Best IGA platform for apps without SCIM
Governing apps with no SCIM, or SCIM on a plan you don't pay for: the SCIM tax, scoring an app's API, and the 3 ways to cover the rest.
On this page
The short answer
Iden ranks first for apps without SCIM because it is the only vendor here to score 5 on apps with no SCIM and no API, and every connector, including ones it builds on request, is in a published per-user price. Okta is second, and the better choice if you already run Okta and your non-SCIM apps are SaaS with an OpenAPI spec.
Our pickIden: the only vendor here that builds and maintains connectors for apps with no SCIM and no API at no extra cost, with every connector included in a published per-user price.
Which IGA platform ranks first for apps without SCIM?
Iden ranks first with 93.8 out of 100, followed by Okta (86.3) and C1 (83.8). 10 vendors are scored on the published 13-criterion rubric, weighted for apps without SCIM.
| Rank | Vendor | Score bar | Score |
|---|---|---|---|
| 1 | Iden | 93.8 | |
| 2 | Okta | 86.3 | |
| 3 | C1 | 83.8 | |
| 4 | Microsoft | 83.8 | |
| 5 | SailPoint | 82.5 | |
| 6 | Zluri | 81.3 | |
| 7 | Saviynt | 77.5 | |
| 8 | Lumos | 77.5 | |
| 9 | Veza | 76.3 | |
| 10 | Opal Security | 73.8 |
How this ranking is weighted
Every vendor gets the same score on each criterion in every report. What changes is the weight: 3 matters most for this reader, 0 is left out. The full scoring guide is on the About page.
| Criterion | Weight | Why it matters here |
|---|---|---|
| Connectors for SCIM and API apps | ||
| Apps with no SCIM and no API | This is the question the report answers. | |
| Entitlements below the group level | ||
| Joiner, mover, leaver from the HRIS | ||
| Depth of offboarding | ||
| Access requests and time-bound access | ||
| Access reviews | ||
| Audit evidence and compliance mapping | ||
| Separation of duties | ||
| Non-human identities | ||
| Time to deploy and services needed | ||
| Pricing transparency and connector cost | Connector fees and SCIM-tier upgrades decide what governing these apps costs. | |
| Enterprise depth |
Scores on the criteria weighted most
| Vendor | Apps with no SCIM and no API | Pricing transparency and connector cost | Total |
|---|---|---|---|
| Iden | 5 | 5 | 93.8 |
| Okta | 3 | 5 | 86.3 |
| C1 | 3 | 3 | 83.8 |
| Microsoft | 3 | 5 | 83.8 |
| SailPoint | 4 | 3 | 82.5 |
| Zluri | 4 | 2 | 81.3 |
| Saviynt | 4 | 3 | 77.5 |
| Lumos | 3 | 1 | 77.5 |
| Veza | 3 | 3 | 76.3 |
| Opal Security | 3 | 3 | 73.8 |
Scores are out of 5. The scores, weights and evidence for every report can be downloaded as JSON or CSV.
The SCIM tax puts more apps in this group than you expect
This group includes apps where SCIM exists on a plan you don't pay for. The SCIM Tax Index, which Iden researches and maintains, found in October 2026 that 331 of 849 surveyed SaaS vendors offer SCIM, and 278 of those 331 (84%) charge extra for it through a higher plan, an add-on or a sales call. 218 don't publish the price. Iden sells the alternative, so check its vendor rows against the vendors' own pricing pages.
The upgrade applies to every seat. With illustrative prices, 150 seats on a $12 plan cost $21,600 a year; if SCIM is only on the $30 plan, the same seats cost $54,000, so provisioning that 1 app costs $32,400 a year. And RFC 7643 specifies "no vocabulary or syntax" for entitlements, so the integration you paid for may switch the account on and off without touching the module permission you care about.
Before shortlisting anything, score each app's API on 4 operations: list users and roles, create a user with a role, change a role, and disable or remove a user. Some APIs create users but can't remove them, which gives you automated joiners and manual leavers. Anything below 4 has 3 options. A ticket to the app admin suits an app with 15 users and 2 changes a year, but the ticket records a request, not a result. An in-house script is cheap until the app ships an update and it fails without telling anyone. A vendor connector moves that upkeep to someone under contract, and this ranking mostly measures who will carry it for you.
