IGA Solutions Compared: 12 Vendors with Features
Identity Governance and Administration (IGA) enables security administrators to manage user identities and access across the enterprise.
We researched 12 IGA platforms, verifying vendor claims against official product documentation, testing access certification workflows, and cross-referencing customer deployments from One Identity, Omada, Oracle, IBM, Lumos, and more. See our analysis on value and performance comparison.
Comparison of the top 12 IGA solutions
* Based on data from B2B review platforms
** Based on data from LinkedIn
IGA vs IAM vs PAM
These three categories overlap in scope but cover different functions.
IAM (Identity and Access Management) handles authentication and access control: verifying a user’s identity and deciding whether the user can enter a system. Single sign-on, multi-factor authentication, and conditional access policies are IAM functions.
IGA (Identity Governance and Administration) governs the access that IAM enforces. It records who holds which access, who approved it, and whether it is still needed. Access reviews, role modeling, SoD enforcement, and compliance reporting are IGA functions.
PAM (Privileged Access Management) covers identities with elevated permissions, such as system administrators, database owners, and root accounts. It controls when elevated access can be used, records privileged sessions, and grants privileges just in time.
How does IGA work?
Identity data enters the IGA platform from authoritative sources such as HR systems, Active Directory, and identity providers. The platform keeps a central identity repository that records who exists in the organization, which roles they hold, and which access they have.
The policy engine turns business rules into provisioning decisions. When an employee joins, changes roles, or leaves, the platform grants, adjusts, or revokes access in connected applications. Requests for sensitive systems can be routed through approval workflows.
Access certification campaigns run on a schedule or on demand. Managers and resource owners confirm whether each user’s access is still needed. Some platforms add peer-group analysis, which flags access that differs from that of colleagues in similar roles.
Provisioning reaches target applications through connectors, SCIM 2.0, or APIs. Each action is logged, and these logs feed the reports used in SOX, GDPR, and HIPAA audits.
IGA Solutions Explained
1. One Identity Manager
One Identity Manager is an IGA platform with deployment options for on-premises, cloud, and hybrid environments, and a focus on Active Directory, Microsoft Entra ID, and SAP governance.
Version 9.3 moved the platform to .NET 8 and replaced the Web Designer portal with an Angular-based Web Portal. In the Web Portal, actions such as approving or denying requests run as background processes, so users can continue working while the system handles them. The Web Portal can also recommend products during an access request based on the recipient’s peer group.
Version 10.0 adds a browser-based administration interface that works without desktop installation.1 Other additions in 10.0:
- Risk score ingestion: Imports user risk scores from third-party analytics and UEBA tools and combines them with internal risk scores.
- ITDR playbooks: Custom playbooks respond to policy violations by disabling accounts, flagging security incidents, or launching targeted attestation.
- Entra ID Behavior-Driven Governance (BDG): Tracks application-level usage, identifies unused or rarely used entitlements, and recommends or automates their removal.
- SAP transaction usage import: Aggregated SAP transaction data supports SoD analysis and identifies unused SAP profiles.
- Natural-language reporting: Authorized users query identity data in natural language through a customer-controlled LLM.
- SIEM output: Syslog messages in CEF format.
Limitations:
- The upgrade to 9.3 cannot use automatic software updates for Job servers and web applications; these must be updated manually.
- Scripts and custom extensions must be compatible with .NET 8, and customizations built in Web Designer must be rebuilt in the Angular portal.
2. ConductorOne
ConductorOne is a SaaS identity governance platform built on its Baton connector framework. Each connector syncs accounts and entitlements from an application for user access reviews and just-in-time access requests.
Connectors run in two modes: hosted by ConductorOne, or self-hosted in the customer’s environment. A self-hosted connector running in service mode on Kubernetes keeps a connection to ConductorOne and uploads access data at regular intervals.
When an administrator adds a connector, ConductorOne lists applications discovered in the organization’s identity, SSO, or federation provider that are not yet managed, and the connector can be attached to one of them.
