href=\"\/blog\/okta-pricing\/\">Okta pricing breakdown<\/a> cover the plans in more detail.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Starter from $6 per user per month, annual billing; $1,500 annual contract minimum<\/dd><\/div><div><dt>Starter<\/dt><dd>SSO, MFA, Universal Directory<\/dd><\/div><div><dt>Essentials<\/dt><dd>Adaptive MFA, Lifecycle Management, Access Governance<\/dd><\/div><div><dt>Workforce contract minimum<\/dt><dd>$1,500 annually<\/dd><\/div><div><dt>Annual minimum<\/dt><dd>$1,500<\/dd><\/div><div><dt>Workflows<\/dt><dd>5 on Starter, 50 on Essentials<\/dd><\/div><div><dt>Lifecycle and governance<\/dt><dd>Essentials ($17) and up<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"jumpcloud\">JumpCloud<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"jumpcloud-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/jumpcloud.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"jumpcloud-2\">JumpCloud<\/h3><p class=\"ok-card__sub\">JumpCloud bundles Apple MDM and Android management into its directory and identity platform and prices per user instead of per device.<\/p><\/div><span class=\"ok-job\">Directory-led device management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 4,121 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">JumpCloud is the natural pick for a team with Mac, Windows and Linux machines that wants directory, single sign-on and device management from one vendor at a per-user price.<\/p><p>JumpCloud publishes three bundles per user per month, billed annually: Device Management at $9, SSO at $11 and Device Identity Management at $13. Monthly billing costs $2 more in each case. Individual add-ons such as Cloud LDAP and Cloud RADIUS are $3 each, and Access Requests is $5. Platform Essentials, Platform and Platform Prime are quote only, and Platform Essentials is capped at 300 users. New customers get a 30 day trial but no free plan.<\/p><p>The saving for small offices is hosted LDAP and RADIUS: Wi-Fi, VPN and legacy apps authenticate against JumpCloud instead of a server you run.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want directory, SSO and device management from one vendor with a public per-user price<\/li><li>you run Mac, Windows and Linux and want MDM for phones as an add-on<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need the deepest mobile controls, which reviewers say are still evolving<\/li><li>you only need mobile management and have no use for the directory layer<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>easy onboarding and unified management of identity and devices, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>Windows group policy gaps, MFA gaps with LDAP and a learning curve, per G2's summary of reviewer themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/jumpcloud\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 4,121 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-jumpcloud-screenshot.png\" alt=\"JumpCloud admin console Applications page listing configured SSO apps such as Atlassian, AWS, Slack and Zoom with status icons and JIT provisioning and identity management support tags.\" width=\"1400\" height=\"1050\" loading=\"lazy\" decoding=\"async\"><figcaption>JumpCloud Configured Applications screen (SSO app list), JumpCloud Cloud Directory platform page<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Cloud LDAP is set up by creating a binding user in the admin portal with the LDAP bind DN option enabled, adding users and groups to the LDAP directory, and pointing the app at ldap.jumpcloud.com on port 389 with STARTTLS or 636 for LDAPS. Plaintext connections and anonymous binds are refused, and the directory is read-only, so changes go through the console or API. MFA for LDAP apps is enforced through a conditional or global policy.<\/p><p>Suspended users are still billable, so offboarding means deleting accounts, not only suspending them. See our <a href=\"\/blog\/jumpcloud-pricing\/\">JumpCloud pricing guide<\/a> for the billing rules.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Device Management $9, SSO $11, Device Identity Management $13 per user per month, billed annually<\/dd><\/div><div><dt>Entry price<\/dt><dd>$9 per user per month, annual<\/dd><\/div><div><dt>MDM add-on<\/dt><dd>$5 per user per month, annual<\/dd><\/div><div><dt>Trial<\/dt><dd>30 days<\/dd><\/div><div><dt>Public Device Management<\/dt><dd>$9\/user\/mo annual<\/dd><\/div><div><dt>Public SSO<\/dt><dd>$11\/user\/mo annual<\/dd><\/div><div><dt>Public Device Identity Management<\/dt><dd>$13\/user\/mo annual<\/dd><\/div><div><dt>Platform packages<\/dt><dd>Contact Sales<\/dd><\/div><div><dt>Legacy free<\/dt><dd>Only eligible pre-February 2024 accounts<\/dd><\/div><div><dt>Hosted LDAP and RADIUS<\/dt><dd>$3 each as add-ons<\/dd><\/div><div><dt>Free plan<\/dt><dd>None for new customers<\/dd><\/div><div><dt>Quote only<\/dt><dd>Platform Essentials, Platform, Platform Prime<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"onelogin\">OneLogin<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"onelogin-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/onelogin.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"onelogin-2\">OneLogin<\/h3><p class=\"ok-card__sub\">A dedicated cloud identity provider with SSO, MFA, directory sync and role-based provisioning, owned by One Identity (Quest) since 2021, with public list prices for three of its four packs.<\/p><\/div><span class=\"ok-job\">Workforce identity and access management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.4<span class=\"ok-muted\"> \u00b7 291 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">OneLogin is one of the few established identity providers that publishes three per-user prices, so a small team can budget without a sales call.