How Iden, Okta and C1 compare
The gap is in the method for apps with no API. Okta's documented route is its On-Premises Provisioning agent with "a SCIM server or custom connectors" you supply, or request tasks sent to Jira or ServiceNow. Its on-demand connectors, announced on 10 September 2026, are built "in as little as 48 hours" at no additional cost, but only for SaaS apps with an OpenAPI spec that is public or that you share with Okta. C1's custom connectors need an API that can "list users or members," and for the rest it creates Jira tickets. Its integrations page says its no-code connectors reach legacy apps "even without an available API," but no doc found describes provisioning through them. Iden's non-SCIM playbook describes a console layer that logs in as an admin service account and makes the change the way an admin would, and its FAQ says Iden builds a missing connector "usually in 48 hours, at no extra cost."
Iden and Okta both publish per-user prices and include connectors. C1 publishes its packaging and scopes the price with you.
Okta and C1 are stronger on what a connector writes. Okta's Entitlement Management exchanges entitlements with provisioning-enabled apps, and C1's GitHub connector provisions repository permissions. Iden's llms.txt claims channel, repository and module-level access, but its GitHub connector page lists user changes and group membership reads, with no repository grant. Given RFC 7643, ask Iden to show the in-app role being set, not just the account.
When another vendor fits better
- Okta, if you already run Okta for workforce identity, your awkward apps are SaaS with an OpenAPI spec, and you want entitlements set inside the app by policy.
- Microsoft Entra ID Governance, tied with C1 on score, if the apps without SCIM are on-prem with a SQL or LDAP back end. Its connector host imports existing ECMA2 connectors. For apps with their own directory and no provisioning, Microsoft's integration guide says you "may need to manually update" the app's own database or directory.
- C1, if your engineers would rather write and own connectors for in-house apps that have an API, and you also want SoD conflicts shown on access requests.
- SailPoint, Zluri or Saviynt, if the no-API method matters more to you than price. Each documents a vendor-supplied route and scores 4 on it, and the biggest single reason they rank lower here is that none publishes a per-user price. SailPoint's Disconnected Application Connector records browser steps but excludes apps behind MFA, CAPTCHA or SSO. Zluri's Universal Identity Connector works "through application interfaces." Saviynt's app onboarding uses a computer-use agent.
Iden's playbook calls the UI-driven layer "more fragile than API-based integration," says an admin console behind hardware MFA needs a person at the moment of the change, and treats an app whose terms forbid automated access as a contract problem first. The same page says an app with only a database someone edits by hand has nothing for Iden to automate.
What to test before you buy
- Bring your 3 hardest apps to every trial, including 1 with no API and 1 whose admin console is behind your SSO and MFA.
- For each, write down the method the vendor uses (SCIM, API, console automation, file or ticket) and which of the 4 operations it performs.
- Request a connector for an app not in the catalogue. Record who builds it, what it costs and how long it takes.
- Rename a role inside a connected app and see whether the next run fails visibly or carries on.
- Remove a user, then pull the app's own user list and role table the next day.
- Ask where each connector's admin credential is stored and when it was last rotated.
Scorecards
Each score, the reason for it and the page it rests on. Every score comes from the vendor's own public pages.
1Iden93.8
Iden is an identity governance (IGA) platform that automates onboarding, offboarding, access requests and access reviews across SaaS, internal and legacy apps, including apps without SCIM or an API. It runs alongside an existing SSO (Okta, Entra, Google Workspace, JumpCloud) rather than replacing it. idenhq.com
| Connectors for SCIM and API apps | Iden publishes 176 per-app connector pages across 14 categories and provisions any SCIM app out of the box, with major SaaS such as Slack, Salesforce, Google Workspace, GitHub and AWS listed. The catalog is smaller than the 300 to 400 connector libraries some peers publish. [1] [2] | |
| Apps with no SCIM and no API | Iden documents a vendor-built method for apps with no SCIM and no API: console automation that drives the admin UI, plus custom connectors that Iden builds and maintains at no extra cost, so the customer does not build them. [1] [2] | |
| Entitlements below the group level | Iden summary pages claim channel-, repository- and project-level provisioning, but the published capability tables for GitHub, Slack and Salesforce list user create, update and delete plus read-only groups or group membership. Public pages do not describe any connector writing an in-app role, repo or channel grant, so provisioning is documented only at the user and group level. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Iden documents an HRIS-triggered joiner plan built before the start date from department, title, manager and employment type (birthright), a mover recompute that removes grants tied to the old department, and leaver workflows. [1] [2] [3] | |
