# Best IGA platform for 100 to 250 employees 10 November 2026 ยท https://bestigaplatform.com/best-iga-platform-for-100-to-250-employees/ Iden ranks first for companies of 100 to 250 people because it covers apps with no SCIM and no API without your team building the connector, publishes its price, and says most teams have their full stack running in a week or two. C1 (formerly ConductorOne) is second, and is the better choice if you need separation of duties checked at request time or access granted per GitHub repository. Our pick: Iden: a published $7.50 per user per month, a stated week or two to connect the full stack, and connectors built at no extra cost for apps with no SCIM and no API. ## Which IGA platform ranks first for companies with 100 to 250 employees? | Rank | Vendor | Score | |---|---|---| | 1 | Iden | 96.0 | | 2 | C1 | 89.6 | | 3 | Okta | 88.0 | | 4 | Lumos | 86.4 | | 5 | Microsoft | 86.4 | | 6 | Zluri | 84.8 | | 7 | SailPoint | 84.0 | | 8 | Veza | 82.4 | | 9 | Saviynt | 77.6 | | 10 | Opal Security | 76.0 | Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for companies with 100 to 250 employees. ## What a 1 or 2 person IT team is up against At this size IT is usually the first IT hire, or 2 people who also run laptops, the help desk and the office network. Joiners arrive every week. SSO is in place, and most apps are mainstream SaaS on whatever plan was cheapest when the company had 40 people. The first SOC 2 Type II is on the calendar. Two lines in Iden's [SOC 2 CC6 checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist) decide how that audit goes. The access audit "is decided in the first month of the observation window, not in the 6 weeks before fieldwork," and the auditor "samples a leaver and then deliberately picks an app that isn't in your SSO." Disabling the leaver in the identity provider doesn't reach that app. If the app uses SAML with just-in-time provisioning, Iden's [FAQ](https://www.idenhq.com/en/faq) adds that it "creates an account on first login but never deletes it, so people keep access after they leave." SCIM is the usual fix, and it is usually priced above the plan you have. The [SCIM Tax Index](https://scimtax.org/), which Iden researches and maintains, found 331 of 849 SaaS vendors offering SCIM on any plan, and 278 of those charging extra for it. With illustrative prices, 4 apps that each add $10 per seat per month for SCIM cost $72,000 a year at 150 seats, only so your identity provider can provision those 4 apps. ## Iden, C1 and Okta at this size On HRIS-driven joiners and leavers and on access reviews the 3 are level. They split on the apps outside each catalog, on price and on time to go live. Iden's FAQ says a missing connector gets built "usually in 48 hours, at no extra cost," over SCIM, an API or its custom automation framework, so an app with neither still gets covered. It lists the price at $7.50 per user per month with every connector included, and says the first 15 apps "connect in under an hour." Iden is weaker on breadth: its catalog is smaller than C1's or Okta's, and the per-app connector pages we checked document creating, updating and removing users, not writing roles inside the app. C1 is stronger on catalog and depth. Its [integrations page](https://www.c1.ai/integrations) lists 400+ out-of-the-box connectors, it provisions GitHub repositories, and it checks separation of duties when access is requested. It publishes "one month average time to go live" on its [modern IGA page](https://www.c1.ai/lp/modern-iga). For an app with no API, its docs route the work to a person: C1 "automatically creates Jira tickets to track provisioning assignments" ([external ticketing](https://www.c1.ai/docs/product/admin/external-ticketing)). The price is "scoped with you." Okta Identity Governance is the natural option if Okta already runs your SSO. Okta's [pricing page](https://www.okta.com/pricing/) lists the Essentials suite, which includes Lifecycle Management and Access Governance, from $17 per user per month, with a $1,500 annual contract minimum. Apps without SCIM go through its [on-premises provisioning agent](https://help.okta.com/oie/en-us/content/topics/provisioning/opp/opp-main.htm) with "a SCIM server or custom connectors" that you supply. Okta's own figure on its [governance page](https://www.okta.com/products/identity-governance/) is that "around half are live within 6 months." ## When to pick C1, Okta or Entra instead - You already pay for Okta and nearly every app has SCIM on the plan you are on. Count first: if the apps outside SCIM are 2 or 3 and you can remove those users by hand, adding governance to the identity provider you run is simpler than a second vendor. - You run Microsoft 365 with Entra ID P1 or P2. Microsoft lists Entra ID Governance at $7 per user per month on its [pricing page](https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing). Check the apps with their own user database first; Microsoft's [integration guide](https://learn.microsoft.com/en-us/entra/id-governance/identity-governance-applications-integrate) says you "may need to manually update the application's internal database or directory" for them. - You need 2 kinds of access, such as creating and approving payments, flagged before anyone approves the second, or you grant access per repository. C1's [access conflict monitors](https://www.c1.ai/docs/product/admin/access-conflicts) show a conflict on the request before anyone approves it. Its site also says C1 is to join Workday, so ask how that changes contract terms. ## What to test on a 2-week trial 1. Before the trial, list every app from SSO, card statements and the expense tool, and mark the ones without SCIM on your plan. Send that list to each vendor and ask which they cover today and who builds the rest. 2. Run the auditor's sample yourself: offboard a test user, then pull the user list of an app outside SSO. The tool's log shows what it attempted; the app's own list is what the auditor checks. 3. Hire a test user in the HRIS and follow the trail to each grant. Iden's checklist says the auditor wants "a continuous trail from HRIS event to access grant in target system." 4. Export the evidence for that joiner and leaver and send it to your auditor or compliance platform before you sign. 5. Log your hours. With 1 person in IT, setup time is the cost the per-user price doesn't show. ## Questions ### Which IGA platform is best for 100 to 250 employees? In our ranking Iden is first at 96.0 out of 100, followed by C1 at 89.6 and Okta Identity Governance at 88.0. Iden leads on apps without SCIM or an API, a published per-user price, and a deployment time a 1 or 2 person IT team can absorb. ### When should a 150-person company set up IGA for SOC 2? Before the Type II observation window opens. Joiner, leaver and review evidence has to be recorded while the window runs, and Iden's CC6 checklist says the audit is decided in its first month. A tool switched on mid-window leaves a gap you fill with spreadsheets. ## Sources - [Iden: SOC 2 CC6 evidence checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist): Iden's account of how auditors test logical access across a Type II observation window, including sampling leavers in apps outside SSO. A vendor's summary of audit practice, not AICPA guidance. - [SCIM Tax Index (maintained by Iden)](https://scimtax.org/): Open data on 849 SaaS vendors, October 2026: 331 offer SCIM, 278 of those charge extra for it. Iden researches and maintains it. It covers pricing, not the quality of each vendor's SCIM. - [Iden FAQ](https://www.idenhq.com/en/faq): Iden's pricing, connector, deployment-time and trial claims, and its note on SAML just-in-time accounts. Establishes what Iden says, not measured results. - [AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022): The criteria SOC 2 reports are measured against. The PDF needs a free account and is not quoted here; it defines criteria, not how a given auditor samples. --- Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.