Limitations:
- Provisioning support differs by connector. The Concur connector, for example, creates accounts but does not deprovision them; deprovisioning must be done in Concur.
- Several connectors are in beta; ConductorOne states that beta connectors may have limited feature support or incomplete error handling.
3. Idira (formerly CyberArk Identity Governance)
CyberArk entered the IGA market through its acquisition of Zilla Security in February 2025.2 Palo Alto Networks completed its acquisition of CyberArk in February 2026 and renamed the CyberArk platform Idira in May 2026. Existing CyberArk customers continue on the same platform under the new name.
AI Profiles are machine learning models that analyze existing permissions and suggest least-privilege access for each role. CyberArk states that Zilla customers spent 80% less effort on access reviews and opened 60% fewer provisioning tickets than with legacy IGA; these are vendor figures.3
The Identity Map shows entitlements of human and non-human identities across connected applications. Universal Sync uses robotic process automation to connect applications that lack standard APIs.
The platform lists 1,000+ prebuilt integrations and runs alongside CyberArk’s PAM products.
Limitations:
- IGA came to the platform through the 2025 Zilla acquisition, and the platform was renamed Idira in 2026; product names differ between older CyberArk and newer Palo Alto Networks documentation.
- Pricing combines PAM and IGA licensing, which adds complexity for organizations that need governance without PAM.
4. Lumos
Lumos uses an AI agent, Albus, to generate RBAC and ABAC policy recommendations from access patterns, role assignments, HRIS data, and usage logs.
In December 2025, Lumos launched Agentic User Access Reviews. Albus runs the first pass of a review campaign and separates commonly held, low-risk access from anomalies before human reviewers see the results. 4
Autonomous Policy Management, launched in April 2025, creates, updates, and enforces RBAC and ABAC policies using machine learning and AI agents.
Lumos also covers SaaS license management: it identifies unused licenses and shadow IT applications, which IT teams can reclaim or bring under governance.
Limitations:
- SAP entitlement governance, mainframe integration, and transaction-level SoD are not covered in Lumos documentation.
5. Microsoft Entra ID Governance
Microsoft Entra ID Governance is a governance add-on license for Entra ID P1 or P2.
Core capabilities include Entitlement Management, which bundles app roles, group memberships, and SharePoint permissions into access packages with defined approval workflows, expiration policies, and access reviews.5 Lifecycle Workflows automate joiner, mover, and leaver events using HR triggers from Workday and SuccessFactors. Privileged Identity Management (PIM) provides just-in-time activation of elevated roles in Entra ID and Azure.6
The Access Review Agent (preview) conducts reviews through Microsoft Teams in natural language, surfacing AI-generated recommendations and guiding reviewers to a decision without requiring them to navigate a separate portal.6
Entitlement management now supports access packages scoped to API permissions for agent IDs, covering AI agent governance within Microsoft’s ecosystem.5
Limitations:
- Applications outside Microsoft must be connected to Entra ID, for example through SCIM provisioning, before they can be governed.
- SoD checks in entitlement management work at the level of incompatible access packages and groups; they do not analyze permissions inside applications such as SAP.
- Governance features are split across Entra ID P1, P2, ID Governance, and Entra Suite licenses.
6. SailPoint Identity Security Cloud
SailPoint offers two IGA products: Identity Security Cloud (SaaS) and IdentityIQ (on-premises).
SoD and non-human identity governance are sold as separate modules. SoD runs through Access Risk Management (ARM). Service accounts, bots, and RPA identities require Machine Identity Security, and AI agents require Agent Identity Security.
In 2026, SailPoint added Agent Identity Security connectors for the SaaS versions of Salesforce, ServiceNow, and Snowflake, which discover AI agents running in those platforms.7
Limitations:
- SoD and non-human modules are paid add-ons; the base license does not reflect full deployment cost.