| Depth of offboarding | Offboarding goes beyond SSO: session revocation, data and ownership transfer before deletion, a record of how each account closed, and an offboarding that stays open until every account is closed, as a verification step. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests in Slack or Teams go to the owner for approval, and grants expire automatically: time-boxed, tied to a task, or break-glass. [1] [2] [3] | |
| Access reviews | Campaigns give reviewers context such as HR employment status, last use and capability descriptions, and revocation runs from the review decision. [1] [2] [3] | |
| Audit evidence and compliance mapping | Review and finding evidence is exportable and mapped to named controls: SOC 2 CC6.1 to CC6.3, ISO 27001 A.9 and A.5.18, and HIPAA. [1] [2] | |
| Time to deploy and services needed | Iden publishes a deployment time in days to weeks with no systems integrator, and offers a 2-week trial. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price, with every connector included, non-SCIM and custom connectors among them. [1] [2] |
2Okta86.3
Okta Identity Governance (OIG) is the IGA product from Okta, made of Lifecycle Management, Workflows and Access Governance (access requests, access certifications, entitlement management, separation of duties) on top of the Okta workforce identity platform. Okta positions it as security-driven governance for the modern enterprise and sells it inside its Essentials suite and above or as an add-on. okta.com
Public ratings (not scored): PeerSpot (Okta Platform, all modules) 4.3 (127 reviews)
| Connectors for SCIM and API apps | The Okta Integration Network lists 8,000+ integrations, 969 of them tagged Lifecycle Management, and Okta states SCIM provisioning for thousands of apps out of the box. [1] [2] [3] | |
| Apps with no SCIM and no API | Apps without SCIM or an API are reached through the On-Premises Provisioning agent with a SCIM server or custom connectors the customer supplies, or through request tasks routed to Jira or ServiceNow. The new on-demand connectors still need the app to publish an OpenAPI spec, so public pages do not describe a path for apps with no API that the customer does not build. [1] [2] [3] | |
| Entitlements below the group level | Entitlement Management stores app entitlements in Okta, assigns them by policy and exchanges them with downstream apps that have provisioning turned on, so in-app permissions below the group level are provisioned, not just read. [1] [2] | |
| Joiner, mover, leaver from the HRIS | The HRIS (Workday, BambooHR, SuccessFactors) is the source of truth with real-time triggers, birthright app provisioning, and explicit mover handling that removes old permissions. [1] [2] [3] | |
| Depth of offboarding | Deactivation deprovisions the user from assigned apps and ends Okta sessions, and a Workflows template transfers Google Drive ownership. Session and token revocation in apps (Universal Logout) sits in Identity Threat Protection, an add-on below the Professional suite, and public pages do not describe a step that verifies offboarding is complete. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests from the dashboard, Slack or Teams go through multi-step approval sequences, and conditions set a duration after which access is revoked automatically. [1] [2] | |
| Access reviews | Certification campaigns revoke access automatically on the reviewer decision, and Governance Analyzer shows reviewers usage history, past decisions, SoD conflicts and how access was assigned. [1] [2] | |
| Audit evidence and compliance mapping | Okta documents campaign and request reports covering 3 years of closed campaigns, plus System Log events, and names SOC2 and SOX as goals. Public pages do not describe an evidence export mapped to named framework controls. [1] [2] | |
| Time to deploy and services needed | Okta offers a self-serve trial and admin-console setup with no required services and publishes deployment times, but its own figures show about a quarter of customers live within 30 days and the median customer taking up to 6 months. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price: Essentials at $17/user/month includes Lifecycle Management and Access Governance, and OIN connectors and the new on-demand connectors carry no extra fee. Billing is annual, with a $1,500 annual minimum and Workflows flow caps by suite. [1] [2] [3] |
3C183.8
ConductorOne now trades as C1 (c1.ai; conductorone.com now serves c1.ai), and its site banner announces that C1 is to join Workday. C1 is an identity platform covering identity governance (lifecycle, access requests and JIT, access reviews, SoD) alongside AI agent, MCP and secrets products for IT, security, IAM and compliance teams. c1.ai
Public ratings (not scored): G2 (via Toolradar aggregator) 4.8 (13 reviews)
| Connectors for SCIM and API apps | C1 publishes a library of 400+ out-of-the-box connectors, with about 400 connector docs pages, plus a configurable SCIM connector. [1] [2] | |
| Apps with no SCIM and no API | Apps with an API can be covered by HTTP and SQL connectors the customer configures, the Baton SDK, or AI-built custom connectors, which are in early access, sync only and need an API that lists users. For apps with no API, the documented path is file-based sync plus tickets in an external ITSM; the marketing FAQ says no-API legacy apps can be integrated, but public pages do not describe provisioning or deprovisioning them without tickets. [1] [2] [3] | |