<\/p><p>Basic is $3 per user per month and includes SSO, MFA, an app catalog and Active Directory sync, but limits security policies and provisioning rules to 5. Essentials at $6 removes that limit and adds automated provisioning and deprovisioning plus Entra ID and Google Workspace directory sync. Business at $10 adds SmartFactor adaptive MFA, Desktop MFA, HR sync from Workday, UKG, Namely or BambooHR, role-based access control, RADIUS and virtual LDAP. Enterprise is call for pricing and holds delegated administration, LDAP sync and API access management. OneLogin Workflows is a separate $2 per user per month add-on.<\/p><p>OneLogin has belonged to One Identity, a Quest Software business, since October 2021, and the pricing page still sells Workforce Identity under that ownership.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want a standalone identity provider with published per-user prices and directory sync from Active Directory, Entra ID, Google Workspace or an HR system<\/li><li>you need RADIUS or virtual LDAP for Wi-Fi, VPN and legacy apps on the Business pack<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you want identity and device management in one product, because nothing on OneLogin's pages shows MDM<\/li><li>you need delegated administration, LDAP sync or API access management for multi-tenant MSP use, which are Enterprise-only with no public price<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>MFA and password vaulting, and one access point for many apps, per G2's summary of reviewer themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>limited advanced IAM features, occasional login issues and slow support during outages, per G2's summary of reviewer themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/onelogin\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 291 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-onelogin-screenshot.png\" alt=\"OneLogin admin console Mappings page showing enabled and disabled user mapping rules with their conditions, plus a highlighted New Mappings button, displayed on a laptop.\" width=\"1200\" height=\"770\" loading=\"lazy\" decoding=\"async\"><figcaption>OneLogin user mappings screen, OneLogin Identity Lifecycle Management product page<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>OneLogin controls access through user mappings, which are if-then rules. A condition checks a source, an operator and a value, for example a custom attribute city equal to Montreal, and an action such as adding a role. In OneLogin's developer example, users in Montreal automatically receive a Montreal reader role, and roles assigned by a mapping can't be removed by hand.<\/p><p>Mappings changed through the API don't run on their own: a user must be created or updated, or an admin must run Reapply Mappings in the console.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Basic $3, Essentials $6, Business $10 per user per month; Enterprise by quote; Workflows add-on $2<\/dd><\/div><div><dt>Basic ($3)<\/dt><dd>SSO, MFA, AD sync, 5 provisioning rules<\/dd><\/div><div><dt>Essentials ($6)<\/dt><dd>Unlimited provisioning rules, Entra ID and Google sync<\/dd><\/div><div><dt>Business ($10)<\/dt><dd>SmartFactor adaptive MFA, Desktop MFA, HR sync, RBAC<\/dd><\/div><div><dt>Workflows<\/dt><dd>$2 per user per month add-on<\/dd><\/div><div><dt>Provisioning rules<\/dt><dd>5 on Basic, unlimited from Essentials<\/dd><\/div><div><dt>Add-on<\/dt><dd>Workflows, $2 per user per month<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"rippling-it\">Rippling IT<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"rippling-it-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/rippling-it.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"rippling-it-2\">Rippling IT<\/h3><p class=\"ok-card__sub\">Rippling IT drives identity, SSO, MFA, app provisioning and device management from the same employee record as HR and payroll, so a hire, role change or exit changes accounts, groups and devices without tickets.<\/p><\/div><span class=\"ok-job\">HR-driven identity and device management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.7<span class=\"ok-muted\"> \u00b7 1,204 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Rippling IT makes sense when HR, payroll and IT should run from the same employee record, so that employee data decides app access and device policy.<\/p><p>Rippling stores attributes such as role, department, manager and status, or syncs them from an external HR system or directory. Rules and dynamic groups called Supergroups act on those attributes, so a hire, a role change or an exit creates, updates or revokes app accounts, group memberships, licenses and device policies without a ticket. Custom apps connect over SAML and SCIM, and Cloud RADIUS and virtual LDAP cover Wi-Fi, VPN and legacy systems. Device management covers macOS, Windows, iOS and iPadOS.<\/p><p>Rippling publishes no IT price. Its pricing page says plans start at $8 per employee per month with a monthly base fee, and the quote form takes it from there. Third-party benchmarks (Vendr) put a median deal near $45,645 a year, and independent estimates for the IT modules disagree with each other, so treat any number you read elsewhere as a guess until you have a quote.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you also want HR and payroll in the same system, so employee data decides app access and device policy<\/li><li>you want joiner, mover and leaver changes to provision and suspend accounts automatically instead of by ticket<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need a published price or a predictable per-user bill, because Rippling IT is quote only<\/li><li>you want a standalone identity provider with no HR layer, or device management for Android and Linux, since Rippling lists macOS, Windows, iOS and iPadOS<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>HR and IT in one place and automated provisioning and offboarding, per G2 reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>complex setup for smaller teams without IT experience and device-agent prompts during meetings, per G2 reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/rippling-it\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 1,204 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-rippling-it-screenshot.png\" alt=\"Rippling IT Management admin screen on the People tab with an All requests table showing device assignment and app access provisioning requests with onboarding and offboarding statuses.