Executive Summary
Two tests come before any feature list: can every employee sign in with a method a phishing site cannot capture, and does access end on the day a person leaves.
Workforce identity and access management (IAM) software signs employees, contractors and partners in to the applications they use, decides what each person may reach, and creates and removes their accounts as they join, change roles and leave. Choose it on three things: how strongly it authenticates people, how many of your applications it connects to, and how closely it follows your HR records. CISA describes MFA as a security control that requires a user to present a combination of two or more different authenticators (something you know, something you have, or something you are) to verify their identity for login. CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.
Workforce identity management is the part of the category this guide covers. Customer login, identity governance and privileged access each have their own guide, linked below, because each is bought by a different team against different requirements. The platforms in this guide overlap with all three, so the first job is to decide which of those needs the workforce platform must meet and which another product already meets.
The vendors divide by what their platform was built around: an independent identity cloud, a productivity suite, a choice of cloud and self-managed deployment, privileged access, governance, sovereign hosting, an enterprise software stack, or device management. Start from the approach that matches your estate, then test the shortlist on your own applications and your own sign-in methods.
Why Phishing-Resistant Sign-In Comes First
A workforce identity platform is the front door to every application behind it, so the sign-in methods it allows set the bar for all of them. CISA states that not all forms of MFA are equally secure, and that some are vulnerable to phishing, push bombing, exploitation of Signaling System 7 (SS7) protocol vulnerabilities, and/or SIM swap attacks. CISA strongly urges all organizations to implement phishing-resistant MFA as part of applying Zero Trust principles, and notes that the Office of Management and Budget requires agencies to adopt phishing-resistant MFA methods.
NIST sets out the levels. NIST states that SP 800-63B provides requirements to credential service providers for remote user authentication at each of three authentication assurance levels. NIST lists its publication date as July 2025. NIST states that applications assessed at AAL2 must offer a phishing-resistant authentication option. NIST states that AAL3 authentication requires a phishing-resistant authenticator with a non-exportable authentication key. NIST states that because syncable authenticators require the private key to be exportable, syncable authenticators shall not be used at AAL3.
That last rule matters when you choose passkeys. A passkey that syncs between a user’s devices is easier to roll out, and only a passkey bound to one device or security key can be used at the higher level. Most workforces need both: synced passkeys for the general population, and device-bound keys for administrators and anyone who can approve payments or change security settings.
Passkeys are the practical route to phishing resistance for most users. The FIDO Alliance describes a passkey as an authentication credential based on FIDO standards that can be stored on a phone or computer, or in a hardware security key. The FIDO Alliance states that passkeys are built on FIDO2 specifications.
Smart cards are the older route. CISA describes PKI-based MFA, such as the smart cards government agencies use, as a less widely available form of phishing-resistant MFA whose successful deployment requires highly mature identity management practices. Organizations that already issue smart cards can keep them for the users who have them, and add passkeys for everyone else.
Some users and applications will not move at once. CISA states that app- or token-based OTP or mobile push with number matching are the best options for small- and medium-size businesses that cannot immediately implement phishing-resistant MFA. Treat these as a stage on the way, with a date for each group to move, and record which applications cannot yet accept the stronger methods.
The same platform also feeds zero trust decisions elsewhere. NIST describes zero trust as an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. Each access decision then depends on the identity platform knowing who the user is and what state their device is in.
Where Workforce Identity Ends: Customer Login, Governance and Privileged Access
Workforce identity management covers the people who work for you. It signs them in, enforces when stronger proof is needed, keeps one directory of users and groups, and provisions their accounts in the applications they use. Customer identity serves the people who buy from you, at a scale and with a sign-up flow that a workforce product is not built for. Identity governance runs access requests, reviews and certifications. Privileged access management vaults and brokers administrator credentials. Several vendors in this guide sell all four, and that is a reason to check each module on its own merits rather than to assume the suite covers them equally.
Two open standards hold the category together. The OpenID Foundation describes OpenID Connect as an interoperable authentication protocol based on the OAuth 2.0 framework of specifications. The IETF describes the System for Cross-domain Identity Management (SCIM) as an HTTP-based protocol that makes managing identities in multi-domain scenarios easier to support via a standardized service. Single sign-on to a modern application uses OpenID Connect or SAML. Provisioning accounts into it uses SCIM or a vendor connector. An application that supports neither needs a gateway, a custom connector or a manual process, and that list sets much of the project effort.