- IdentityIQ (on-premises) and Identity Security Cloud (SaaS) are separate products with different feature sets.
7. Okta Identity Governance
Okta Identity Governance (OIG) is a governance add-on to Okta’s workforce identity platform. It combines Lifecycle Management for provisioning, Okta Workflows for no-code automation, and Access Governance for certifications and access requests. Applications connected through the Okta Integration Network (8,000+ pre-built integrations) can be governed without building separate connectors.8
Governance Analyzer adds recommendations to certification campaigns based on sign-in frequency, last access date, and peer-group membership.9
Limitations:
- OIG requires Okta as the identity platform; it is not sold as a standalone IGA product.
- Lifecycle scenarios outside the built-in options require custom flows in Okta Workflows.
8. Ping Identity (PingOne Identity Governance)
PingOne Identity Governance is an add-on to PingOne Advanced Identity Cloud, Ping’s hosted identity platform. It covers access requests, access certifications, SoD policies, and entitlement aggregation from onboarded applications.10
Certifications can run on a schedule or be triggered by events. An event rule pairs a condition with an action; for example, creating a user in the system can automatically start a certification for that user.
Governance glossary attributes attach custom metadata, such as risk level or data classification, to applications, entitlements, and roles. Reviewers see this metadata during certifications, and scoping rules limit which users can view or act on specific applications, entitlements, or roles.
SoD policies are checked during access requests, and scheduled policy scans catch violations in existing access. Workflow nodes handle each violation by granting an exception, rejecting it, or removing the conflicting entitlements.
Limitations:
- Identity Governance runs only on PingOne Advanced Identity Cloud; organizations using other Ping products need an Advanced Identity Cloud tenant.
- Custom reports, near real-time reporting data, and 90-day retention for governance data require a paid reporting and analytics tier on top of standard IGA reports.
Add as preferred source9. Saviynt Identity Cloud
Saviynt Identity Cloud is a SaaS platform that combines IGA, PAM, and Application Access Governance in one product. There is no on-premises version.
SoD is included in the core platform, not a paid add-on as with SailPoint. The 2025 release redesigned the SoD dashboard and added out-of-the-box rulesets for SAP, Oracle, Salesforce, and NetSuite.11
Human, machine, and AI agent identities are governed within the same platform. In 2025, Saviynt expanded non-human coverage to workloads and credentials. Third-party and contractor identities are handled through a dedicated External Identity Management module.
Saviynt added SCIM server support in 2025, reducing the need for custom development for cloud application integrations.
Saviynt claims 75% automation of access review decisions and a 70% reduction in decision time. Both are vendor-stated figures; independent verification is not available.12
Customer reference: VF Corporation replaced its legacy manual platform with Saviynt to create a single identity platform across 12 brands. Ingredion’s CISO reported that access terminations became near-immediate and new hires received access on day one.12
Limitations:
- No on-premises option; organizations with data residency requirements need to confirm available hosting regions.
10. IBM Verify Identity Governance
IBM Verify Identity Governance models SoD around business activities, such as creating a purchase order or approving an invoice, instead of roles. IBM positions this model as closer to how auditors describe access risk, because business activities change less often than roles.13
IBM’s broader Verify platform includes Identity Threat Detection and Response (ITDR) and Identity Security Posture Management (ISPM) for human and non-human identities.13
Limitations:
- Non-human identity coverage is documented for the broader Verify platform (ITDR, ISPM), not for Verify Identity Governance specifically.
- The product was previously sold as IBM Security Identity Governance and Intelligence and IBM Security Verify Governance; older documentation uses those names.
11. Omada Identity
Omada Identity Cloud is a SaaS IGA platform. Omada sells a fixed-price Accelerator Package with a 12-week implementation timeline; this is a vendor commitment, not an independently measured result.