\" width=\"1400\" height=\"830\" loading=\"lazy\" decoding=\"async\"><figcaption>Rippling IT Management requests table, Rippling IT device management product page<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Rippling's own SSO rollout guide describes three steps: add employees from Rippling, an external HR system, a directory or a CSV; set up Supergroups; then deploy SSO with pre-built or custom SAML and SCIM apps, preview the changes and fix account mismatches. After that, provisioning, updates and revocation run automatically. The guide claims a 50 app rollout in one day, which is a vendor claim without supporting data.<\/p><p>Whether Rippling IT can be bought without the HR platform isn't stated on the pricing page, so ask in the first call.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>No published IT price; plans start at $8 per employee per month with a monthly base fee, per Rippling&#x27;s pricing page<\/dd><\/div><div><dt>Pricing<\/dt><dd>Quote only, monthly base fee<\/dd><\/div><div><dt>Provisioning<\/dt><dd>SAML and SCIM, rule-based from HR data<\/dd><\/div><div><dt>Devices<\/dt><dd>macOS, Windows, iOS, iPadOS<\/dd><\/div><div><dt>Dynamic groups<\/dt><dd>Supergroups by department, location or tenure<\/dd><\/div><div><dt>Device management<\/dt><dd>macOS, Windows, iOS, iPadOS<\/dd><\/div><div><dt>Integrations<\/dt><dd>Pages cite 600+, 650+ and 800+ apps<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"zoho-directory\">Zoho Directory<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"zoho-directory-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/zoho-directory.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"zoho-directory-2\">Zoho Directory<\/h3><p class=\"ok-card__sub\">Zoho's standalone directory and identity service with SSO, MFA, Active Directory sync, conditional access, device login and hosted Cloud LDAP and RADIUS, priced well below most identity vendors.<\/p><\/div><span class=\"ok-job\">Workforce identity and access management<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.0<span class=\"ok-muted\"> \u00b7 2 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Zoho Directory is the cheapest all-in-one directory in this list, and the one with the least independent evidence behind it.<\/p><p>The Free plan covers 10 users with SSO for 3 third-party apps (unlimited Zoho apps), MFA through Zoho OneAuth, Cloud RADIUS and Cloud LDAP for 10 users, and anomaly detection. Standard is $2 per user per month and Professional is $7, both billed monthly, with 15% off for yearly billing and a 45 day trial. Standard removes the app limit and adds custom provisioning and a custom domain. Professional adds 10 directory stores, custom admin roles and unlimited RADIUS and LDAP. Zoho's pricing page showed euros in our browser, so the dollar figures come from the Zoho-provided listing on G2 and should be confirmed at checkout.<\/p><p>The warning is evidence: G2 shows 4.0 from 2 reviews, and Capterra and GetApp show none. Run the 45 day trial before betting a client on it.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you want the cheapest credible all-in-one directory with SSO, MFA and device login, especially if you already run Zoho apps<\/li><li>you need hosted Cloud LDAP or RADIUS for Wi-Fi, VPN or printers without running servers<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need independent proof from many reviews, because G2 shows only 2 reviews and Capterra and GetApp show none<\/li><li>you need full device management with patching and app deployment, since the pages read describe device login only<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>too few reviews to name themes<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>too few reviews to name themes<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/zoho-directory\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 2 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-zoho-directory-screenshot.png\" alt=\"Zoho Directory admin console Sign-in Simulator under Security and Conditional Access Policies, with fields for user name, location, IP address, platform and device management status.\" width=\"1300\" height=\"762\" loading=\"lazy\" decoding=\"async\"><figcaption>Zoho Directory admin console: Sign-in Simulator for conditional access policies (Zoho Directory help center)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Zoho Directory can be the identity provider for a custom app, or it can accept an external one. In the second case an admin opens Security, Custom Authentication, adds Okta, Entra ID or Google as a SAML identity provider, chooses which user groups sign in through it and sets the IdP priority. Smart groups assign users automatically by department, role or attribute, and conditional access policies can deny, allow or require MFA by location, time, IP and device.<\/p><p>The pages we read describe device login for Linux, Mac and Windows laptops, not full device management with patching and app deployment, and they don't document SCIM or OIDC in depth.