Buyer's Guide: Customer Identity & Access Management (CIAM) Platforms

Executive Summary

A customer identity and access management (CIAM) platform runs sign-up, sign-in, account recovery and consent for the people who use your apps and websites. Choose one on three things: how far you can customize the pages customers see, which sign-in methods it offers, including passkeys, and how it counts and prices active users. Sign-in for your own employees is a separate purchase, covered in the workforce identity and access management guide.

Login-page customization separates these platforms more than a feature list does. Some offer a theme editor for colors, fonts and logos. Some accept your own CSS, or page templates around a hosted login form. Some let your developers build the screens in their own framework while the platform runs authentication behind them. Section 3 sets out what each vendor’s own documentation says about it.

The eight vendors here fall into seven approaches: a developer identity platform from a workforce identity company, customer identity inside a cloud provider, an enterprise identity suite with a single-tenant cloud, identity with fraud prevention and identity verification, identity and consent inside a customer-data suite, multi-tenant identity for B2B software, and a no-code journey builder. Start from the approach that matches your product and team, then test the shortlist on your own sign-up flow.

Why Passkeys, Account Takeover and Consent Shape the Choice

Customer sign-in is attacked in bulk, with passwords stolen elsewhere. OWASP describes credential stuffing as the automated injection of stolen username and password pairs into website login forms to fraudulently gain access to user accounts. Every customer who reuses a password exposes your service to a breach at someone else’s.

Passkeys take the reusable password out of sign-in. The FIDO Alliance describes a passkey as an authentication credential based on FIDO standards that can be stored on a phone or computer, or in a hardware security key. The FIDO Alliance states that passkeys are built on FIDO2 specifications. A customer signs in with the same face, fingerprint or PIN that unlocks the device, and there is no shared secret for an attacker to replay.

NIST sets the assurance levels. NIST states that syncable authenticators may be offered as a new option for applications that seek to implement up to AAL2. NIST states that because syncable authenticators require the private key to be exportable, syncable authenticators shall not be used at AAL3. For most consumer apps, synced passkeys are the practical choice, because customers keep them when they replace a phone. Higher-risk actions, such as changing a payout account or a delivery address, can still require a step-up check.

Consent is usually captured at sign-up, so the identity platform is often where it is first recorded. The European Commission states that, where consent is required to process personal data, valid consent must be freely given, informed and given for a specific purpose. The European Commission lists, among the conditions for valid consent, that the request for consent states clearly that it is possible to withdraw consent, for example through a visible unsubscribe link or another way that must be as easy to use as giving consent.

U.S. state law adds other duties. The California Attorney General states that the California Consumer Privacy Act of 2018 (CCPA) gives consumers more control over the personal information that businesses collect about them, including the right to know how it is used and shared, the right to delete personal information collected from them with some exceptions, and the right to opt out of its sale or sharing. Ask each vendor where it stores each consent and preference, how a withdrawal reaches the systems that use the data, and how a deletion request reaches every copy of the profile.

Open standards keep the choice reversible. The OpenID Foundation describes OpenID Connect as an interoperable authentication protocol based on the OAuth 2.0 framework of specifications. Apps that sign in through standard OpenID Connect move to a new provider with less rework than apps built on a vendor’s own SDK. Ask each vendor which OpenID Connect and OAuth flows it supports, and how existing password hashes can be imported so customers do not have to reset their passwords when you migrate.

Customer Identity or Workforce Identity: Where This Guide Ends

Workforce identity signs in employees, who are known in advance and arrive from an HR system. Customer identity signs in people who register themselves, in numbers you do not control, on pages that are part of your product. That changes what you buy: self-service registration, social and passwordless sign-in, progressive profiling, consent, bot defense and pricing by monthly active user. Phishing-resistant MFA policy for staff, application single sign-on and HR-driven provisioning are covered in the workforce identity guide and are not repeated here.

Several vendors sell workforce and customer identity as separate products, sometimes on separate platforms with separate prices. Check which product each document, quote and price applies to before you compare them.

Building sign-up and sign-in yourself is possible with open-source libraries, but the work continues after launch. Password storage, account recovery, bot defense, passkeys, audit logs and protocol updates all need maintenance. The usual decision is narrower: how much of the user interface your team builds, and how much the platform hosts. That is the subject of the next section.

