The job to be done
Give the right identity the right access, for the right reason, and remove it when that reason ends.
Identity and access management (IAM) decides who or what may use a digital resource, how identity is proven, what they may do, and how that access is created, reviewed, and taken away. Authentication proves a claimed identity. Authorization decides whether an action is allowed. Provisioning creates and removes accounts. Governance reviews standing access. Privileged access management vaults and records elevated sessions. Workforce single sign-on, customer identity, workload identities, identity governance, and privileged access share protocols but are not one purchase. Native hyperscaler IAM is usually a spoke behind a corporate identity provider.
What goes in
- Identity lifecycle events
- Application access requirements
- Authentication and device signals
What should come out
- Authentication and access decisions
- Provisioning and deprovisioning
- Access review and audit evidence
Inside the segment
These capabilities answer different questions. Use the distinction to define the work before assembling a shortlist.
Workforce IAM
Give employees, contractors, and partners a single sign-on and multifactor authentication path into applications and cloud consoles.
Boundary: Workforce identity is not customer identity, not identity governance, and not privileged session brokering, even when the same vendor sells those adjacent products.
Customer identity (CIAM)
Let consumers, patients, citizens, or business-to-business tenant users register, consent, and sign in to a product you operate.
Boundary: Do not casually share the workforce directory with customer identities. Conversion, consent, and self-service matter as much as security.
Workload and non-human identity
Issue and constrain credentials for service accounts, API clients, bots, automation, and cloud roles.
Boundary: A human single sign-on product does not automatically govern machine credentials, long-lived access keys, or AI-agent registrations.
Identity governance and administration (IGA)
Create, review, certify, and remove standing entitlements, including separation of duties, so access stays justified.
Boundary: Login success is not proof that SAP, electronic health record, or finance admin rights are still needed. IGA is often a second product beside the identity provider.
Privileged access management (PAM)
Vault, time-box, broker, and record elevated access to servers, cloud roles, vendors, and secrets.
Boundary: Multifactor authentication at login is not a vault, session recording, or just-in-time elevation for shared administrator accounts.
How the work flows
Inventory identities and systems
List humans, vendors, service accounts, and agents. Group applications by protocol such as OpenID Connect, SAML, or legacy. Note privileged targets and the current identity provider, directory, governance, and privileged access tools.
Choose two observable success scenarios
Choose measurable lab outcomes, such as joiner provisioning, removal of a contractor’s access, or a recorded privileged session. Set target times from the organization’s requirements and measure actual propagation and session behavior.
Set assurance and recovery rules
Use identity proofing, authenticator and federation assurance as design concepts. Choose phishing-resistant methods where required, define authorized recovery checks, and test token lifetime, application logout and revocation behavior.
Run an isolated test tenant
Use synthetic identities, a representative application set including one legacy app, one human-resources source, a provisioning round-trip, one policy engine, one privileged target, and one break-glass account. Measure failed logins and help-desk steps.
Tabletop revocation and exit
Tabletop a stolen refresh token, lost laptop and contractor departure. Test new logins, existing application sessions, cloud credentials and privileged sessions separately. Record residual access and export supported configuration and evidence.
The environment changes the question
Use these scenarios to adapt the evaluation to your organization. They describe operational concerns, not a determination of compliance.
Finance ↗
A payments team evaluates workforce single sign-on plus separation of duties for core-banking administrators, with step-up authentication on beneficiary changes and privileged session recording on payment consoles.
Evaluate: Keep know-your-customer proofing distinct from authenticator strength, and treat stolen-token fraud as a session and revocation problem rather than another password rule.
Utilities ↗
An energy operator cannot put modern authenticators on every operational-technology workstation, so named operator identity and session recording sit at a jump host or privileged-access broker instead of shared shop-floor passwords.
Evaluate: Compensate at the broker for devices that cannot run phishing-resistant authenticators, and keep cloud workforce identity separate from plant control networks.
Manufacturing ↗
A plant uses shared workstations, supplier remote access, and internet-of-things service accounts, so headquarters workforce single sign-on is paired with privileged vendor access at sites and a separate customer portal for connected products.