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Free for 10 users; Standard $2, Professional $7 per user per month billed monthly; 15% off billed yearly<\/dd><\/div><div><dt>Free plan<\/dt><dd>10 users, SSO for 3 third-party apps<\/dd><\/div><div><dt>Standard ($2)<\/dt><dd>Unlimited SSO apps, custom provisioning<\/dd><\/div><div><dt>Professional ($7)<\/dt><dd>10 directory stores, custom admin roles<\/dd><\/div><div><dt>Trial<\/dt><dd>45 days<\/dd><\/div><div><dt>Billing<\/dt><dd>$2 and $7 monthly, 15% off yearly<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"a-multifactor-layer-on-top-of-your-directory\">A multifactor layer on top of your directory<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Sometimes the directory is fine and the gap is the second authentication factor. A layer that sits in front of Active Directory, Entra ID, Google Workspace or Okta is cheaper than replacing the directory.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"cisco-duo\">Cisco Duo<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"cisco-duo-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/duo.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"cisco-duo-2\">Cisco Duo<\/h3><p class=\"ok-card__sub\">Duo puts MFA, single sign-on and device trust in front of the directory you already run, whether that is Active Directory, Entra ID, Google Workspace or Okta. It does not host your full directory or automate joiners, movers and leavers.<\/p><\/div><span class=\"ok-job\">MFA and single sign-on layer<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.5<span class=\"ok-muted\"> \u00b7 590 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">Duo is the cheapest way to add strong MFA, single sign-on and device checks to a directory you already run.<\/p><p>Duo publishes four editions per user per month: Free for up to 10 users, Essentials at $3, Advantage at $6 and Premier at $9. Essentials adds Duo SSO, the Duo Directory user store, phishing-resistant MFA, passwordless sign-in and Trusted Endpoints. Advantage adds Duo Passport, risk-based authentication and Active Directory Defense. Premier adds complete device trust and VPN-less access to private resources. Self-service licenses are sold in blocks of 10 under 100 users and 25 above, and the pricing page doesn't say whether billing is annual or monthly.<\/p><p>Duo's documentation describes MFA, SSO and inbound directory sync. It doesn't describe provisioning or deprovisioning accounts in other apps, so a team that wants joiner, mover and leaver automation still needs a directory or HR-driven tool next to it. Capterra reviewer summaries praise easy setup and reliable MFA and complain about unreliable push delivery when a phone is lost, though we could not read the live review pages.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>you already have a directory and want strong MFA, SSO and device checks on top of it at a published per-user price<\/li><li>you have 10 or fewer users and want free MFA, or you want phishing-resistant MFA from the $3 Essentials tier<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>you need one product that hosts the directory and automates app provisioning and deprovisioning, because Duo's docs describe MFA, SSO and inbound sync only<\/li><li>you want device trust or VPN-less access on a tight budget, since those start at Advantage ($6) or Premier ($9)<\/li><\/ul><\/div><\/div><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-duo-screenshot.png\" alt=\"Duo Admin Panel Single Sign-On page showing the External Authentication Sources tab with a list of SAML identity providers and Active Directory sources, their status and authentication proxies.\" width=\"1300\" height=\"670\" loading=\"lazy\" decoding=\"async\"><figcaption>Duo Admin Panel: Single Sign-On, External Authentication Sources (Duo documentation)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>For SSO, an admin picks an authentication source: Duo Directory, on-premises Active Directory through the Duo Authentication Proxy (version 6.5.1 or later), or an external SAML identity provider such as Entra ID. Routing rules, up to 30, choose the source per login. When Active Directory or a SAML provider is the source, that system, not Duo, manages passwords and policies.<\/p><p>Trusted Endpoints marks a device as managed by checking it against a management system such as Intune or Jamf, or through Duo Desktop. Enabling a block policy before Duo Desktop is deployed can lock users out, so roll it out in monitor mode first.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Free up to 10 users; Essentials $3, Advantage $6, Premier $9 per user per month<\/dd><\/div><div><dt>Free<\/dt><dd>Up to 10 users, MFA only<\/dd><\/div><div><dt>Essentials ($3)<\/dt><dd>SSO, Duo Directory, Trusted Endpoints, passwordless<\/dd><\/div><div><dt>Advantage ($6)<\/dt><dd>Passport, risk-based authentication, Active Directory Defense<\/dd><\/div><div><dt>Premier ($9)<\/dt><dd>Device trust, VPN-less access<\/dd><\/div><div><dt>SSO and Trusted Endpoints<\/dt><dd>Essentials ($3) and up<\/dd><\/div><div><dt>Licenses<\/dt><dd>Blocks of 10 under 100 users<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"identity-governance-software\">Identity governance software<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Identity governance software adds access requests, approvals and certification campaigns on top of provisioning: managers or app owners confirm, on a schedule, that each person still needs each access, and removals are tracked until they happen. Separation-of-duties checks block conflicting access, such as the same person creating and approving payments, before it is granted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A small team can cover part of this without a dedicated product. Entra ID Governance is a $7 per user per month add-on to the Microsoft stack, and Okta's Essentials plan at $17 includes Access Governance and access requests. SaaS management tools such as Torii and Zluri also run access reviews, which we cover in our <a href=\"\/blog\/saas-management-software\/\">SaaS management software comparison<\/a>. A dedicated governance platform becomes worth the cost when a regulator or auditor requires formal certifications across many systems. In practice the top IGA options for a small company are three: Entra ID Governance at $7 per user per month, Okta Access Governance inside the $17 Essentials plan, and SailPoint by quote.