| Entitlements below the group level | Requests and provisioning work at resource level, such as groups, repos and roles within an app, and the GitHub v2 connector provisions repository permissions. [1] | |
| Joiner, mover, leaver from the HRIS | The HRIS or IdP directory is the source of truth, with user created and updated triggers, birthright access profiles, automatic re-enrollment when a mover starts matching a different profile, and revocation for leavers. [1] [2] | |
| Depth of offboarding | Leaver automation revokes entitlements across connected apps and opens a review campaign for any access that remains, as a verification step. Connector actions include signing out all sessions, revoking OAuth tokens and transferring Drive and Calendar ownership in Google Workspace. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests from web, Slack, Teams or CLI go through approval policies with a max request duration, after which C1 revokes the grant automatically, and there is an emergency access path. [1] | |
| Access reviews | Campaigns give reviewers insights such as peer access, risk level and recommendations, and revocation can run automatically after the campaign. [1] [2] | |
| Audit evidence and compliance mapping | Campaign reports export with verifiable file hashes, alongside conflict-monitor reports and logs that can be exported to a SIEM. Campaigns can be scoped by a compliance framework attribute, but its values are tags the customer creates rather than a built-in framework mapping, and SOX and ISO 27001 are named only in the SoD context. [1] [2] [3] | |
| Time to deploy and services needed | C1 publishes go-live in weeks, 1 month on average, with guided agentic onboarding; deployment experts are offered but not stated as required. [1] [2] | |
| Pricing transparency and connector cost | No public price, but packaging is public: SKU-based Platform or usage-based Flex pricing, Pro and Advanced platform levels, program size by managed identities, and named modules (Lifecycle, Access, Comply). Exact pricing is quoted per customer. [1] [2] |
4Microsoft83.8
Microsoft Entra ID Governance adds entitlement management (access packages), access reviews, lifecycle workflows, privileged identity management and app provisioning to a Microsoft Entra ID tenant. It is sold as a per-user add-on for Entra ID P1/P2 customers and is also bundled in Microsoft Entra Suite and Microsoft 365 E7. microsoft.com
Public ratings (not scored): PeerSpot 3.9 (14 reviews)
| Connectors for SCIM and API apps | Microsoft publishes a gallery of preintegrated provisioning connectors, which it describes as hundreds of apps rather than thousands, plus generic SCIM 2.0 support. [1] [2] | |
| Apps with no SCIM and no API | Non-SCIM on-prem apps can be reached through the provisioning agent and ECMA connector host (SQL, LDAP or imported ECMA2 connectors), which the customer configures or builds. For apps with their own directory and no provisioning integration, Microsoft says removals may have to be done manually. [1] [2] [3] | |
| Entitlements below the group level | Access packages can assign application app roles, Teams and SharePoint sites below the group level, and SAP IAG business roles in preview. Otherwise in-app permissions depend on the app exposing app roles or groups, and public pages do not describe a general entitlement discovery and exchange model like a dedicated entitlement catalog. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Entra documents HR-driven inbound provisioning from Workday and SuccessFactors, lifecycle workflows for joiners, movers and leavers, and attribute-based automatic assignment policies for birthright access. [1] [2] [3] | |
| Depth of offboarding | Leaver workflow tasks disable the account, revoke all refresh tokens, remove groups, Teams, licenses and access packages, and delete the user, while provisioning removes accounts downstream. Content and ownership transfer is left to the app or custom Logic Apps extensions, and public pages do not describe a step that verifies offboarding is complete. [1] [2] [3] | |
| Access requests and time-bound access | Users request access packages through self-service with multi-stage approvals, and policies make assignments time-limited so they expire automatically; PIM adds time-bound role activation. [1] [2] | |
| Access reviews | Recurring reviews come with smart recommendations and inactive-user decision helpers, and denied access is removed automatically when auto-apply is turned on. [1] [2] [3] | |
| Audit evidence and compliance mapping | Access review history and audit logs can be downloaded, and Microsoft publishes guidance mapping Entra governance controls to named frameworks (PCI DSS requirement 7, NIST, FedRAMP). That mapping is guidance, not an evidence export tagged by framework. [1] [2] | |
| Time to deploy and services needed | Setup is self-serve in the tenant with no required services, but Microsoft does not publish a typical deployment time. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price of $7/user/month standalone, billed annually, on top of a required Entra ID P1 ($7) or P2 license. Gallery and on-prem provisioning connectors are included from P1, not priced per connector. [1] [2] [3] |
