STACK BUILDER

IAM stack builder: which jobs and tools you need

Short answer

Answer four questions. The builder marks each of the five IAM jobs as In place, Core, Next or Later using the plain rules printed below the results, and lists the vendors whose own pages document each job. It does not score vendors or pick one for you.

By The Access Desk · Best IAM Tools · Published 2026-10-08

Which jobs matter for you now?

Core now: Lifecycle and governance. Next: Application coverage and identity orchestration, Privileged access and Identity threat detection and response.

Compare the listed vendors side by side

Figure 1. The five jobs this site maps. Squares count vendors whose own pages describe the job (filled) or part of it (half-filled). Counts, not quality.

Read the stack as a list

J5 Identity threat detection and response: 5 documented, 1 partial
J4 Privileged access: 2 documented, 7 partial
J3 Application coverage and identity orchestration: 2 documented, 6 partial
J2 Lifecycle and governance: 7 documented, 4 partial
J1 Directory and single sign-on: 5 documented, 1 partial

Directory and single sign-on

In place

You already run Microsoft Entra ID for this job. Keep it, and check that the other jobs reach the apps it does not.

Vendors whose pages document this job (6)

Google Cloud IdentityDocumented
Listed at $7.2 per user per month on the product page; a Free edition is also offered.
JumpCloudDocumented
Size note: Platform Essentials has a 300-user maximum.
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Microsoft EntraDocumentedYour identity provider
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
OktaDocumented
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Ping IdentityDocumented
Size note: 5,000-user annual minimum.
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.
SilverfortPartialNames Microsoft Entra ID
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.

Lifecycle and governance

Core

At your size or audit level, removing access on time and proving it in reviews needs a system rather than tickets.

Vendors whose pages document this job (11)

C1 (formerly ConductorOne)Documented
Structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities). No prices.
LumosDocumented
Not published.
Microsoft EntraDocumentedYour identity provider
Prerequisite: Requires Entra ID P1 or P2.
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
OktaDocumented
Prerequisite: Identity Governance requires Okta Workforce Identity.
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
SailPointDocumented
Suites listed (Standard, Agentic Business, Agentic Business Plus) without prices.
SaviyntDocumented
Not published.
VezaDocumented
Not published.
Google Cloud IdentityPartial
Listed at $7.2 per user per month on the product page; a Free edition is also offered.
JumpCloudPartial
Size note: Platform Essentials has a 300-user maximum.
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Orchid SecurityPartialNames Microsoft Entra ID
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Ping IdentityPartial
Size note: 5,000-user annual minimum.
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.

Application coverage and identity orchestration

Some on-premises apps sit outside SSO and SCIM. Count them before you buy anything for this job.

Vendors whose pages document this job (8)

Orchid SecurityDocumentedNames Microsoft Entra ID
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
SaviyntDocumented
Not published.
C1 (formerly ConductorOne)Partial
Structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities). No prices.
LumosPartial
Not published.
Microsoft EntraPartialYour identity provider
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
Push SecurityPartial
Standard (up to 500 employees): $5 per user per month on an annual contract, or $6 per employee per month billed monthly, both billed in advance. Enterprise (500+ employees): volume pricing on request. Every licence includes the full platform; a trial is available.
SailPointPartial
Suites listed (Standard, Agentic Business, Agentic Business Plus) without prices.
VezaPartial
Not published.

Privileged access

List your admin accounts and machine secrets first; add a tool when the list outgrows manual control.

Vendors whose pages document this job (9)

AponoDocumented
No pricing page on its own site (/pricing redirects to the home page). AWS Marketplace, 1-month contract: $4,900.00 per month commit for 100 users, plus $49.00 per month for each extra user.
CyberArk (Idira, Palo Alto Networks)Documented
No prices stated in the Idira release or in our other sources.
JumpCloudPartial
Size note: Platform Essentials has a 300-user maximum.
Per user per month: Device Management $9 annual or $11 monthly; SSO $11 or $13; Device Identity Management $13 or $15. Platform tiers priced on request (Platform Essentials up to 300 users). Add-ons $3 to $6. 30-day trial.
Microsoft EntraPartialYour identity provider
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
OktaPartial
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Orchid SecurityPartialNames Microsoft Entra ID
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Ping IdentityPartial
Size note: 5,000-user annual minimum.
PingOne for Workforce Essential $3 and Plus $6 per user per month, annual contract, 5,000-user minimum; 30-day trial on both.
SaviyntPartial
Not published.
SilverfortPartialNames Microsoft Entra ID
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.