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"sailpoint\">SailPoint<\/h3>\n\n\n\n<section class=\"ok-card ok-wide\" aria-labelledby=\"sailpoint-2\"><header class=\"ok-card__head\"><span class=\"ok-fav ok-fav--md\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/sailpoint.png\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div class=\"ok-card__title\"><h3 class=\"wp-block-heading\" id=\"sailpoint-2\">SailPoint<\/h3><p class=\"ok-card__sub\">The reference identity governance platform: access requests, certification campaigns, joiner-mover-leaver lifecycle and separation-of-duties checks across many systems, sold to enterprises on a services-led implementation.<\/p><\/div><span class=\"ok-job\">Identity governance and administration<\/span><span class=\"ok-rate\"><span class=\"ok-stars\" aria-hidden=\"true\">\u2605\u2605\u2605\u2605\u2606<\/span> 4.6<span class=\"ok-muted\"> \u00b7 258 G2 reviews<\/span><\/span><\/header><div class=\"ok-card__body\"><div class=\"ok-card__main\"><p class=\"ok-lede\">SailPoint is the reference platform for identity governance, built and sold for enterprises, and it is the tool to look at only when certification campaigns are a requirement.<\/p><p>SailPoint publishes no price list. Packaging is three suites, Standard, Business and Business Plus, with newer agentic suites that add non-human identities, and SailPoint added a commitment model called Navigators in December 2025. There is no small-business edition and no stated minimum. A third-party benchmark, Vendr, shows a median of about $109,835 a year across 39 purchases, with the lowest at $21,086, and puts professional services at 30 to 60 percent of first-year cost.<\/p><p>The G2 rating of 4.6 covers all SailPoint products, not only the cloud platform, and reviewers are mostly enterprises.<\/p><div class=\"ok-cs\"><div class=\"ok-cs__yes\"><strong class=\"ok-cs__h\">Choose it when<\/strong><ul><li>compliance requires formal access certifications and separation-of-duties checks across many systems<\/li><li>you have the budget and a partner for a multi-month deployment<\/li><\/ul><\/div><div class=\"ok-cs__no\"><strong class=\"ok-cs__h\">Skip it when<\/strong><ul><li>your identity governance budget is below roughly $20,000 a year or you cannot fund an implementation project<\/li><li>you mainly need SSO, MFA and basic onboarding and offboarding for a few hundred users<\/li><\/ul><\/div><\/div><dl class=\"ok-users\"><dt class=\"ok-k ok-k--p\">Users like<\/dt><dd>centralized governance automation and audit-ready certification campaigns, per G2 reviewers<\/dd><dt class=\"ok-k ok-k--c\">Users dislike<\/dt><dd>a steep learning curve and slow support resolution, per G2 reviewers<\/dd><dd class=\"ok-src\">Source: <a href=\"https:\/\/www.g2.com\/products\/sailpoint\/reviews\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">G2<\/a>, 258 reviews<\/dd><\/dl><figure class=\"ok-shot\"><div class=\"ok-shot__bar\" aria-hidden=\"true\"><i><\/i><i><\/i><i><\/i><\/div><img src=\"https:\/\/theitlead.com\/blog\/wp-content\/uploads\/2026\/10\/iam-sailpoint-screenshot.png\" alt=\"SailPoint Identity Security Cloud Identity Outliers screen listing outlier scores, with an Outlier Score 97 card and contributing factors such as peer access similarity and rare access.\" width=\"1300\" height=\"828\" loading=\"lazy\" decoding=\"async\"><figcaption>SailPoint Identity Security Cloud: Identity Outliers view (SailPoint product page)<\/figcaption><\/figure><details class=\"ok-more\"><summary>How it works in practice<\/summary><p>Per SailPoint's developer documentation, a certification campaign is created from scratch or from a scheduled template, previewed, edited and activated. Campaign types include Manager, Source Owner, Identities, Access Items, Role Composition and Uncorrelated Accounts. Reviewers grant or revoke each access item and can reassign a certification with a required comment. If any reviewer chose revocation, the campaign enters a remediation phase and completes when remediation finishes.<\/p><p>The access request side recommends items based on peer group and role and can approve low-risk requests automatically. SailPoint went public on Nasdaq in February 2025 and, in 2026, announced an agentic identity fabric and the intent to acquire Entro, a non-human identity vendor.<\/p><\/details><\/div><dl class=\"ok-card__side\"><div><dt>Starting price<\/dt><dd>Quote only; no public price list or minimum<\/dd><\/div><div><dt>Pricing<\/dt><dd>Quote only<\/dd><\/div><div><dt>Campaign types<\/dt><dd>Manager, Source Owner, Identities, Access Items, Role Composition<\/dd><\/div><div><dt>Third-party benchmark<\/dt><dd>Vendr median about $109,835 a year<\/dd><\/div><div><dt>G2 scope<\/dt><dd>All SailPoint products<\/dd><\/div><\/dl><\/div><\/section>\n\n\n\n<aside class=\"ok-callout ok-callout--watch\"><p><strong>Budget the project, not only the license<\/strong> Implementation is the larger cost with governance platforms. Vendr reports professional services at 30 to 60 percent of the first-year cost, so a license quote alone understates the budget.<\/p><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-iam-plan-includes-automated-user-provisioning\">Which IAM plan includes automated user provisioning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The cheapest plan with automated user provisioning is Zoho Directory Standard at $2 per user per month, followed by OneLogin Essentials at $6 and Entra ID P1 at $7. Provisioning is the feature most often locked behind a higher plan, so check this table before comparing sign-in prices.