Building your own workforce identity provider is rarely sensible. The protocols are public, but running a highly available sign-in service, keeping hundreds of application integrations current and answering for every authentication failure is a product in itself. The real decision is which of the adjacent needs the workforce platform will meet, and which a specialist product will meet alongside it.
| Need | What it answers | Where it is bought |
|---|---|---|
| Workforce access | Who can sign in to which application, and how strongly they must prove it | This guide |
| Customer identity | Sign-up, sign-in and consent for customers and partners at scale | Customer Identity & Access Management guide |
| Identity governance | Who should have which access, with requests, reviews and audit evidence | Identity Governance & Administration guide |
| Privileged access | How administrator and service credentials are vaulted, brokered and recorded | Privileged Access Management guide |
| Device management | Which devices are enrolled, patched and compliant before they reach data | Endpoint Management guide |
How do you evaluate Workforce Identity & Access Management (IAM)?
Authentication is the first thing to test. Ask which methods each product supports, which of them it treats as phishing-resistant, and whether a policy can require those methods for a given application or user group. Okta describes Okta FastPass as its proprietary, device-bound authentication method, and states that it also supports third-party FIDO2 authenticators. Microsoft states that passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Microsoft Entra ID Free, with no extra licenses required. Microsoft states that an authentication strength can require users to use only phishing-resistant authentication methods to access a sensitive resource. Microsoft states that Conditional Access requires a Microsoft Entra ID P1 license. Check the license tier behind each policy feature, since the method may be free while the rule that enforces it is not.
Application coverage decides how much of your estate the platform reaches. Okta advertises access to 8,000 pre-built integrations. Microsoft states that the Microsoft Entra application gallery contains thousands of SaaS applications preintegrated with Microsoft Entra ID for single sign-on and automated user provisioning. Catalog size matters less than whether your own applications are in it with both sign-on and provisioning. Send each vendor your application list and ask which entries support single sign-on only, which also support provisioning, and which need a gateway or a custom connector.
Most enterprises still run a directory on their own servers, and the platform has to work with it. Microsoft describes Microsoft Entra Cloud Sync as a hybrid identity synchronization service for users, groups and contacts between Active Directory and Microsoft Entra ID. Ask each vendor what software it installs on your network, how it fails over, and what users can still do if the connection to the cloud service is lost.
Lifecycle automation is where workforce identity saves the most effort. The HR system should create the account, a role change should change access, and a departure should end access the same day. Ping Identity describes PingIDM as an identity management and synchronization platform that handles the joiner, mover and leaver lifecycle and workflow-driven provisioning across systems. SailPoint states that point-in-time reviews leave multi-month gaps where unauthorized, stale and excessive access accumulates unseen. Test the leaver case first: terminate a test user in the HR system and time how long each downstream account stays active.
Standards support keeps you from being locked in. IBM lists support for FIDO2, OAuth 2.0, OpenID Connect, SCIM, Shared Signals Framework, OpenID for Verifiable Credentials and FAPI 2.0. Ask every vendor for the same list, and ask which standards it can both consume and emit, since a platform that only consumes them cannot pass risk signals on to other tools.
| Capability | What it does | Buyer translation |
|---|---|---|
| Phishing-resistant authentication | Passkeys, security keys or smart cards bound to the real site | Which groups can use it on day one, and which applications cannot accept it |
| Adaptive access policy | Requires stronger proof based on user, device, location and risk | Which license tier includes the policy engine, and can it require specific methods per application |
| Single sign-on | One sign-in to many applications over OpenID Connect or SAML | Coverage of your own application list, including older and on-premises applications |
| Provisioning | Creates, updates and removes accounts in applications | Which of your applications support SCIM or a vendor connector |
| HR-driven lifecycle | Joiner, mover and leaver changes driven from the HR system | Time from termination in HR to access removed everywhere |
| Directory and hybrid sync | One store of users and groups, connected to on-premises directories | What runs on your network, and what still works if the cloud link fails |
| Device assurance | Checks device state before granting access | Which device signals it reads, and from which management tools |
Vendors in Workforce Identity & Access Management (IAM)
Representative vendors include CyberArk / Palo Alto Networks (Idira), IBM Verify, JumpCloud, Microsoft Entra ID, Okta Workforce Identity Cloud, Oracle Access Management, Ping Identity and SailPoint. The list is alphabetical, is not a ranking, and is not for sale. How we choose vendors
The approaches below follow one question: what was the platform built around before it became a workforce identity product? That origin still shapes which needs each one meets without extra modules.
