IAM stack by company size: what changes at 300 and 5,000 people

Under 300 people

Priority: one identity provider, MFA everywhere, and automated onboarding and offboarding for the main applications.

Published size facts: JumpCloud's Platform Essentials tier has a 300-user maximum; Okta contracts have a $1,500 annual minimum; Google Cloud Identity and Microsoft Entra ID both have free editions. Okta Starter, at $6 per user per month, includes SSO, MFA and Universal Directory.

What can wait: a separate governance platform, unless an audit or a customer contract requires access reviews.

300 to 5,000 people

Priority: lifecycle from HR, access reviews and evidence. With more people joining and leaving every month, manual offboarding is harder to keep complete, and first audits usually arrive in this range.

The options split two ways. Governance inside your identity provider: Microsoft ID Governance at $7.00 per user per month on top of Entra ID P1 or P2, or Okta Identity Governance, which Okta's pricing table marks as included from Essentials ($17 per user per month) upward and its footnote describes as an add-on. Or a separate platform such as SailPoint, Saviynt, Veza, C1 or Lumos. C1 publishes plan sizes from 100 to 20,000 managed identities.

What to watch: applications outside your connectors. A mid-size company with on-premises applications should count them before choosing a governance tool.

Over 5,000 people

Priority: everything above, plus privileged access and identity threat detection as core jobs. Admin populations and the number of accounts an attacker can try grow with headcount.

Published size facts: PingOne for Workforce, at $3 and $6 per user per month, carries a 5,000-user annual minimum. Saviynt offers a private cloud option, and Ping offers PingFederate as self-run software and a dedicated tenant, for organizations with deployment requirements.

What to watch: Active Directory. Large organizations often still run it, which makes directory detection and recovery, from vendors such as Semperis, Silverfort and Microsoft Defender for Identity, relevant.

Is size the only input?

No. A 200-person bank under DORA may need what a 3,000-person retailer does not. The stack builder combines size with your applications, audit pressure and current identity provider.