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Tool<\/th><th>Lowest plan with automated provisioning<\/th><th>Price per user per month<\/th><th>Limit or catch (USD where priced)<\/th><\/tr><\/thead><tbody><tr><td>Microsoft Entra ID<\/td><td>P1 for group and on-premises app provisioning<\/td><td>$7, paid yearly<\/td><td>Nested groups cannot define scope; lifecycle workflows need the governance add-on<\/td><\/tr><tr><td>Google Cloud Identity<\/td><td>Premium<\/td><td>$8.40, flexible plan<\/td><td>Free covers SSO and 2-Step Verification only<\/td><\/tr><tr><td>Okta Workforce Identity<\/td><td>Essentials for Lifecycle Management<\/td><td>$17, billed annually<\/td><td>$1,500 annual minimum; Starter has SSO, MFA and 5 Workflows<\/td><\/tr><tr><td>JumpCloud<\/td><td>Not broken out by plan on the pricing page<\/td><td>From $9, billed annually<\/td><td>Ask which bundle includes SCIM-based lifecycle rules<\/td><\/tr><tr><td>OneLogin<\/td><td>Essentials for unlimited provisioning rules<\/td><td>$6<\/td><td>Basic is limited to 5 rules<\/td><\/tr><tr><td>Rippling IT<\/td><td>Quote only<\/td><td>Quote only<\/td><td>Provisioning runs from HR data<\/td><\/tr><tr><td>Zoho Directory<\/td><td>Standard for custom provisioning<\/td><td>$2, billed monthly<\/td><td>Free has default provisioning only<\/td><\/tr><tr><td>Cisco Duo<\/td><td>Not offered<\/td><td>Not applicable<\/td><td>Duo syncs users in; it doesn't provision other apps<\/td><\/tr><tr><td>SailPoint<\/td><td>Quote only<\/td><td>Quote only<\/td><td>Governance and lifecycle sold as suites<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-iam-software-costs-for-a-small-team\">What IAM software costs for a small team<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IAM software for a small team costs from $2 per user per month: the cheapest published paid price is Zoho Directory Standard, and the highest published per-user price in this list is Okta Essentials at $17. Two tools are quote only. Four have a free tier, each with a cap: 50 users to start on Google Cloud Identity Free, 10 on Duo Free, 10 on Zoho Directory Free, and Entra ID Free, which comes with a Microsoft 365 or Azure subscription. JumpCloud has no free plan for new customers.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Five things raise the bill beyond the headline price:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Minimums.<\/strong> Okta Workforce Identity has a $1,500 annual contract minimum, so a 10-person team pays more than $6 per user.<\/li><li><strong>Plan gates.<\/strong> Provisioning automation moves you up: OneLogin Essentials at $6, Okta Essentials at $17, Google Premium at $8.40.<\/li><li><strong>Add-ons.<\/strong> OneLogin Workflows is $2 per user per month, JumpCloud LDAP and RADIUS are $3 each, and Entra governance is a separate $7.<\/li><li><strong>Billing term.<\/strong> JumpCloud costs $2 more per user per month on monthly billing, and Zoho takes 15% off for yearly billing.<\/li><li><strong>Layers.<\/strong> Duo, SailPoint or a governance add-on sits on top of the directory, not instead of it.<\/li><\/ul>\n\n\n\n<div class=\"ok-calc\" data-calc=\"{&quot;min&quot;: 5, &quot;max&quot;: 100, &quot;default&quot;: 25, &quot;unit&quot;: &quot;people&quot;, &quot;label&quot;: &quot;Team size&quot;, &quot;items&quot;: [{&quot;label&quot;: &quot;Microsoft Entra ID P1&quot;, &quot;sub&quot;: &quot;$7 per user, paid yearly&quot;, &quot;per&quot;: 7}, {&quot;label&quot;: &quot;Google Cloud Identity Premium&quot;, &quot;sub&quot;: &quot;$8.40 per user, flexible plan&quot;, &quot;per&quot;: 8.4}, {&quot;label&quot;: &quot;Okta Starter&quot;, &quot;sub&quot;: &quot;$6 per user, $1,500 annual minimum&quot;, &quot;per&quot;: 6, &quot;min_units&quot;: 20.84}, {&quot;label&quot;: &quot;Okta Essentials&quot;, &quot;sub&quot;: &quot;$17 per user, lifecycle and governance&quot;, &quot;per&quot;: 17, &quot;min_units&quot;: 7.35}, {&quot;label&quot;: &quot;JumpCloud SSO bundle&quot;, &quot;sub&quot;: &quot;$11 per user, annual&quot;, &quot;per&quot;: 11}, {&quot;label&quot;: &quot;OneLogin Essentials&quot;, &quot;sub&quot;: &quot;$6 per user, provisioning rules&quot;, &quot;per&quot;: 6}, {&quot;label&quot;: &quot;OneLogin Business&quot;, &quot;sub&quot;: &quot;$10 per user, adaptive MFA and RBAC&quot;, &quot;per&quot;: 10}, {&quot;label&quot;: &quot;Zoho Directory Professional&quot;, &quot;sub&quot;: &quot;$7 per user, billed monthly&quot;, &quot;per&quot;: 7}]}\"><div class=\"ok-calc__q\">Team size: <strong data-n>25 people<\/strong><\/div><ol class=\"ok-bars\"><li><span class=\"ok-bars__label\">Okta Starter<small>$6 per user, $1,500 annual minimum<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:35.3%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$150<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">OneLogin Essentials<small>$6 per user, provisioning rules<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:35.3%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$150<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Microsoft Entra ID P1<small>$7 per user, paid yearly<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:41.2%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$175<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Zoho Directory Professional<small>$7 per user, billed monthly<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:41.2%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$175<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Google Cloud Identity Premium<small>$8.40 per user, flexible plan<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:49.4%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$210<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">OneLogin Business<small>$10 per user, adaptive MFA and RBAC<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:58.8%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$250<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">JumpCloud SSO bundle<small>$11 per user, annual<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:64.7%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$275<small> per month<\/small><\/span><\/li><li><span class=\"ok-bars__label\">Okta Essentials<small>$17 per user, lifecycle and governance<\/small><\/span><span class=\"ok-track\"><span class=\"ok-fill\" style=\"width:100.0%\"><\/span><\/span><span class=\"ok-bars__v\" data-cost>$425<small> per month<\/small><\/span><\/li><\/ol><p class=\"ok-note\">Monthly cost at list price. Okta rows apply the $1,500 annual minimum. Duo, Rippling IT and SailPoint are left out: Duo sits on top of a directory, and the other two are quote only. Microsoft 365 Business Premium already includes Entra ID P1.