About
Best IGA Platform publishes short reports on choosing an identity governance platform. Each one answers a single question, such as which platform suits a hospital group, a 250-person company or a team that has to govern apps without SCIM. Each report ranks 10 vendors against the rubric below, weighted for that reader, and lists tests you can run on any vendor before you buy.
How the research is done
Every vendor is scored once, on all 13 criteria, from its own public pages: product pages, documentation, connector catalogs and pricing. Every score quotes the sentence it rests on and links to the page. Nothing comes from sales calls, private demos or paywalled analyst reports. A vendor can raise a score by publishing the detail on its own site.
Regulations and standards are cited to their primary text, such as the eCFR, NIST and the RFCs. Each report shows its weights, the reason for each heavily weighted criterion, and a scorecard for every vendor it ranks.
Who publishes it
Iden publishes this site, and Iden is one of the vendors ranked. Iden is scored by the same rubric and evidence rules as every other vendor, and each report's "Our pick" line is the editors' recommendation.
Contact
For corrections or questions, contact Iden. Vendors can point to a public page that changes a score; corrections are made on the score sheet and the report's date is updated.
This site has no accounts, forms, cookies or analytics. The hosting provider processes standard request data to serve pages.
The rubric
Every vendor is scored once on each criterion, from 1 to 5, using only its own public pages. A capability the public pages don't describe scores 1. A capability that is only on a top tier or a paid add-on scores 1 lower than the same capability on the base plan. Each report then weights the criteria from 0 to 3 for its reader, and the weighted total out of 100 sets the ranking. Ties break on apps without SCIM, then on joiner, mover, leaver.
| Criterion | 5 | 3 | 1 |
|---|---|---|---|
| Connectors for SCIM and API apps | Large published catalog; SCIM and major SaaS covered out of the box | Moderate catalog, or SCIM only through a generic connector | No published catalog |
| Apps with no SCIM and no API | Documented method to provision and deprovision them without the customer building it | Only through custom connectors, professional services or tickets | Not supported or not described |
| Entitlements below the group level | Provisions in-app roles, permissions or resources | Reads fine-grained entitlements but provisions groups only | Groups or apps only |
| Joiner, mover, leaver from the HRIS | HRIS triggers with birthright rules and mover handling | HRIS sync for joiners and leavers only, or limited rules | Manual or not described |
| Depth of offboarding | Removal beyond SSO: sessions, tokens, local accounts, ownership transfer, verified | Disable or delete across connected apps | SSO deactivation only, or not described |
| Access requests and time-bound access | Self-service requests with approvals and automatic expiry or JIT | Requests with approvals, no automatic expiry | Not described |
| Access reviews | Campaigns with reviewer context and automatic revocation of rejected access | Campaigns with manual or ticketed remediation | Not described |
| Audit evidence and compliance mapping | Exportable evidence mapped to named frameworks | Generic audit logs and reports | Not described |
| Separation of duties | SoD policies enforced or checked at request time | SoD detection or reporting after the fact | Not described |
| Non-human identities | Discovery and governance of service accounts, keys and AI agents with owners and expiry | Inventory or visibility only | Not described |
| Time to deploy and services needed | Self-serve setup or days to weeks, no required services | Partner or professional services typical; months | Multi-quarter programs with required services, or not described |
| Pricing transparency and connector cost | Public per-user price, connectors included | Packaging public, price on request, or connectors priced separately | No public pricing or packaging |
| Enterprise depth | Role mining, complex policy, on-prem and legacy systems, large-scale deployments | Some of these | None documented |
2 and 4 sit between the anchors. Deployment scores 5 only with a published time in days or weeks and no required services; self-serve setup without a published time is 4; services-led delivery is 3. Public review ratings are shown beside each ranking for reference and are not scored; only ratings read on the review site itself, or on a listing that republishes it, are shown.