5SailPoint82.5
SailPoint Identity Security Cloud is a SaaS identity governance platform for large enterprises covering lifecycle provisioning, access requests, certifications, separation of duties and machine and AI-agent identities. SailPoint now markets it as SailPoint Human Fabric, which it describes as the evolution of Identity Security Cloud, sold in Agentic Standard, Agentic Business and Agentic Business Plus suites. sailpoint.com
Public ratings (not scored): PeerSpot 4.1 (72 reviews)
| Connectors for SCIM and API apps | SailPoint publishes a large connector catalog (deep governance, quick compliance and discovery connectors, covering SaaS such as GitHub, Salesforce, Workday, Okta and Entra ID) plus a SCIM 2.0 source that manages any SCIM 2.0 compliant system. [1] [2] [3] | |
| Apps with no SCIM and no API | SailPoint supplies a Disconnected Application Connector that provisions accounts to web apps with no API by recording browser operations, plus an RPA connector for apps without modern APIs. The connector does not work with apps behind SSO, MFA or federated sign-in, and the RPA route depends on an RPA platform the customer already runs. [1] [2] [3] | |
| Entitlements below the group level | Connector docs show provisioning of in-app objects below the group level, such as adding and removing Salesforce permission sets, permission set groups, roles and managed packages, and GitHub teams as entitlements. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Public docs describe HR-driven lifecycle states (pre-hire, active, leave of absence, terminated), birthright roles, and mover handling that removes access granted by role criteria when an identity no longer matches. [1] [2] [3] [4] | |
| Depth of offboarding | Beyond account disable or delete, a terminated lifecycle state can revoke roles, access profiles and entitlements across all sources, and SailPoint can publish Session Revoked (Shared Signals) events when an identity enters a lifecycle state. Public pages do not describe ownership transfer or token cleanup when someone leaves. [1] [2] | |
| Access requests and time-bound access | Self-service requests with approvals can require an end date and maximum duration, and Just-In-Time (Privilege on Demand) access is removed when the activation period ends. Time-bound requests are in the core docs, while the suites page places JIT provisioning for elevated access in Agentic Business and above. [1] [2] [3] | |
| Access reviews | Certification campaigns revoke rejected access automatically on direct-connect sources, and reviewers can see activity data such as days active in the last 90. Activity data needs Activity Insights connectors, which SailPoint says to arrange through the CSM. [1] [2] | |
| Audit evidence and compliance mapping | Audit reports can be downloaded, the compliance page names SOX, GDPR and HIPAA, and Agentic Fabric produces framework-aligned evidence exports for AI agents. Public pages do not describe a framework-mapped evidence pack for human access governance. [1] [2] [3] | |
| Time to deploy and services needed | SailPoint does not publish a deployment time for the core platform, on-prem sources need a virtual appliance cluster, and it sells implementation services covering application onboarding and role modeling. The only claim of weeks is for the Access Risk Management add-on. [1] [2] [3] | |
| Pricing transparency and connector cost | No public price, but packaging is public: 3 suites, add-ons, and an NHI allotment per licensed human identity. [1] [2] |
6Zluri81.3
Zluri is a SaaS management and identity governance (IGA) platform covering app and identity discovery, onboarding and offboarding workflows, access requests, access reviews, SoD and identity posture, built on a direct-API integration layer that reaches apps outside SSO and SCIM. Zluri is now an Infotech company (formerly Info-Tech Research Group), acquired in October 2026 and run as a standalone division; the product name is unchanged. zluri.com
Public ratings (not scored): AWS Marketplace (2 AWS reviews + 177 G2 reviews) 4.6 (179 reviews)
| Connectors for SCIM and API apps | Zluri publishes a catalog of 300+ out-of-the-box API connectors across IdPs, HRIS, ITSM and major SaaS, plus SCIM provisioning support. [1] [2] [3] | |
| Apps with no SCIM and no API | The Universal Identity Connector documents interface automation that provisions through the app UI when no API or database access exists, plus database orchestration and ITSM tasks. Custom integrations are quoted with timelines based on system complexity, and public pages do not say whether the connector is included or delivered as a service. [1] [2] | |
| Entitlements below the group level | Workflow actions provision resource-level access such as folders, repositories, channels and projects, beyond group membership. [1] [2] | |
| Joiner, mover, leaver from the HRIS | HRMS-triggered onboarding applies birthright, department and role rules, automation rules handle attribute changes, and mover handling is documented. HRIS triggers are documented for HiBob, Personio, BambooHR and SDK sources, and Zero Touch setup is done with the Zluri CSM. [1] [2] [3] | |