Ownership has changed at several of these vendors, so check the company behind each product. Palo Alto Networks announced the completion of its acquisition of CyberArk on February 11, 2026. Palo Alto Networks states that the acquisition of CyberArk extends privilege security controls beyond a narrow set of administrators to every identity across the enterprise. Palo Alto Networks describes Idira as built on CyberArk’s legacy, and states that existing CyberArk customers can continue to use the platform as they always have. A request for cyberark.com is answered by paloaltonetworks.com. Ping Identity announced the completion of its acquisition by Thoma Bravo in 2022.
Neutrality and suite gravity pull in opposite directions. Okta states that it offers independent and neutral cloud-based identity solutions that allow customers to integrate with nearly any application, service or cloud that they choose. Okta states that its principal competitor is Microsoft, and that it can and often does co-exist alongside competitors' products within its customer base.
Deployment model separates the rest. Ping Identity offers PingOne, a multi-tenant cloud platform; PingOne Advanced Identity Cloud, a single-tenant cloud platform managed by Ping; and Ping Advanced Identity Software for private, public, hybrid and on-premises environments. IBM states that IBM Verify Identity Access delivers identity and access management for workforce and customer identities. IBM states that IBM Verify Identity Access can be deployed on premises, in sovereign cloud, private cloud or hybrid environments. IBM describes IBM Verify as a unified platform that secures both human and non-human identities across web, mobile and hybrid enterprise environments. Oracle states that Oracle Access Management delivers risk-aware multifactor authentication and single sign-on across cloud and on-premises, and can be deployed as an image in Oracle Cloud Infrastructure or in on-premises data centers. Oracle states that Oracle Identity and Access Management Suite 12c can be deployed as software on-premises or as an Oracle Cloud Infrastructure (OCI) instance. Oracle describes a cloud native identity as a service (IDaaS) platform that manages user access and entitlements for Oracle Cloud Infrastructure (OCI) and across a wide range of cloud and on-premises applications.
Two approaches start outside sign-in. SailPoint describes IdentityIQ as an identity governance and administration platform custom-built for complex enterprise and hybrid environments. SailPoint states that it offers quick compliance connectivity for hundreds of popular SaaS and cloud applications. CyberArk lists Identity Administration among its SaaS services, to authenticate user identities and authorize access to features and platform services. CyberArk lists Workforce Password Management, to securely store, manage and share business application credentials. At the smaller end, device management comes first. JumpCloud states that its unified endpoint management and multi-platform device management capabilities let IT teams securely and centrally manage any machine in their fleet, from any location.
| Vendor | Approach | Where it fits |
|---|---|---|
| Ping Identity | Cloud or self-managed by choice | Multi-tenant, single-tenant or self-managed deployment from one vendor |
| JumpCloud | Directory and device management together | Users, single sign-on and devices managed from one console |
| SailPoint | Governance-led identity | Governance and lifecycle for complex and hybrid estates |
| Oracle Access Management | Identity in an enterprise software stack | MFA and single sign-on deployed on-premises or in Oracle Cloud Infrastructure |
| Microsoft Entra ID | Identity in the productivity suite | Identity for Microsoft cloud estates, with access policy in paid tiers |
| Okta Workforce Identity Cloud | Independent identity clouds | Sign-in, MFA and lifecycle across applications from many vendors |
| CyberArk / Palo Alto Networks (Idira) | Privilege-led identity security | Workforce access within a privileged access platform |
| IBM Verify | Self-managed identity for sovereign sites | Workforce and customer access on premises or in sovereign cloud |
Eight vendors are named here, one for each approach; the field runs to about two dozen, including MFA specialists, governance vendors and directory tools. The approaches were written before any vendor was chosen, and a row in this table is not for sale. Identity vendors, named here or not, can describe their own products in the Spotlight below.