Evaluate: Treat supplier and machine identities as first-class inventory, not leftover shared logins on the factory floor.
Healthcare ↗
A health system needs workforce access to an electronic health record, patient-facing customer identity with consent and access logging, and fast leaver disablement for clinicians who change assignments.
Evaluate: Design emergency access and timely disablement around clinical workflows, and keep patient and workforce identity requirements distinct.
Public sector ↗
An agency maps applications to identity-proofing, authenticator, and federation assurance levels and checks current authorization packages for any government cloud SKU a vendor advertises.
Evaluate: Treat federal guidance as design language, not a product certification, and verify the live authorization package rather than brochure claims.
Retail & e-commerce ↗
A retailer splits consumer customer identity for shoppers and marketplace sellers from the workforce identity used by store and headquarters staff.
Evaluate: Keep customer conversion, social login, and business-to-business tenant single sign-on on a customer-identity stack rather than the employee directory.
What drives the operating cost
- Identity count and type: named workforce users, customer monthly active users, service accounts, and privileged vault objects are billed on different meters.
- Connector and hybrid residual work: each human-resources, enterprise-resource-planning, mainframe, RADIUS, or custom application connector is a project, and on-premises directories remain after cloud single sign-on.
- Assurance and recovery: phishing-resistant authenticators, hardware keys, identity proofing, and high-assurance recovery paths add operations even when list prices are unpublished.
- Governance and privileged surface: certification campaigns, separation-of-duties rules, servers, Kubernetes, cloud roles, vendor access, and secrets in continuous integration all expand scope.
- Packaging: single sign-on, identity governance, privileged access, and identity-fabric suites are separate SKUs; hyperscaler IAM may ride on cloud spend and still need a corporate identity-provider license.
Questions worth asking
- Can we enforce phishing-resistant authentication for the required populations?
- Does disabling an account revoke application access and existing sessions as intended?
- Who can change access policy, and how is emergency access protected?
Common assumptions to check
One identity product covers workforce login, customer identity, entitlement governance, and privileged sessions.
Those five jobs share protocols and often share a vendor logo, but they remain separately scoped modules. A common pattern is an identity provider plus identity governance plus privileged access, not a single console.
A Temporary Access Pass or similar recovery code proves who the person is.
In Microsoft Entra, Temporary Access Pass bootstraps authenticator enrollment after identity verification. It is not identity proofing and is not a standing phishing-resistant sign-in method.
Native hyperscaler IAM replaces the corporate identity provider.
AWS IAM Identity Center, Google Workforce Identity Federation, and Oracle Cloud Infrastructure IAM are usually spokes that consume a corporate identity provider. Identity Center can also cover customer-managed SAML applications, which still does not make it a full customer-identity or governance suite.
APPLY THE IDEA / EVALUATION PLAN
Make the outcome observable.
Use test identities to follow joiner, mover, and leaver events across two applications. Verify revocation rather than assuming it.
Build a synthetic identity inventory before any production cutover.
A written list of human, vendor, service-account, and privileged targets plus protocols for a lab application set, with no production identities imported.
Prove joiner provisioning and leaver revocation in an isolated tenant.
A synthetic joiner reaches a test application through single sign-on, and a synthetic leaver is disabled with identity-provider logout and a recorded check that the application session and any privileged session end.
Exercise recovery without treating a bootstrap credential as proofing.
After an authorized identity-verification step, a Temporary Access Pass or equivalent enrolls a replacement authenticator, and later sign-ins use the enrolled method rather than the bootstrap credential.
Map SKUs and connectors in writing against the lab, not the brochure.
A matrix showing which licensed module provided single sign-on, governance, or privileged access in the test, plus an export of users, applications, and policies.
Use synthetic data and an authorized test environment. Record scope, product edition, permissions, results, and recovery behavior.