| Depth of offboarding | Offboarding goes beyond SSO: revocation in non-SSO apps, signing users out, data backup and ownership transfer, email forwarding and MDM device lock or wipe. Public pages do not describe a step that verifies offboarding is complete; verification is documented for onboarding only. [1] [2] | |
| Access requests and time-bound access | Self-service requests in Slack or the app catalog go through multi-step, policy-driven approvals with a requested duration field, and time-bound access is revoked automatically. [1] [2] | |
| Access reviews | Recurring certifications give reviewers activity data and risk insights, and closed-loop remediation deprovisions rejected access via API. [1] [2] | |
| Audit evidence and compliance mapping | Audit-ready review reports export with SOX, SOC 2 and ISO 27001 named, and SoD policies are mapped to SOX 404, SOC 2 TSC, ISO 27001 A.9 and NIST AC-5. [1] [2] [3] | |
| Time to deploy and services needed | Zluri publishes timelines in weeks (standard integrations 2 to 4 weeks, enterprise connectors 4 to 8 weeks, weeks to first policy for SoD) with no required services stated. Sign-up is invite-only, and HRIS-triggered onboarding is configured with the Zluri CSM rather than self-serve. [1] [2] [3] | |
| Pricing transparency and connector cost | No public price on zluri.com (the pricing URL redirects to the demo form) and no published packaging. The Zluri AWS Marketplace listing shows a single Base Plan figure with a note to contact Zluri for private pricing, with no per-user price or connector terms. [1] |
7Saviynt77.5
Saviynt Identity Cloud is a cloud-native converged identity platform combining identity governance and administration with application access governance, privileged access management, identity security posture management and non-human identity governance. Saviynt sells it in Essentials, Pro and Premier tiers to enterprises, and markets AI-agent governance separately as Zuma. saviynt.com
Public ratings (not scored): PeerSpot 3.7 (28 reviews)
| Connectors for SCIM and API apps | The Saviynt Exchange lists 445 apps, 119 of them tagged Saviynt-developed, and Saviynt says it onboards apps with SCIM and REST APIs. Saviynt-developed connectors are included in tier pricing. [1] [2] [3] | |
| Apps with no SCIM and no API | Saviynt describes a vendor-supplied way to bring apps with no integration protocol under management: an AI onboarding agent with a computer-use agent that drives the app UI, and support for web, CLI and thick-client apps. This is described only on product pages, since the docs need a login, and the disconnected-app connectors on the Exchange (Cerby, Redblock, Torch) are partner products. [1] [2] [3] | |
| Entitlements below the group level | Saviynt documents provisioning of fine-grained entitlements below the group level, such as Salesforce entitlements down to object fields, through rules-based and request-based provisioning. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Public pages describe an HR-driven lifecycle from Workday HR records, with access assigned at onboarding and revoked at departure, plus rules-based (ABAC) provisioning. Public pages do not describe mover handling or birthright rules; birthright appears only in a partner services listing, and product docs need a login. [1] [2] | |
| Depth of offboarding | Saviynt describes automatic revocation of access on departure across connected apps. Public pages do not describe session or token revocation, local accounts or ownership transfer at offboarding, and product docs need a login. [1] | |
| Access requests and time-bound access | Self-service requests get risk-based approvals, and Just-in-Time access grants time-bound access and removes it automatically. The pricing page lists just-in-time access in the Pro tier, not Essentials. [1] [2] [3] | |
| Access reviews | Certification campaigns offer AI recommendations, automatic decisions for low-risk items and risk-aware remediation suggestions. Marketing copy implies rejected access is revoked, but public docs do not describe automatic revocation. [1] [2] [3] | |
| Audit evidence and compliance mapping | Reporting controls are mapped to named regulations (SOX, PCI, FedRAMP, HIPAA), a Unified Controls Framework is cross-mapped to standards such as CIS and NIST CSF, and compliance audit reports cover GDPR and SOX. [1] [2] [3] | |
| Time to deploy and services needed | The Saviynt commitment of value in less than 12 weeks is tied to its Expert Services packages, and its own success package schedules a deployment review 4 to 6 months after purchase, which points to services-assisted deployments over months. [1] [2] | |
| Pricing transparency and connector cost | No public price, but packaging is public (Essentials, Pro and Premier tiers plus independent solutions), and Saviynt-developed connectors are included. [1] [2] |
8Lumos77.5
Lumos is an identity governance and security platform covering access requests (AppStore), lifecycle management, access reviews and non-human identity and AI agent governance, with an AI agent (Albus) for role design and reviews. It is aimed at security, identity and IT teams governing human, machine and AI identities. lumos.com
Public ratings (not scored): G2 (via AWS Marketplace, external reviews from G2) 4.7 (69 reviews)
| Connectors for SCIM and API apps | Lumos publishes a catalog of 300+ integrations, with 253 integration docs pages, plus a generic SCIM 2.0 connector that syncs and provisions any SCIM app without a dedicated connector. [1] [2] | |
