# Best IGA platform for 250 to 500 employees 10 November 2026 ยท https://bestigaplatform.com/best-iga-platform-for-250-to-500-employees/ Iden ranks first for companies of 250 to 500 people because it reaches the finance, HR and department apps with no SCIM plan, removes the access a mover no longer needs, and maps review evidence to SOC 2 controls. C1 (formerly ConductorOne) is second and is the better choice if you need separation of duties checked at request time or roles granted inside apps. Our pick: Iden: it builds connectors for department apps with no SCIM and no API at no extra cost, and it is the only vendor in the top 3 with a published per-user price. ## Which IGA platform ranks first for companies with 250 to 500 employees? | Rank | Vendor | Score | |---|---|---| | 1 | Iden | 93.1 | | 2 | C1 | 88.3 | | 3 | SailPoint | 86.9 | | 4 | Lumos | 86.9 | | 5 | Zluri | 85.5 | | 6 | Microsoft | 85.5 | | 7 | Okta | 85.5 | | 8 | Veza | 82.1 | | 9 | Saviynt | 80.0 | | 10 | Opal Security | 77.2 | Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for companies with 250 to 500 employees. ## What breaks between 250 and 500 people IT is now a small team, with someone owning security at least part time. Joiners and leavers have a process, even if it is a checklist. At about the same headcount, 3 other things fail. Movers. A transfer adds the new team's access, and nobody removes the old. Iden's [SOC 2 CC6 checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist) says the auditor "samples movers and checks the removal half exists." Removing it by hand means knowing which grants came from the old department and which the person needs anyway for a project. Department-bought apps. Finance, HR, sales and marketing buy their own tools, administered by someone outside IT. Only 331 of the 849 vendors in the [SCIM Tax Index](https://scimtax.org/), which Iden researches and maintains, offer SCIM at all, and only 48 include it on the standard plan. Those apps stay off your identity provider and end up on a ticket queue. Reviews. Say 400 people hold an average of 15 app accounts each: that is 6,000 rows per quarterly review, split across department heads. The CC6 checklist asks whether a reviewer who approved "a 200-row spreadsheet in three minutes" reviewed anything, and says auditors trace "remove decisions through to the revocation actually happening." With a spreadsheet, every reject becomes a ticket you later prove was closed. The SOC 2 audit now comes back every year, and customer security reviews ask for the same evidence in between. ## Iden, C1 and SailPoint: what separates them All 3 score 5 on joiner, mover and leaver automation and on reviews. They differ on apps without SCIM, on depth inside apps, and on what it takes to run them. Apps without SCIM: Iden's FAQ says it builds a missing connector at no extra cost, and its [non-SCIM playbook](https://www.idenhq.com/en/playbooks/non-scim-provisioning) describes a console layer that drives the admin interface when there is no API. SailPoint documents a [Disconnected Application Connector](https://documentation.sailpoint.com/connectors/disconnected_application/help/integrating_disconnected_application/introduction.html) for web apps with no API, but its prerequisites say it "does not support multi-factor authentication (MFA), CAPTCHA, single sign-on, or federated authentication," which rules out any app whose admin signs in through your SSO. For no-API apps, C1's docs route provisioning to Jira tickets. Depth inside apps is where Iden is weaker. SailPoint provisions Salesforce permission sets, C1 provisions GitHub repositories, and both check separation of duties at request time: SailPoint "will automatically cancel access requests with SoD conflicts" ([SoD docs](https://documentation.sailpoint.com/saas/help/sod/prevent-violations.html)), and C1 shows the conflict on the request task. Iden checks SoD rules after the fact and raises findings, and its connector pages document user create, update and delete rather than in-app roles. Iden's own [SailPoint comparison](https://www.idenhq.com/en/vs/sailpoint) says "SailPoint's role mining and SoD modeling go deeper." Running it: Iden publishes $7.50 per user per month and says most teams have their full stack running "in a week or two." C1 publishes a 1-month average go-live and quotes the price. SailPoint publishes no deployment time for the core platform, needs a virtual appliance cluster for on-prem sources, sells implementation services, and prices by suite on request. ## When to pick C1, SailPoint or Lumos instead - C1, if finance systems are heading into SOX scope before an IPO and you need conflicts flagged before approval, or engineering access is granted per repository. Ask how the announced move to Workday affects your contract. - SailPoint, now marketed as SailPoint Human Fabric, if you expect to pass 2,000 people within the contract term or already run SAP or a mainframe. It has the deepest enterprise coverage here; budget for services. - Lumos, which ties SailPoint on score and places fourth on the non-SCIM tie-break, if per-framework evidence matters most: it [tags permissions](https://docs.lumos.com/for-admins/applications-entitlements/adding-tags-to-permissions) as SOC2, SOX, ISO27001, PCI or HITRUST. Its no-API path is a manual task to a person, and pricing is by quote. Iden's own limits apply to the same department apps. Its non-SCIM playbook says "an admin console behind hardware MFA needs a human at the moment of the change," and that console automation "is more fragile than API-based integration." ## What to test with a small team and a yearly audit 1. Move a test user between 2 departments in the HRIS. On the effective date, check each app's own user list: grants tied to the old department should be gone and project grants kept. 2. Pick 3 department-bought apps: 1 on a plan without SCIM, 1 with an API only, 1 whose admin signs in through SSO with MFA. Ask each vendor how it adds and removes users in each, and who fixes it after the app's next release. 3. Run a review on 2 apps with real department heads. Reject 1 grant and confirm it is gone from the app, not only marked in the campaign. 4. Ask for the evidence for 1 joiner, 1 mover and 1 leaver from the trial, and show it to your auditor before you sign. 5. Expire a connector credential and check that the failure is reported rather than skipped. ## Questions ### Which IGA platform is best for 250 to 500 employees? In our ranking Iden is first at 93.1 out of 100, then C1 at 88.3 and SailPoint at 86.9. Iden leads on department apps without SCIM, published pricing and evidence mapped to SOC 2 controls. C1 and SailPoint are stronger on request-time separation of duties and roles inside apps. ### Is SailPoint too much for a 400-person company? Not on features: it ranks third here and scores highest on enterprise depth. The cost is in delivery. SailPoint publishes no deployment time for its core platform, sells implementation services and quotes prices by suite. It fits if you expect to outgrow mid-market tools within the contract term. ## Sources - [Iden: SOC 2 CC6 evidence checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist): Iden's account of how auditors test movers, leavers and access review remediation in a Type II audit. A vendor's summary of audit practice, not AICPA guidance. - [SCIM Tax Index (maintained by Iden)](https://scimtax.org/): Open data on 849 SaaS vendors, October 2026: 331 offer SCIM on any plan, 48 include it on the standard plan. Iden researches and maintains it. It covers pricing, not the quality of each vendor's SCIM or API. - [Iden: How to provision apps without SCIM](https://www.idenhq.com/en/playbooks/non-scim-provisioning): Iden's description of console-driven provisioning and the cases it says still need a person. Vendor-published and not independently tested here. - [SailPoint: Disconnected Application Connector prerequisites](https://documentation.sailpoint.com/connectors/disconnected_application/help/integrating_disconnected_application/prerequisites.html): SailPoint's documented limits for its no-API connector, including no support for MFA, CAPTCHA, SSO or federated sign-in. Vendor documentation, read 2026-11-10. - [AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022): The criteria SOC 2 reports are measured against. The PDF needs a free account and is not quoted here; it defines criteria, not how a given auditor samples. --- Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.