Identity threat detection and response

Check what your identity provider already includes for session risk before adding a separate product.

Vendors whose pages document this job (6)

Microsoft EntraDocumentedYour identity provider
Per user per month, paid yearly: Entra ID Free; P1 $7.00; P2 $10.00; ID Governance $7.00 (requires P1 or P2); Entra Suite $12.00 (requires P1); Workload ID $3.00 per workload identity. P1 is included in Microsoft 365 E3 and Business Premium, P2 in Microsoft 365 E5. Defender for Identity needs EMS E5 or A5, Microsoft 365 E5 (E5, A5, G5), Microsoft 365 E5, A5, G5 or F5 Security, Microsoft 365 F5 Security and Compliance, or a standalone Defender for Identity licence; the standalone price is not stated.
OktaDocumented
Starter $6, Core Essentials $14, Essentials $17 per user per month, billed annually; Professional and Enterprise priced on request; $1,500 annual minimum; 30-day Starter trial. Identity Threat Protection is an add-on from Essentials up and included in Professional. Okta's pricing table marks Identity Governance (OIG) as included from Essentials ($17 per user per month) upward, and Okta's footnote describes OIG as an add-on.
Push SecurityDocumented
Standard (up to 500 employees): $5 per user per month on an annual contract, or $6 per employee per month billed monthly, both billed in advance. Enterprise (500+ employees): volume pricing on request. Every licence includes the full platform; a trial is available.
SemperisDocumentedNames Microsoft Entra ID
Purple Knight assessment is free. Directory Services Protector is listed on Microsoft Marketplace with "Price varies" and no list price; no public price on semperis.com.
SilverfortDocumentedNames Microsoft Entra ID
No list price; Silverfort says pricing is based on the size of the organization. Four packages: Core (ISPM, Universal MFA), Plus (adds NHI Security and AI Agent Security), Advanced (adds Authentication Firewall and ITDR), Enterprise (adds Access Intelligence and Privileged Access Security with just-in-time access). Standard support included; Premier support 10% and Diamond 20% of licence cost.
Orchid SecurityPartialNames Microsoft Entra ID
No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.

How does the builder decide?

Directory and single sign-on: "In place" if you have an identity provider; "Core" if you have none.
Lifecycle and governance: "Core" if you have 300 or more people or any formal audits; otherwise "Next".
Application coverage: "Core" if you have many legacy, custom-built or homegrown apps, or if you have on-premises apps and heavy audit pressure; "Next" if you have some on-premises apps; "Later" if your apps are mostly SaaS with SSO and SCIM.
Privileged access: "Core" if audit pressure is heavy or you have over 5,000 people; otherwise "Next".
Identity threat detection: "Core" if you have over 5,000 people or heavy audit pressure; "Next" if you have 300 to 5,000 people; "Later" if under 300.
Vendor lists: vendors whose status for the job is Documented, then Partial, alphabetical within each group. A vendor is tagged "Your identity provider" when it is the identity provider you chose, and "Names <your provider>" when its own pages name that provider. Prerequisites and size notes are shown, not used to hide anyone.

The rules are deliberately simple and printed in full so you can disagree with them. They do not score or rank vendors; within each job, vendors are grouped by what their own pages document and then listed alphabetically.

Frequently asked questions

Why does the builder not recommend one vendor?

Because the right vendor depends on contracts, skills and apps we cannot see. The builder narrows the jobs and lists who documents each; the profiles and head-to-heads help you choose.

Why is Orchid Security listed under some jobs?

Orchid's own pages document application coverage and describe part of the lifecycle, privileged access and detection jobs, so it appears in those lists in alphabetical order within its status group.

Does the builder store my answers?

No. Your answers stay in the page address so you can share or bookmark them; nothing is sent anywhere.