| Apps with no SCIM and no API | For apps with an API or database, Lumos documents generic REST and database connectors, a Connector SDK and provisioning webhooks, but the customer configures or builds these. For apps with no API, the documented path is CSV sync plus Manual Tasks routed to a person and tracked to completion. [1] [2] [3] | |
| Entitlements below the group level | Connector docs describe provisioning in-app permissions below the group level, such as per-user Bitbucket project and repository permissions, and the AppStore syncs assignable permissions. [1] | |
| Joiner, mover, leaver from the HRIS | The HRIS is the source of truth, triggering onboarding on start date or account creation and offboarding on deactivation or end date, with access policies for birthright and mover workflows that re-evaluate policies when an attribute changes. [1] [2] [3] | |
| Depth of offboarding | Removal workflows run in order and go beyond account disable: session sign-out, data transfer and group ownership transfer in Google Workspace, and manual tasks for app admins. An offboarding completes only when all its tasks finish. [1] [2] [3] | |
| Access requests and time-bound access | Self-service AppStore requests from web, Slack or Teams go through flexible approvals, and time-based access is removed automatically at the end of the window. Time-based access needs either IdP assignment or a deprovisioning webhook for the app. [1] [2] | |
| Access reviews | Campaigns at account and permission level give reviewers context such as employment status and AI insights from usage and prior decisions, and rejected access is removed automatically through deprovisioning workflows. [1] [2] | |
| Audit evidence and compliance mapping | Lumos produces a PDF audit report per review, guidance on proving completeness and accuracy for SOX and SOC 2 audits, and built-in permission tags for named frameworks (SOC2, SOX, ISO27001, PCI, HITRUST). [1] [2] [3] | |
| Time to deploy and services needed | Lumos publishes lifecycle deployment in weeks and offers a guided self-implementation program (Launchpad). [1] [2] | |
| Pricing transparency and connector cost | No public price and no published plans or packaging; the pricing page is a demo form and Lumos says pricing is custom. [1] |
9Veza76.3
Veza is an identity security platform built on an access graph of effective permissions across cloud, SaaS, data systems and on-prem apps, with IGA modules for access reviews, lifecycle management, access requests, SoD and NHI and AI-agent security. ServiceNow has completed its acquisition of Veza and Veza is now part of ServiceNow, with the product still sold as Veza; these scores cover its Next-Gen IGA use case (Veza Access Governance). veza.com
Public ratings (not scored): PeerSpot 3.9 (4 reviews) · AWS Marketplace (3 AWS reviews + 1 PeerSpot review) 3.9 (4 reviews)
| Connectors for SCIM and API apps | Veza lists 325+ native integrations plus generic SCIM 2.0 provisioning, but provisioning and deprovisioning run through Lifecycle Management, which requires a separate Veza license. [1] [2] | |
| Apps with no SCIM and no API | Apps without a built-in or SCIM connector are covered through the Open Authorization API (connector scripts the customer builds or deploys), flat files, ServiceNow ticket creation or custom REST payloads. [1] [2] [3] | |
| Entitlements below the group level | Access Profiles and Access Requests provision in-app entitlements such as roles, permission sets, licenses and groups in target apps. Fulfilment runs through Lifecycle Management provisioning policies, which require a separate Veza license. [1] [2] | |
| Joiner, mover, leaver from the HRIS | HR-sourced policies and workflows cover joiners, movers and leavers, with birthright Access Profiles and Business Roles. Lifecycle Management requires a separate Veza license. [1] [2] | |
| Depth of offboarding | Leaver workflows disable or suspend accounts, remove all entitlements, can end active sessions on supported integrations and cover local accounts, and review remediations can be verified. All of this ships in Lifecycle Management, which requires a separate Veza license. [1] [2] [3] | |
| Access requests and time-bound access | Access Hub supports self-service and on-behalf requests with multi-level approvals, JIT access policies and policy-enforced auto-expiration. Approved requests are fulfilled by Lifecycle Management provisioning policies, though the Access Requests pages carry no separate license note. [1] [2] | |
| Access reviews | Campaigns show risk scores, usage insights and past certification decisions, and Veza can verify that rejected access was removed. Automatic revocation on sign-off needs Access Reviews Advanced and works only for apps with provisioning turned on. [1] [2] [3] | |
| Audit evidence and compliance mapping | Audit-ready reports are named against SOX, ISO 27001, SOC 2 and GDPR, review reports export to Excel, and completeness-and-accuracy procedures for auditors are documented. [1] [2] | |
| Time to deploy and services needed | Veza publishes connection in minutes and says no professional-services integration build is needed; the platform is agentless SaaS with a getting-started guide customers follow themselves. On-prem sources need an Insight Point container the customer runs. [1] [2] | |
