Cybersecurity

Identity and access management buyers, mid-evaluation.

IAM is where security, IT and compliance meet, and it is increasingly bought under external pressure rather than internal ambition. The shortlist is small and the decision usually turns on what the rest of the stack already uses.

What starts it

Nobody evaluates identity and access management for fun.

An audit or framework requirement

SOC 2, ISO 27001 or a customer security review names access control directly. The most common starting point.

A cyber insurance condition

MFA has become a condition of cover rather than a recommendation, and that forces a purchase.

Onboarding and offboarding breaking

Headcount change makes manual provisioning untenable, and a leaver with live access becomes a board-level problem.

A Microsoft licensing decision

Moving to E5 puts Entra in the stack for free, and every specialist on the shortlist has to justify itself against it.

Who is in the room

Security, IT and audit, pulling different ways.

CISO or Head of SecurityRisk reduction and whether it satisfies the framework in question.

IT operationsProvisioning, directory integration and the helpdesk load it removes or adds.

Application ownersWhether their apps are supported without custom work.

Compliance and GRCEvidence and access reviews, which is often the reason the project exists.

FinancePer-user pricing at full headcount, not at pilot.

Weighed against, by name

Short, and short for one reason.

OktaMicrosoft Entra IDJumpCloudPing IdentityCyberArk

A genuinely short list, and it is short for one reason: most buyers already pay Microsoft. Entra ID is the default that every other name is measured against, Okta is the answer when the estate is not Microsoft-centred, JumpCloud when the buyer wants directory and device together, and Ping or CyberArk when the requirement is enterprise federation or privileged access specifically. Password managers and standalone MFA sit in adjacent categories and are not usually compared here.

Every lead we deliver carries the vendors that person put side by side on the page, by name and with a timestamp — so your rep knows which of these they are actually up against before the first call.

How size changes it

The same category is bought three different ways.

Under 300 staffThe decision is usually whether the Microsoft licence tier they already hold is enough. A separate IAM purchase at this size needs a specific reason — an auditor, an insurer, or an estate that is not Microsoft.

300 to 2,000 staffJoiner-mover-leaver automation becomes the requirement, because manual provisioning has visibly broken. Application coverage decides it: the buyer counts how many of their own apps are supported without custom work.

Above 2,000 staffPrivileged access, federation and access reviews separate into their own requirements, and the single-vendor assumption breaks. Most estates this size end up running more than one product.

Why the shortlist is short

Every IAM evaluation is a Microsoft decision first.

The incumbent is already paid for

Entra ID arrives inside licensing the company holds. A competing vendor is not arguing they are better in the abstract, they are arguing they are worth a second line of spend.

Licence tier is the hinge

Much of the comparison turns on which Microsoft tier the buyer is on and what moving up would cost, which is a negotiation happening outside the security team.

Non-Microsoft estates invert it

Where the stack is Google, AWS-centred or genuinely mixed, the default advantage disappears and the evaluation opens up immediately.

What they read

What an IAM buyer needs in writing.

Zero-trust and access-review explainers

Practitioners self-educate here before they shortlist.

Migration guides from a legacy directory

The switching cost is the objection, and it is mostly a migration story.

Compliance mapping

Showing which controls a tool satisfies does more than feature marketing in this category.

Comparisons against the bundled option

Entra is the default competitor now. A page that meets it head on gets read.

How a program runs

IAM buyers are reachable by title across both security and IT, so programs here can segment by which side of the committee you sell to. The consideration set matters: being weighed against Entra is a licensing argument, being weighed against Okta is a capability argument.

Also covered

Other categories we publish in.

Endpoint Detection & ResponseTriggers, committee and consideration set →GRC & Compliance AutomationTriggers, committee and consideration set →

Before you ask

What vendors get wrong about identity and access management buyers.

Why is this consideration set smaller than other categories?

Because the Microsoft default removes most of the field before the evaluation starts. Buyers compare a handful of credible alternatives to a product they already own, rather than surveying a market.

What starts an IAM evaluation?

External pressure far more often than internal ambition — a SOC 2 or ISO audit naming access control, or a cyber insurer making MFA a condition of cover rather than a recommendation.

Do buyers end up with one IAM product?

Below a couple of thousand staff, usually. Above it, privileged access and workforce identity tend to separate, and most estates run more than one vendor.