The Cloud Application Gateway (CAG) connects Omada Identity Cloud to systems hosted on-premises or in other clouds over outbound-only connections, so inbound firewall rules do not need to change. It runs data imports, provisioning jobs, schema discovery, and connection tests, uses mutual authentication, and receives over-the-air updates. Omada also supports site-to-site VPN; connector capabilities are the same in both models.
Omada documents lifecycle management, access certification, and risk analysis for human identities, non-human identities, and AI agents in the same platform.
Limitations:
- The 12-week Accelerator Package covers a defined scope (HR and Active Directory integration plus a limited number of business systems); additional systems fall outside the fixed timeline.
12. Oracle Identity Governance
Oracle offers two IGA products: Oracle Identity Governance (OIG) for on-premises deployment and Oracle Access Governance (OAG) as SaaS.
In a hybrid setup, access reviews run in OAG while provisioning continues through OIG 12c. Oracle states that OAG reduces access governance IT tickets by 70%.14
Oracle Identity Role Intelligence uses machine learning to mine roles from organizational structure, user attributes, and activity patterns, and publishes them to OIG.
Source: Oracle Identity Governance (OIG)
Access Guardrails in Oracle Access Governance apply SoD rules during access requests, blocking the request or allowing it for a defined period with conditional approval. For Oracle Fusion Cloud Applications, Access Governance passes approval decisions for SoD-flagged requests to Risk Management Cloud, so the entitlement does not need to be approved again there.
The OIG connector framework covers mainframe, LDAP, databases, Office 365, ServiceNow, Dropbox, Google Workspace, and WebEx. The IGA Integrations Exchange lists prebuilt connectors for both products.15
Customer reference: Cummins evaluated OAG for cloud-native governance, citing zero-migration from OIG 12c and insight-driven analytics as key factors.14
Limitations:
- OIG (on-premises) and Oracle Access Governance (SaaS) are separate products; hybrid deployments run access reviews in Access Governance and provisioning in OIG.
- Outside the Oracle ecosystem (Fusion, E-Business Suite), integration requires additional connector work.
Common Features
The 12 platforms in this list document the following core capabilities:
- Identity lifecycle (JML): Joiner-mover-leaver automation driven by HR data or role assignments, with automated provisioning and deprovisioning across connected systems.
- Access certification: Periodic access review campaigns with approval workflows for line-of-business managers or IT teams.
- SoD controls: Separation of duties enforcement through policy-based conflict detection. SailPoint sells SoD as a paid add-on (Access Risk Management); Saviynt includes it in the core platform.
- Role-based access control: Role mining, role modeling, and RBAC policy management.
- Self-service access requests: End-user portals for access requests with configurable approval workflows.
- Audit trails: Audit-ready logging and reporting are included in all platforms.
AI-Driven IGA
Several IGA vendors now apply AI in four areas: access recommendations, first-pass access reviews, risk-based response, and natural-language queries.
Access recommendations: Peer-group analysis compares a user’s access with that of colleagues in the same job function, location, and department. Access outside that pattern is flagged for review. SailPoint and Saviynt use this approach in certification recommendations.
Agentic access reviews: Lumos’s Albus agent and SailPoint’s Harbor Pilot run the first pass of a review campaign, separate commonly held access from anomalies, and give reviewers a filtered list. Lumos reports up to 6x faster campaign completion.
Risk-based response: One Identity Manager 10.0 imports user risk scores from third-party UEBA tools. Its ITDR playbooks disable accounts, flag incidents, or launch targeted attestation when a policy violation is detected.
Natural-language queries: SailPoint Harbor Pilot, One Identity Manager’s LLM-based reporting, and Saviynt’s MCP Server let administrators query identity data in natural language, for example: “Which users with access to financial systems have not logged in for 90 days?”
ConductorOne and Lumos describe themselves as “AI-native” or “autonomous” platforms, where AI takes actions instead of recommending them. In these platforms, audit logs of AI decisions and human approval of final access decisions are the points to check.
Top 8 IGA Use Cases
Employee onboarding: When a new hire appears in the HR system, IGA provisions birthright access (email, collaboration tools, and department applications) on or before the first day, without an IT ticket.