| Pricing transparency and connector cost | No public price on veza.com (it has no pricing page); the Veza AWS Marketplace listing shows packaged list prices with identity and connector caps ($100,000 per 12 months for the platform, $150,000 with Workflows), so connectors are capped per package. [1] |
10Opal Security73.8
Opal is an access governance platform centred on just-in-time, time-bound access requests, access reviews and policy-as-code (OpalScript), extended to service accounts and AI agents (Opal Zero, launched September 2026). Opal says it is built for engineer-led, cloud-native enterprises and states it is not positioned as the SoD and certification leader for the largest regulated enterprises. opal.dev
Public ratings (not scored): AWS Marketplace (aggregates G2 reviews) 4.6 (30 reviews)
| Connectors for SCIM and API apps | The integrations docs list about 60 connectors (55+ per the docs page; the marketing page says 250+), covering Okta, Google, Azure, AD, Workday, Rippling, AWS, GCP and major SaaS. Public pages do not describe a generic outbound SCIM connector, and user provisioning is supported only on a listed subset of integrations. [1] [2] [3] | |
| Apps with no SCIM and no API | Apps without a supported integration are handled by a Custom Connector the customer builds by implementing API endpoints, or by ticket propagation to Jira, Linear or ServiceNow for manual fulfilment. [1] [2] | |
| Entitlements below the group level | Public docs describe provisioning of resources below the group level: AWS IAM roles, RDS, EC2, EKS, GCP projects and folders, Box folders, Grafana folders and dashboards, and GitHub repositories. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Access Rules use HRIS and IdP attributes (Workday, Rippling, Okta, Google, Entra) to grant and remove access on join, move and leave. Opal itself says its lifecycle depth varies compared with HR-driven JML suites and warns against using rules for sensitive resources, and account creation is supported only on a subset of integrations. [1] [2] | |
| Depth of offboarding | Deprovisioning deactivates or deletes the user in supported end systems, triggered by the IdP or HRIS, by reviews or manually, and time-bound grants expire automatically. Public pages do not describe session or token revocation, ownership transfer or a step that verifies offboarding is complete. [1] [2] | |
| Access requests and time-bound access | Self-service requests via web, Slack, Teams or Google Chat go to configurable reviewers with escalation, and just-in-time, time-bound access with automatic expiry is the core of the product. [1] [2] | |
| Access reviews | Access campaigns can revoke rejected access automatically on decision or at campaign end. Usage and last-used context for reviewers comes from Paladin Insights, which is in open beta and must be turned on by Opal support. [1] [2] [3] | |
| Audit evidence and compliance mapping | Campaign reports export as PDF and CSV, events can be streamed, and SOX, SOC 2, ISO and HITRUST are named. Public pages do not describe a control mapping per framework. [1] [2] | |
| Time to deploy and services needed | Opal documents self-serve cloud sign-up and publishes a deployment time in days with an incremental rollout, with no required services stated; self-hosted options also exist. [1] [2] | |
| Pricing transparency and connector cost | No public price on opal.dev (the pricing URL shows the demo form); a per-user price appears only on the Opal AWS Marketplace listing, and opal.dev publishes a launch price for Opal Zero. Public pages do not say whether connectors are included. [1] [2] |
Questions
Which IGA platform is best for apps without SCIM?
On this weighting, Iden ranks first with 93.8 out of 100, ahead of Okta and C1. It is the only vendor here to score 5 on apps with no SCIM and no API, and its connectors are included in a published per-user price. Okta suits SaaS apps with an OpenAPI spec.
Should we just pay for the app's SCIM tier?
Sometimes, for a high-risk app with a published price, or when the higher plan also brings audit logs you need. Multiply seats by the monthly price difference by 12 and compare. Check first that the SCIM integration sets in-app roles, not just account status.
Sources
- SCIM Tax Index (maintained by Iden)Open data (CC-BY 4.0) on which of 849 SaaS vendors offer SCIM and whether they charge extra, October 2026: 331 with SCIM, 278 (84%) charging extra, 218 unpublished. Iden researches and maintains it. It covers pricing, not the quality of each vendor's SCIM or API.
- RFC 7643, SCIM: Core SchemaEstablishes that SCIM is a published standard (2015) and that entitlements have no specified vocabulary. Says nothing about pricing.
- Iden: How to provision apps without SCIMIden's description of API connectors, its custom automation framework, connector maintenance and credentials, and the apps it says still need a person. Vendor-published and not independently tested here.
- Okta: On-demand SaaS integrations deployment guideOkta's statement that on-demand connectors are available from November 2026 at no additional cost, only for new SaaS integrations with an OpenAPI spec that is public or shared by the customer. Vendor-published; the 48-hour figure is Okta's own claim, not measured here.