<\/p><\/div>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how-to-roll-out-iam-without-locking-yourself-out\">How to roll out IAM without locking yourself out<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Most identity incidents in a small team come from the rollout, not the tool: an MFA policy that locks out the admin who can fix it, or an offboarding rule nobody tested.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The main risks of rolling out MFA are lockouts and delays. Entra ID's security defaults are all or nothing, so you can't exempt a single account. Duo warns that enabling a block policy before Duo Desktop is deployed can lock users out. Google says changes to a custom SAML app can take up to 24 hours to apply, and Capterra reviewers of Duo mention push notifications that fail when a phone is lost. The steps below are ordered to catch each of these before they reach everyone.<\/p>\n\n\n\n<ol class=\"ok-steps\"><li><h3 class=\"wp-block-heading\" id=\"list-apps-accounts-and-owners\">List apps, accounts and owners<\/h3><p>Export the apps people sign in to and the accounts that exist in each. Mark the ones that are shared logins or service accounts, because SSO won't cover them.<\/p><div class=\"ok-steps__meta\">Owner: IT lead<\/div><\/li><li><h3 class=\"wp-block-heading\" id=\"create-two-break-glass-admin-accounts\">Create two break-glass admin accounts<\/h3><p>Create two or more cloud-only accounts that are not federated or synced, protect each with a hardware security key (passkey) instead of a shared password, keep the keys sealed, exclude the accounts from policies that block or restrict sign-in, and alert on any sign-in. Microsoft's emergency access guidance recommends exactly this setup.<\/p><div class=\"ok-steps__meta\">Owner: IT lead<\/div><\/li><li><h3 class=\"wp-block-heading\" id=\"pilot-with-one-group\">Pilot with one group<\/h3><p>Move IT staff and a few volunteers first. Use report-only or monitor mode where the tool offers it, such as Conditional Access report-only in Entra ID.<\/p><div class=\"ok-steps__meta\">Owner: IT lead<\/div><\/li><li><h3 class=\"wp-block-heading\" id=\"enforce-mfa-admins-first\">Enforce MFA, admins first<\/h3><p>Require MFA for admins, then everyone. Prefer phishing-resistant methods such as security keys or passkeys for admin roles. On Microsoft tenants, MFA is already required for the Azure portal, Entra admin center and Intune admin center, and for the Microsoft 365 admin center since February 2025.<\/p><div class=\"ok-steps__meta\">Owner: IT lead<\/div><\/li><li><h3 class=\"wp-block-heading\" id=\"connect-your-source-of-truth-and-three-apps\">Connect your source of truth and three apps<\/h3><p>Point the tool at HR data or the directory, and set up provisioning for the three apps that cost the most in licenses or hold the most sensitive data.<\/p><div class=\"ok-steps__meta\">Owner: IT lead and HR<\/div><\/li><li><h3 class=\"wp-block-heading\" id=\"test-an-offboarding-end-to-end\">Test an offboarding end to end<\/h3><p>Disable a test user and check that each connected app removes access. Repeat after every provisioning rule change.<\/p><div class=\"ok-steps__meta\">Owner: IT lead<\/div><\/li><\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"what-iam-doesn-t-answer-who-owns-your-service-accounts\">What IAM doesn't answer: who owns your service accounts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">IAM software doesn't answer who owns your service accounts, because every tool above manages people. The logins that aren't people, such as backup jobs, deploy pipelines, API integrations and scheduled scripts, usually sit outside SSO and outside the review cycle, and the person who created them may have left. A directory can list them, but a list doesn't say who is responsible for each one or whether it is still needed.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><span class=\"ok-tchip\"><span class=\"ok-fav ok-fav--xs ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"13\" height=\"13\" loading=\"lazy\" decoding=\"async\"><\/span>The IT Lead<\/span> is built for that single gap: you import service accounts from CSV, nominate an owner, collect an emailed attestation and keep the review trail. It records ownership and decisions and doesn't change anything in your systems. If you want a starting point, our <a href=\"\/blog\/service-account-inventory-template\/\">service account inventory template<\/a> has the columns, and the <a href=\"\/blog\/privileged-access-management-software\/\">privileged access management comparison<\/a> covers vaulting and rotation for the accounts that carry admin rights.<\/p>\n\n\n\n<aside class=\"ok-product ok-wide\" id=\"the-it-lead\"><span class=\"ok-fav ok-fav--md ok-fav--ours\"><img src=\"\/blog\/wp-content\/uploads\/opskit\/fav\/itl.svg\" alt=\"\" width=\"24\" height=\"24\" loading=\"lazy\" decoding=\"async\"><\/span><div><p class=\"ok-product__eyebrow\">What these tools don&#x27;t answer<\/p><p class=\"ok-product__head\">Know who owns every service account, and when it was last reviewed.