Role change: When an employee transfers from Finance to Engineering, IGA removes access tied to the old role and grants access required for the new one. Access that is not removed on role change accumulates, a pattern known as privilege creep.
Offboarding: When an employee leaves, IGA revokes access across connected systems immediately or on a defined schedule. Saviynt customer Ingredion reported that access terminations became near-immediate after deployment.
External workforce governance: Contractors, partners, and suppliers need time-limited access with renewal workflows. IGA enforces expiration dates and triggers re-approval before access extends, rather than leaving accounts active after a project ends.
Access certifications: Line-of-business managers periodically review their team’s application access and confirm it is still needed. Some platforms show last login date, peer-group comparisons, and risk scores next to each item.
Segregation of duties enforcement: IGA detects toxic combinations of access, such as the same user being able to both create and approve a purchase order, and either blocks the grant or flags it for review.
Non-human identity governance: Service accounts, RPA bots, API keys, and AI agents need owners, access reviews, and deprovisioning, like human identities. Coverage differs by vendor: SailPoint sells it as separate modules, while Saviynt and Omada include non-human identities in the same platform.
Compliance reporting: Auditors require evidence that access to regulated systems was limited to authorized users during a defined period. IGA produces access history reports, certification records, and SoD violation logs for SOX, GDPR, and HIPAA audits.
FAQs
Identity Governance and Administration (IGA) is a software category that manages the full lifecycle of user access to applications, systems, and data. It automates provisioning and deprovisioning, enforces access policies, runs access certification campaigns, and maintains the audit records required for compliance with regulations such as SOX, GDPR, and HIPAA.
IAM (Identity and Access Management) covers authentication and access control confirming who a user is and granting or denying access. IGA adds a governance layer: visibility into all access rights across the environment, policy enforcement, access review workflows, and compliance reporting. IGA systems work alongside IAM tools and address access accumulation and auditability problems that IAM alone cannot solve.
IGA stands for Identity Governance and Administration. In a government context, it refers to the same category of tools described above, applied to managing access to government systems, applications, and sensitive data in compliance with public sector regulations and frameworks.
Cite this research
Pick the format that matches where you're publishing. Pasting the link version into your CMS preserves the backlink.
@misc{dilmegani2026,
author = {Dilmegani, Cem},
title = {{IGA Solutions Compared: 12 Vendors with Features}},
year = {2026},
month = sep,
howpublished = {\url{https://aimultiple.com/iga-solutions}},
note = {AIMultiple. Retrieved September 29, 2026}
}Results and timestamps of 12 data points. Download the summary data shown in this article's charts and tables as a ZIP file containing one CSV file.
Want the granular data behind it? Join Premium
Changelog
2 updatesExpanded the introduction with a section on IGA vs IAM vs PAM.
Added One Identity Manager to the list of IGA solutions.
Reference Links
Cem's work at AIMultiple has been cited by leading global publications including Business Insider, Forbes, Morning Brew, and Washington Post, global firms like Deloitte and HPE, NGOs like World Economic Forum, and supranational organizations like European Commission. [1], [2], [3], [4], [5]
Throughout his career, Cem served as a tech consultant, tech buyer and tech entrepreneur. He advised enterprises on their technology decisions at McKinsey & Company and Altman Solon for more than a decade. He also published a McKinsey report on digitalization.
He led technology strategy and procurement of a telco while reporting to the CEO. He has also led commercial growth of deep tech company Hypatos that reached a 7 digit annual recurring revenue and a 9 digit valuation from 0 within 2 years. Cem's work in Hypatos was covered by leading technology publications like TechCrunch and Business Insider.
Cem regularly speaks at international technology conferences. He graduated from Bogazici University as a computer engineer and holds an MBA from Columbia Business School.
Be the first to comment
Your email address will not be published. All fields are required. Comments are left in their original language.