JOB J2 · LIFECYCLE AND IGA
Lifecycle and governance tools: who covers joiners, movers, leavers and access reviews
Short answer
Seven of the 16 vendors document this job: C1 (formerly ConductorOne), Lumos, Microsoft Entra, Okta, SailPoint, Saviynt and Veza. Four more cover part of it. The practical differences are whether the tool runs inside your identity provider or beside it, how many certification types it describes, and how it reaches applications with no connector.
What does this job include?
- Joiner, mover and leaver provisioning triggered by the HR system.
- Access requests with approvals.
- Access reviews, also called certifications or attestations.
- Entitlement and role management.
- Audit trails and evidence reports for auditors.
Read the stack as a list
- J5 Identity threat detection and response: 5 documented, 1 partial
- J4 Privileged access: 2 documented, 7 partial
- J3 Application coverage and identity orchestration: 2 documented, 6 partial
- J2 Lifecycle and governance: 7 documented, 4 partial
- J1 Directory and single sign-on: 5 documented, 1 partial
Who documents this job?
HR systems and directories trigger join, role change and leave workflows; C1 says it finds what offboarding missed and records each action.
Source: C1 Lifecycle · Read 27 Sep 2026
Structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities). No prices.
HRIS-triggered joiner, mover and leaver workflows; revocation across IdPs, local accounts, custom apps, SaaS, cloud and on-premises systems; licenses reclaimed for leavers; full audit trail.
Source: Lumos Lifecycle Management · Read 27 Sep 2026 · Source: Lumos homepage · Read 27 Sep 2026
Not published.
Entra ID Governance: lifecycle workflows before start, on status change and at leave, access reviews, entitlement management, and HR-driven provisioning from Workday and SAP SuccessFactors.
Source: Microsoft Learn: Entra ID Governance overview · Read 27 Sep 2026 · Source: Microsoft Learn: HR-driven provisioning · Read 27 Sep 2026
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Prerequisite: Requires Entra ID P1 or P2.
Lifecycle Management with HR sources (Workday, BambooHR, SuccessFactors) and SCIM; Okta Identity Governance adds access requests, certifications and entitlement management and requires Okta Workforce Identity.
Source: Okta Lifecycle Management · Read 27 Sep 2026 · Source: Okta Identity Governance · Read 27 Sep 2026
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Prerequisite: Identity Governance requires Okta Workforce Identity.
Joiner, mover and leaver automation; Manager, Source Owner and Search certification campaigns; AI-driven certifications; automatic audit evidence collection and audit-ready reports.
Source: SailPoint Identity Security Cloud · Read 27 Sep 2026 · Source: SailPoint documentation: certifications · Read 27 Sep 2026
Suites listed (Standard, Agentic Business, Agentic Business Plus) without prices.
Onboarding, account creation, granting and revoking access, and certification campaigns as core IGA functions.
Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026
Not published.
Birthright access, role change and offboarding including local accounts, with Dry Run and Safety Limits; access reviews that show local, machine and service accounts.
Source: Veza Lifecycle Management · Read 27 Sep 2026 · Source: Veza Access Reviews · Read 27 Sep 2026
Not published.
Who covers part of it?
Automated user provisioning to third-party apps is a Premium-only feature; governance features are not in our sources.
Source: Google Cloud Identity editions · Read 27 Sep 2026
Listed at $7.2 per user per month on the product page; a Free edition is also offered.
User lifecycle management is sold as an add-on, and JumpCloud has introduced agentic identity lifecycle management.
Source: JumpCloud pricing · Read 27 Sep 2026 · Source: JumpCloud platform · Read 27 Sep 2026
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Feeds identity context into IAM, IGA and ITSM tools; joiner, mover and leaver execution and certification campaigns stay in those tools.
Source: Orchid Security: IAM programs · Read 27 Sep 2026 · Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Inbound provisioning and SCIM in the Essential tier; governance features are not in our sources.
Source: Ping Identity pricing · Read 27 Sep 2026
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.
How do all 16 vendors read for this job?
| Vendor | J2Lifecycle and IGA |
|---|---|
| Apono | Not in our sources |
| C1 (formerly ConductorOne) | Documented |
| CyberArk (Idira, Palo Alto Networks) | Not in our sources |
| Google Cloud Identity | Partial |
| JumpCloud | Partial |
| Lumos | Documented |
| Microsoft Entra | Documented |
| Okta | Documented |
| Orchid Security | Partial |
| Ping Identity | Partial |
| Push Security | Not in our sources |
| SailPoint | Documented |
| Saviynt | Documented |
| Semperis | Not in our sources |
| Silverfort | Not in our sources |
| Veza | Documented |
Inside the identity provider or beside it?
Okta Identity Governance requires Okta Workforce Identity, and Microsoft Entra ID Governance requires Entra ID P1 or P2, so both suit organizations already on that provider. SailPoint, Saviynt, Veza, C1 and Lumos are separate platforms that connect to the identity provider and HR system you run. A separate platform adds a contract and an integration project; an add-on ties governance to your sign-in vendor.
Source: Okta Identity Governance · Read 27 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026
What do auditors look for in this job?
NIST SP 800-53 control AC-2 covers account management, including disabling accounts that are no longer needed. DORA, Regulation (EU) 2022/2554, applies to EU financial entities from 17 January 2025, and its technical standards ask for a lifecycle process for identities and accounts. PCAOB AS 2201 tells auditors of public companies that the identification of risks and controls within IT is not a separate evaluation. In practice, the evidence is who approved access, when it was removed and whether reviews happened.
Source: NIST SP 800-53 Rev. 5 · Read 27 Sep 2026 · Source: Regulation (EU) 2022/2554 (DORA) · Read 27 Sep 2026 · Source: Commission Delegated Regulation (EU) 2024/1774 (ICT risk management technical standards) · Read 27 Sep 2026 · Source: PCAOB AS 2201 · Read 27 Sep 2026
What about applications the governance tool cannot reach?
Every governance tool acts through connectors. An application without one is handled by tickets, a CSV file or not at all. Saviynt documents onboarding of disconnected apps inside its own IGA, and Orchid Security documents discovering such apps and feeding them to the IGA you run. See the application coverage job.
Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026 · Source: Orchid Security: IAM programs · Read 27 Sep 2026
Frequently asked questions
What is the difference between an identity provider and IGA?
An identity provider signs people in and can create accounts in connected apps. Identity governance and administration (IGA) decides who should have access, records approvals, runs access reviews and removes access when people move or leave, with evidence for auditors.
Which governance vendors publish prices?
Microsoft lists ID Governance at $7.00 per user per month on top of Entra ID P1 or P2. Okta's Core Essentials suite at $14 lists Lifecycle Management and Access Governance, and the pricing table marks Identity Governance as included from Essentials ($17) upward, with a footnote describing it as an add-on. C1 publishes its plan structure without prices and SailPoint lists suites without prices. Saviynt, Veza and Lumos do not publish prices.
Do I need governance if my apps support SCIM?
SCIM, defined in RFC 7644, creates, updates and removes accounts in apps that support it. Governance adds the decisions around those changes: who approved them, whether access is still needed, and the evidence auditors ask for.
Read next