Which CIAM Platforms Let You Customize the Login Page Most?

Login-page customization comes in three levels. A theme changes colors, fonts, logos and layout. Templates and CSS change the page around the login form, or restyle the form itself. Your own code replaces the hosted screens with screens your developers build, while the platform keeps running authentication. Each level brings the pages closer to your product, and leaves your team more to maintain.

The Okta and ForgeRock customer identity platforms have both been renamed, and Auth0 states that Customer Identity Cloud and Auth0 by Okta are the same technology, and that readers will likely encounter both names. Ping Identity describes PingOne Advanced Identity Cloud, formerly ForgeRock Identity Cloud, as a SaaS identity and access management solution for workforce, consumer and B2B identities.

Ping Identity states that the hosted pages can be customized in each realm with an editor in the Advanced Identity Cloud admin console, using themes for colors, fonts, layout and logos. Ping Identity states that the Ping Orchestration SDKs or APIs can be used to create and host your own custom journeys, and recommends deactivating the hosted journey pages if you do.

Auth0 states that with Advanced Customizations for Universal Login (ACUL) you can write the login experience in your preferred framework and use any third-party CSS, JavaScript or component library, while Auth0 features such as passkeys, bot detection and MFA keep working. For apps on the Okta platform rather than Auth0, Okta states that it hosts the sign-in page that appears when apps redirect to Okta to sign users in, and that you can customize the page using easy controls or a code editor that is provided.

Both reach fully custom screens built by your own developers. The difference is the level between a theme and your own code. On Auth0, Universal Login pages can be customized with a page template written in the Liquid template language, which defines the content around login prompts, and page templates require a custom domain for the tenant. Short of building your own screens, a template gives more control than a theme editor. At the custom-code level the two are comparable, because your developers own the screens on either platform.

The other platforms sit at different points on the same scale. Microsoft states that you can upload your own CSS file to replace default Microsoft styling for color, font, text size, position of elements, and displays for different devices and screen sizes. AWS describes the Amazon Cognito branding editor as a visual design and editing tool for managed login pages, built into the Amazon Cognito console. AWS states that passkey sign-in isn't available in the classic hosted UI, and that in the Lite feature plan the classic hosted UI is your only option for user pool domain services.

SAP describes Screen-Sets as registration and consent forms built in a drag-and-drop UI Builder and pre-integrated with its CIAM platform. SAP states that flows can be changed and screens added by editing the HTML and CSS code of the default screen-sets. Descope describes Descope Flows as visual, drag-and-drop workflows for building user authentication journeys in the Descope Console. Descope states that a style can be customized in a GUI or in Code Mode, adjusting any UI component's appearance.

Transmit Security describes Mosaic as built for orchestration and AI, and states that drag-and-drop tools and natural language prompts can be used to design customer journeys such as registration, login or payments. Frontegg states that it was built with multi-tenancy by design, and that it lets you manage single or multi-tenant organizational structures, configurations, policies and branding for each account. Ask each vendor to rebuild your current sign-up page on its platform during the evaluation, and count the hours it took.

Customization is one of several capabilities to test. Sign-in methods, bot and fraud defense, B2B organization support and consent capture matter as much, and each is easier to compare in a demo of your own flow than on a feature list.

Vendors in Customer Identity & Access Management (CIAM) Platforms

Representative vendors include Amazon Cognito, Descope, Frontegg, Microsoft Entra External ID, Okta Customer Identity Cloud / Auth0, Ping Identity, incl. ForgeRock, SAP Customer Data Cloud / Gigya and Transmit Security. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors

The approaches below follow what each platform was built around before it sold customer identity. That origin still shapes what comes without extra products.

Ownership has changed at several of these vendors. Okta announced the completion of its acquisition of Auth0 on May 3, 2021. Ping Identity announced the completion of its acquisition by Thoma Bravo on Oct. 18, 2022. Ping Identity lists a press release titled "Thoma Bravo Completes Acquisition of ForgeRock; Combines ForgeRock into Ping Identity". SAP states that Gigya provided customer identity and access management (CIAM) and consent data management, that SAP announced its acquisition of Gigya in 2017, and that Gigya’s capabilities are now integrated into SAP’s customer data solutions. SAP states that SAP Customer Data Cloud consists of Customer Identity, Customer Consent and CIAM for B2B.