How much should you budget for Workforce Identity & Access Management (IAM)?
Workforce identity is priced per user, usually per month and billed annually, in suites that bundle more features at each tier. Okta states that its Workforce Identity suites are sold per user per month and billed annually, with the Starter Suite beginning at $6 per user/month and the Essentials Suite beginning at $17 per user/month. Okta states that its suites follow a unified model where all products share the same number of subscriptions, with exceptions for Workflows, Okta Privileged Access and Machine-to-Machine tokens. Microsoft lists Microsoft Entra ID P1 at $7.00 per user per month, paid yearly. JumpCloud describes Platform Essentials as identity and device management features plus SSO and passwordless authentication, with 300 users maximum.
The unit being counted varies, and it changes the bill more than the list price does. Ping Identity states that its pricing tiers are structured by identity count and type: customers, business-to-business, workforce, or agentic and AI identity. Ping Identity states that PingOne products including PingOne DaVinci, PingOne MFA and PingID, and PingOne SSO use an Annual Active User or Monthly Active User unit of measure. Ping Identity states that its software products, which customers install and operate, use a managed (stored) identity unit of measure, counted regardless of activity. Under a stored-identity count, every dormant account still costs money, so clean the directory before you count.
Account status affects the count as well. JumpCloud states that suspended users are retained in the system and billed as normal users. Ask every vendor how it counts suspended, disabled and never-used accounts, and how often it measures.
Non-human identities are starting to appear in workforce licenses. SailPoint states that its Agentic Standard package includes an initial allotment of two non-human identities for each licensed human identity, and its Agentic Business and Agentic Business Plus packages five. Service accounts, API clients and AI agents can outnumber people, so ask how each vendor counts them now and how it will count them at renewal. Channel terms differ too. JumpCloud states that it offers exclusive pricing to MSPs and channel partners that join its partner program.
| Meter | You are charged for | Grows with | Where it goes wrong |
|---|---|---|---|
| Per user, per suite | Every licensed user at the suite’s price | Headcount, contractors and partners | Paying the top tier for every user when only some need its features |
| Monthly or annual active users | Users who sign in during the period | Activity | Seasonal staff and partners raising the peak |
| Stored identities | Every account held, active or not | Directory size | Dormant and duplicate accounts counted |
| Add-on modules | Governance, privileged access, workflows or threat detection | Modules adopted | Modules licensed for all users but deployed to a few |
| Non-human identities | Service accounts, API clients and agents | Automation and AI adoption | Allotments exceeded at renewal |
How long does implementation take for Workforce Identity & Access Management (IAM)?
A workforce identity rollout is an application migration and a change in how people sign in. Move applications in waves, and move sign-in methods group by group, so a problem affects one wave at a time.
List every application, how it authenticates today, and whether it supports OpenID Connect, SAML and SCIM. List user populations, including contractors and partners, and the system of record for each.
Connect the HR system and any on-premises directory. Clean up duplicate and dormant accounts. Test joiner, mover and leaver events end to end before any application moves.
Start with modern SaaS applications that support single sign-on and provisioning. Move older and on-premises applications last, with a gateway or connector where needed.
Enroll administrators in device-bound keys first, then move each user group to passkeys. Remove weaker methods for each group once it has moved, and keep a dated list of exceptions.
What should you ask vendors about Workforce Identity & Access Management (IAM)?
Ask each vendor to answer in writing and to demonstrate on your own applications and users.
-
Do most of your users and applications already run on one productivity suite?Yes Price that suite’s identity service at the tier with the policy features you need, and compare an independent identity cloud on integration coverage.No Start with independent identity clouds and vendors that offer a choice of hosting.
-
Must identity data stay on premises or in a sovereign cloud?Yes Shortlist vendors that sell self-managed software or single-tenant hosting, and ask who operates it.No Compare multi-tenant services on availability commitments and data location options.
-
Is audit evidence for access reviews the main driver?Yes Evaluate a governance product alongside the sign-in platform, and test the connectors to your key systems.No Check that the sign-in platform’s own lifecycle features cover joiners, movers and leavers.
RFP packages are a separate paid product. Vendors do not pay to appear in buyer guides.