<\/p><p>The IT Lead imports service accounts from CSV, nominates owners, collects their attestations and keeps a review trail an auditor can follow. Built for small IT teams and MSPs.<\/p><\/div><a class=\"ok-product__cta\" href=\"https:\/\/theitlead.com\/\">See how it works<\/a><\/aside>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"which-tool-to-pick\">Which tool to pick<\/h2>\n\n\n\n<ul class=\"ok-rows\"><li><span>You have Microsoft 365 Business Premium or E3<\/span><strong class=\"ok-go\">Microsoft Entra ID P1, already included<\/strong><\/li><li><span>You run Google Workspace and want SAML SSO for free<\/span><strong class=\"ok-go\">Google Cloud Identity Free, up to 50 users<\/strong><\/li><li><span>You manage Mac, Windows and Linux devices and want one console<\/span><strong class=\"ok-go\">JumpCloud, from $9 to $13 per user per month<\/strong><\/li><li><span>You use many SaaS apps and want lifecycle automation<\/span><strong class=\"ok-go\">Okta Essentials at $17, or OneLogin Essentials at $6<\/strong><\/li><li><span>HR data should drive access and devices<\/span><strong class=\"ok-go\">Rippling IT, by quote<\/strong><\/li><li><span>You only need to add MFA to an existing directory<\/span><strong class=\"ok-go\">Duo Free or Essentials at $3<\/strong><\/li><li><span>An auditor requires certification campaigns<\/span><strong class=\"ok-go\">SailPoint, or Entra ID Governance for a lighter start<\/strong><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"frequently-asked-questions\">Frequently asked questions<\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What does an identity and access management system do?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>An identity and access management system controls who can sign in to which systems and what they can do there. It authenticates people with single sign-on and MFA, decides what they may reach, creates and removes their accounts in connected apps, and records the access they hold so it can be reviewed.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the best software for managing users and access?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The best software for managing users and access depends on the stack. Microsoft Entra ID P1 is the default for Microsoft 365 teams because it is included in Business Premium, Google Cloud Identity suits Google Workspace, JumpCloud suits mixed device fleets, and Okta or OneLogin suit teams with many third-party SaaS apps.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What are the top IGA tools?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The top identity governance (IGA) tools start with SailPoint, the reference platform. Smaller teams often start with the governance features inside their identity provider, such as Entra ID Governance at $7 per user per month or Okta Access Governance in the $17 Essentials plan.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Is there free identity and access management software?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Free identity and access management software exists, but every free tier has a cap. Google Cloud Identity Free starts at 50 users, Duo Free and Zoho Directory Free cover 10 users, and Entra ID Free is included with a Microsoft 365 or Azure subscription. JumpCloud has no free plan for new customers.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need IAM software if I only use Microsoft 365?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>If you only use Microsoft 365, you already have Entra ID. The question is the plan: Business Premium includes P1 with Conditional Access, while risk-based policies and Privileged Identity Management need P2 and lifecycle workflows need the governance add-on.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the difference between IAM and PAM?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>The difference between IAM and PAM is scope: IAM manages everyday sign-in and access for all users. Privileged access management controls and records the use of admin and break-glass accounts, usually with approvals, session limits and password rotation.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n<ul class=\"ok-related ok-wide\"><li><a href=\"\/blog\/okta-pricing\/\"><span>Pricing<\/span>Okta pricing: plans, costs and annual minimums<\/a><\/li><li><a href=\"\/blog\/jumpcloud-pricing\/\"><span>Pricing<\/span>JumpCloud pricing: plans, modules and real costs<\/a><\/li><li><a href=\"\/blog\/okta-vs-microsoft-entra-id\/\"><span>Comparison<\/span>Okta vs Microsoft Entra ID<\/a><\/li><li><a href=\"\/blog\/privileged-access-management-software\/\"><span>Software<\/span>Best privileged access management software<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Identity and access management software compared for small IT teams: nine tools, published prices, plan gates, free tier caps and who should skip each.<\/p>\n","protected":false},"author":1,"featured_media":91,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-90","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-software"],"_links":{"self":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/90","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/comments?post=90"}],"version-history":[{"count":1,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/90\/revisions"}],"predecessor-version":[{"id":104,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/posts\/90\/revisions\/104"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media\/91"}],"wp:attachment":[{"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/media?parent=90"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/categories?post=90"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/theitlead.com\/blog\/wp-json\/wp\/v2\/tags?post=90"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}