Two vendors sell customer identity as part of a cloud platform. Microsoft states that Microsoft Entra External ID includes Microsoft's customer identity and access management (CIAM) solution. Microsoft states that, for apps offered to consumers and business customers, External ID makes it easy to add CIAM features like self-service registration, personalized sign-in experiences and customer account management. Microsoft states that, effective May 1, 2025, Azure AD B2C is no longer available to purchase for new customers. AWS states that Amazon Cognito helps you implement secure sign-in and access control for users, AI agents and microservices.

One approach starts from fraud. Transmit Security describes Mosaic as a microservices-based CIAM platform for B2C and B2B use cases, covering onboarding, lifecycle journeys, progressive profiling, consent and self-service. Transmit Security states that Mosaic supports MFA options including OTP, passkeys, mobile biometrics, magic links and social login. Transmit Security states that Mosaic's identity verification scans and validates government-issued IDs and confirms document ownership.

Two vendors sell low-code and no-code customer identity to software teams. Frontegg describes its product as a low-code CIAM platform for managing customer identity. Frontegg states that it lets you define access controls based on subscription, feature flag or object level (ABAC) roles and permissions. Frontegg states that Agen.co lets organizations expose enterprise context to internal agents, copilots and AI workflows through an identity-aware control layer. Descope states that its no-code CIAM platform offers drag-and-drop user journeys, and that signup, login, MFA, SSO and step-up can be added with its workflow interface.

Eight vendors are named, across seven approaches; the field also includes developer authentication services, open-source identity servers and regional providers. The approaches were written before any vendor was selected, and a row here is not for sale. Customer identity vendors, whether named here or not, can describe their own products in the Spotlight below.

How much should you budget for Customer Identity & Access Management (CIAM) Platforms?

Customer identity is priced mainly by monthly active users (MAU): the people who sign in at least once in a month. Several vendors publish a free tier with a stated MAU allowance. Auth0 lists a Free plan at $0 per month for up to 25,000 monthly active users. AWS states that, for users who sign in directly or through a social identity provider, Amazon Cognito user pools have a free tier of 10,000 monthly active users per account or per AWS organization on the Lite or Essentials tier. Frontegg lists a Pay as you go plan at $0 per month that includes a fully customized hosted login and 7,500 monthly active users. Descope lists a Free Forever plan at $0 with 7,500 monthly active users. Microsoft states that External ID uses a monthly active users (MAU) billing model with optional premium add-ons for advanced scenarios. Microsoft states that MAU billing for External ID includes a free tier.

Above the free tier, the tier you need sets the price as much as the user count. AWS states that Amazon Cognito offers three pricing tiers for user pools, Lite, Essentials and Plus, and that Plus offers threat protection capabilities against suspicious log-ins and additionally supports risk-based adaptive authentication and compromised credentials detection. Descope lists its Pro plan as starting at $249 per month, billed annually. Security features such as risk-based authentication, bot detection and breached-password checks often sit in higher tiers or add-ons, so price the tier that has them.

Some vendors count something other than active users. Ping Identity states that its pricing tiers are structured by identity count and type: customers, business-to-business, workforce, or agentic and AI identity. Transmit Security states that its pricing is based on monthly active users (MAUs) or event volume. Ask each vendor how it counts a customer who signs in on two apps, a business customer’s users, a machine-to-machine token and an anonymous visitor, and how it treats a month with a sales peak.

Enterprise contracts are quoted. Ask for the uplift at renewal in writing, the price per MAU above the committed volume, and the cost of each add-on you expect to need within the contract term.

How long does implementation take for Customer Identity & Access Management (CIAM) Platforms?

A customer identity rollout changes the first screen many customers see, so move one app or one market at a time and measure sign-up completion before and after each step.

What should you ask vendors about Customer Identity & Access Management (CIAM) Platforms?

Ask each vendor to answer in writing and to demonstrate on your own sign-up flow.

Related Resources