Vendors & products
15 profilesAn editorial selection of relevant offerings, with documented scope and practical evaluation questions. Atlas Fold provides a separate provisional documentation assessment for selected offerings; inclusion in this directory is not a ranking.
Microsoft / Workforce IAM
Microsoft Entra ID
This profile covers Entra ID workforce authentication, Conditional Access, and hybrid directory sync. It does not cover customer identity, identity governance add-ons, or privileged access unless those SKUs are licensed separately.
Okta / Workforce IAM
Okta Workforce Identity
This profile covers the workforce identity suite. Auth0 customer identity is a related but separately scoped product. Single sign-on, adaptive multifactor authentication, identity governance, and privileged access are distinct SKUs.
Auth0 / Customer identity
Auth0
Auth0 serves customer and application identity separately from Okta Workforce Identity. Scope its authentication, provisioning and authorization offerings explicitly; the application remains responsible for enforcing the authorization decisions it obtains.
Ping Identity / Workforce and customer federation
PingFederate / PingOne
Design the PingOne versus PingFederate split explicitly. ForgeRock-origin capabilities appear in Ping's family unless a live contract still names ForgeRock. Government-cloud authorization claims need a current package check, not a brochure.
SailPoint / Identity governance
SailPoint Human Fabric / Identity Security Cloud
Current public naming also uses Human Fabric and describes its relationship to Identity Security Cloud. Existing customer editions and migration requirements still need contract-specific verification. This profile is identity governance, not workforce single sign-on.
Saviynt / Identity governance
Saviynt Identity Cloud
This profile is identity governance plus some privileged and non-human identity coverage, not a standalone workforce identity provider. Connector inventory and runtime enforcement must be proven per application. AI-agent registration is marketed and needs a lab check.
CyberArk / Privileged access
Idira Privileged Access Management
This profile covers privileged access in the CyberArk portfolio under Palo Alto Networks. Machine and agent identity products require separate scoping; do not assume one console or subscription covers the entire portfolio.
BeyondTrust / Privileged access
BeyondTrust PAM Portfolio
This profile covers privileged account and session management plus endpoint privilege. Cloud entitlement and identity-threat capabilities are adjacent offerings. Confirm the selected module, deployment and target support rather than treating the whole portfolio as one product.
Delinea / Privileged access
Delinea Secret Server
This profile is vault-focused privileged access for human, machine, and described AI credential control. It is not a workforce identity provider. Treat platformization and identity-governance-adjacent features as separate modules to license and test.
IBM / Identity fabric
IBM Verify
Map which SKU does single sign-on, customer identity, identity governance, or privileged identity before an evaluation. This is a fabric for hybrid IBM, mainframe, and regulated estates, not a single greenfield software-as-a-service identity provider.
Oracle / Cloud IAM and identity governance
Oracle OCI IAM / Identity Governance
This profile covers native Oracle Cloud identity domains plus adjacent identity governance. It is not a generic customer-identity suite for non-Oracle applications unless those connections are in scope. Confirm identity-domain versus Identity Governance packaging on the quote.
JumpCloud / Workforce directory and device management
JumpCloud Open Directory
This profile is workforce directory and device management, not customer identity or a full identity-governance suite. The cloud-directory pages are the current public path; treat device management as in-scope only when that module is licensed.
Cisco Duo / Multifactor authentication overlay
Cisco Duo
Duo is access security, not a full identity-governance or customer-identity platform. It integrates with Active Directory, virtual private networks, software-as-a-service, and Entra external authentication methods. It does not by itself certify entitlements or vault privileged passwords.
Amazon Web Services / Cloud workforce IAM
AWS IAM Identity Center
Identity Center can use an external identity provider and support customer-managed SAML applications. Scope account access, application assignments and provisioning separately; it is not a complete customer-identity or identity-governance product.
Google Cloud / Cloud workforce and customer identity
Google Cloud Identity / Workforce Federation / Identity Platform
These are distinct products: Cloud Identity manages Google identities, Workforce Identity Federation maps an external identity provider into Google Cloud, and Identity Platform provides customer identity. Verify the selected product’s requirements separately.