Published November 6, 2026
Identity and access management (IAM) software decides who can sign in to an organization's applications, how they prove who they are, and what they can reach once signed in. It holds the directory of users, runs single sign-on and multifactor authentication, and creates and removes accounts as people join, change roles and leave. This edition covers workforce IAM: employees, contractors and the service accounts and AI agents that act for them.
Where the market stands
On January 26, 2022, OMB memorandum M-22-09 required phishing-resistant MFA for federal agency staff, contractors and partners. For their routine self-service access, it told agencies to drop methods that fail to resist phishing, including SMS or voice calls, one-time codes and push notifications.
CISA's October 2022 fact sheet names two forms of phishing-resistant MFA: FIDO/WebAuthn and PKI-based authentication. It strongly urges system administrators and other high-value targets to implement it or plan their migration to it.
NIST published SP 800-63-4, its Digital Identity Guidelines, in July 2025, replacing Revision 3. At AAL2, the verifier must offer at least one phishing-resistant option. At AAL3, the authenticator must be phishing-resistant and hold a non-exportable private key. Syncable authenticators, such as synced passkeys, may be used up to AAL2 and not at AAL3.
In October 2024, Microsoft began rolling out required MFA for sign-in to the Azure portal, the Microsoft Entra admin center and the Intune admin center. Starting October 1, 2025, enforcement began to extend to Azure CLI, Azure PowerShell, infrastructure-as-code tools and the REST API for create, update and delete operations. Microsoft allowed tenants with complex environments to postpone this second phase until July 1, 2026.
Ownership and product changes
- Thoma Bravo completed its acquisition of ForgeRock on August 23, 2023 and combined it into Ping Identity.
- Okta said that from September 28 to October 17, 2023, an attacker reached files in its customer support system tied to 134 customers. Some files held session tokens, which the attacker used to hijack the Okta sessions of 5 customers. Okta completed its acquisition of Spera Security, an identity security platform, in February 2024.
- Microsoft made the Microsoft Entra Suite generally available on July 11, 2024.
- IBM renamed IBM Security Verify Access to IBM Verify Identity Access with version 11.0, released in December 2024.
- SailPoint priced its initial public offering on February 12, 2025, at $23.00 per share. Its shares were set to begin trading on the Nasdaq Global Select Market on February 13, 2025, under the ticker SAIL. On August 4, 2026, it launched Human Fabric, which it calls the evolution of its Identity Security Cloud, and made Agentic Fabric generally available.
- Palo Alto Networks completed its acquisition of CyberArk on February 11, 2026. On May 12, 2026, it made Idira generally available. Idira is an identity security platform for human, machine and AI agent identities. Existing CyberArk SaaS customers can move to Idira capabilities on upgrade paths set by product.
The main product types
- Identity in the productivity suite. Microsoft includes Entra ID P1 in Microsoft 365 E3 and P2 in E5. Conditional Access requires P1 or P2.
- Standalone identity providers. Okta Workforce Identity and PingOne for Workforce sell single sign-on, MFA and a directory apart from any productivity suite. Okta adds lifecycle management, governance and threat protection in higher tiers. Ping includes a no-code orchestration engine.
- Directory plus device management. JumpCloud sells a cloud directory with single sign-on, MFA and management of Windows, Mac and Linux devices.
- Governance on top of an identity provider. SailPoint Human Fabric runs AI-driven access certifications, enforces separation of duties and provisions access as the organization changes.
- Privileged-access-led platforms. Palo Alto Networks positions Idira around privileged access management extended to every identity. Palo Alto Networks says CyberArk Workforce Access customers can upgrade to full zero standing privilege and traditional PAM, and add agentic and machine identity protections.
- Cloud services that bridge on-premises systems. IBM describes IBM Verify as an identity-as-a-service offering that bridges from on-premises IAM. It can use IBM Verify Access or Active Directory as an identity provider.
If most of your applications are Microsoft 365 and Windows, start by pricing what your current Microsoft agreement already includes. If they are not, test a standalone provider against your hardest applications.
What it costs where prices are published
List prices as published on each vendor's page on October 17, 2026.
- Microsoft Entra. Entra ID P1 is $7 per user per month and P2 is $10, paid yearly on an annual commitment. Entra ID Governance is $7 per user per month for P1 and P2 customers. The Microsoft Entra Suite, which combines network access, identity protection, governance and identity verification, is $12 per user per month and requires P1. Passkeys are available in every Entra ID edition, including Free, with no extra license.
- Okta Workforce Identity. Starter, with single sign-on, MFA and Universal Directory, is $6 per user per month. Core Essentials is $14. Essentials, which adds adaptive MFA, lifecycle management and access governance, is $17. Professional and Enterprise are priced on inquiry. All suites are billed annually, with a $1,500 annual contract minimum.
- PingOne for Workforce. Essential, with single sign-on, MFA and a directory for SaaS applications, is $3 per user per month. Plus, which adds adaptive MFA and passwordless authentication with FIDO, is $6. Both prices assume an annual contract with a 5,000-user minimum.
- JumpCloud. The SSO plan, with single sign-on, MFA and a password manager, is $11 per user per month billed annually or $13 billed monthly. The Platform packages are priced through sales.
- IBM Verify. IBM says Verify pricing is based on actual usage, measured in resource units.
Ask each vendor which tier the features you need sit in, and what the per-user rate becomes at renewal.
Service accounts and AI agents
Microsoft lists Entra Workload ID at $3 per workload identity per month. Its mandatory MFA does not apply to managed identities and service principals. User accounts that run scripts must complete MFA, and Microsoft recommends moving them to workload identities.
Microsoft Entra Agent ID creates and manages identities for AI agents. Microsoft says it is available to all Entra customers. Extending Entra security features to agents requires Microsoft Agent 365.
Okta includes machine-to-machine tokens in its Enterprise suite. SailPoint sells Agentic Fabric, standalone or in its unified solution, to discover and govern AI agents, credentials and MCP servers. Idira covers machine and AI agent identities alongside human ones.
Count service accounts and agents before you sign. A model built on headcount alone will miss them.
What a deployment requires
Organizations that keep Active Directory need software that links it to the cloud directory.
- Microsoft. Entra Cloud Sync uses a lightweight provisioning agent that makes outbound connections only. Several agents can run at once for failover. It syncs every two minutes and handles multiple disconnected Active Directory forests.
- Okta. The Okta AD agent makes outbound HTTPS connections on port 443. Okta recommends two or more agents on separate servers in each domain.
SCIM is the IETF protocol for provisioning accounts across domains, published as RFC 7644 in September 2015. For applications without SCIM, plan a custom connector or manual steps.
Entra ID supports synced passkeys and device-bound passkeys on FIDO2 security keys and in Microsoft Authenticator. Passkey profiles let administrators require device-bound passkeys for some groups and allow synced passkeys for others. Synced passkeys do not support attestation.
Roll out phishing-resistant MFA to administrators first. Test enrollment, lost-device recovery and help desk resets with a pilot group before broad rollout.
Questions to settle first
Settle these before choosing a product.
- Which applications still rely on passwords, legacy protocols or no SCIM support, and who owns each one?
- Which identity features does your current Microsoft or other suite agreement already include?
- Which users will get synced passkeys, which need device-bound keys, and how will lost devices be recovered?
- How many service accounts and AI agents sign in today, and who owns them?
- Will governance and privileged access come from the same vendor as sign-in, or from separate products?