Best IGA platform for healthcare
10 IGA vendors ranked for hospitals and clinic groups: HIPAA workforce access, agency and per-diem staff, apps around the EHR, and our pick.
Best IGA PlatformHealthcare
On this page
The short answer
Iden ranks first for healthcare because it builds the connector itself for apps with no SCIM and no API, which describes much of what surrounds the EHR, and ends time-bound access for staff the HRIS never sees. Lumos is a close 2nd and the better choice if your apps mostly have APIs and in-app role provisioning matters more.
Our pickIden: the only vendor here that builds connectors for apps with no SCIM and no API itself, at no extra cost, and it revokes agency and per-diem access on the end date you set.
Which IGA platform ranks first for healthcare?
Iden ranks first with 91.4 out of 100, followed by Lumos (89.3) and SailPoint (88.6). 10 vendors are scored on the published 13-criterion rubric, weighted for healthcare.
| Rank | Vendor | Score bar | Score |
|---|---|---|---|
| 1 | Iden | 91.4 | |
| 2 | Lumos | 89.3 | |
| 3 | SailPoint | 88.6 | |
| 4 | C1 | 88.6 | |
| 5 | Microsoft | 85.0 | |
| 6 | Okta | 84.3 | |
| 7 | Omada | 82.1 | |
| 8 | Veza | 82.1 | |
| 9 | Saviynt | 80.7 | |
| 10 | One Identity | 77.9 |
How this ranking is weighted
Every vendor gets the same score on each criterion in every report. What changes is the weight: 3 matters most for this reader, 0 is left out. The full scoring guide is on the About page.
| Criterion | Weight | Why it matters here |
|---|---|---|
| Connectors for SCIM and API apps | ||
| Apps with no SCIM and no API | Scheduling, PACS viewers, payer portals and lab systems around the EHR are often outside SSO and SCIM. | |
| Entitlements below the group level | ||
| Joiner, mover, leaver from the HRIS | Agency, per-diem and rotating staff join and leave constantly, and many are not in the HRIS. | |
| Depth of offboarding | HIPAA 164.308(a)(3) requires termination procedures when a workforce member leaves. | |
| Access requests and time-bound access | ||
| Access reviews | HIPAA 164.308(a)(4) asks you to review and modify access rights under your own policy. | |
| Audit evidence and compliance mapping | An OCR investigation or a HIPAA audit asks for documented access decisions. | |
| Separation of duties | ||
| Non-human identities | ||
| Time to deploy and services needed | ||
| Pricing transparency and connector cost | ||
| Enterprise depth |
Scores on the criteria weighted most
| Vendor | Apps with no SCIM and no API | Joiner, mover, leaver from the HRIS | Depth of offboarding | Access reviews | Audit evidence and compliance mapping | Total |
|---|---|---|---|---|---|---|
| Iden | 5 | 5 | 5 | 5 | 5 | 91.4 |
| Lumos | 3 | 5 | 5 | 5 | 5 | 89.3 |
| SailPoint | 4 | 5 | 4 | 5 | 4 | 88.6 |
| C1 | 3 | 5 | 5 | 5 | 4 | 88.6 |
| Microsoft | 3 | 5 | 4 | 5 | 4 | 85.0 |
| Okta | 3 | 5 | 4 | 5 | 3 | 84.3 |
| Omada | 3 | 5 | 4 | 5 | 4 | 82.1 |
| Veza | 3 | 4 | 4 | 4 | 5 | 82.1 |
| Saviynt | 4 | 4 | 3 | 4 | 5 | 80.7 |
| One Identity | 3 | 5 | 3 | 5 | 4 | 77.9 |
Scores are out of 5. The scores, weights and evidence for every report can be downloaded as JSON or CSV.
What HIPAA asks of workforce access
The Security Rule puts workforce access in 3 places. 45 CFR 164.308(a)(3) requires procedures so that workforce members have appropriate access to ePHI, termination procedures included. 164.308(a)(4) adds the specification to "establish, document, review, and modify a user's right of access to a workstation, transaction, program, or process." 45 CFR 164.312(a) marks unique user identification and an emergency access procedure as Required. Most of the rest is Addressable, which under 164.306(d)(3) means you implement it, or write down why it isn't reasonable and appropriate and adopt an equivalent. That written decision is what an investigator asks for.
The termination specification applies when "the employment of, or other arrangement with, a workforce member ends," and 45 CFR 160.103 defines the workforce to include volunteers, trainees and others under your direct control "whether or not they are paid" by you. Agency nurses, per-diem staff, residents, students on rotation and volunteers are in scope, and most of them aren't in the HRIS that triggers your leaver workflow. Their access should end on a contract or rotation date known to the agency and the unit manager, and no HR event fires when it passes. Break-the-glass access fails the same way: it is granted in an emergency and, if nobody reviews it afterwards, stays as standing access nobody approved.
How Iden, Lumos and SailPoint compare
The gap at the top comes from the scheduling systems, PACS viewers, dictation tools and payer portals around the EHR. For an app with no SCIM and no API, Iden's FAQ says it builds the connector, usually in 48 hours, at no extra cost, and its non-SCIM playbook describes a console layer that logs in as an admin service account and makes the change. The same playbook says a console behind hardware MFA needs a person present for each change. SailPoint's Disconnected Application Connector provisions web apps with no API, but its prerequisites exclude MFA, single sign-on and federated login, so check how each portal's admin login works. Lumos offers a Connector SDK that it says "takes development work," and for apps with no API, manual tasks routed to a person.
Lumos and SailPoint are stronger on in-app roles. Lumos documents provisioning project and repository permissions in Bitbucket, and SailPoint adds and removes Salesforce permission sets and roles. Iden's connector pages, GitHub among them, list user create, update and delete with group membership read only, and its catalog names no EHR, so the EHR would be a custom connector. That matters for EHR role templates: a nurse who floats from the emergency department to the ICU keeps the first template unless something removes it.
Evidence is close. Iden's FAQ says its evidence maps to HIPAA access requirements, Lumos lets you tag permissions as HITRUST, SOX or PCI, and SailPoint's compliance page names HIPAA. Cost and effort separate them more. Iden publishes $7.50 per user per month with every connector included and says most teams run their full stack within 1 to 2 weeks. Lumos pricing is custom. SailPoint publishes its suites but no price, and sells professional services for application onboarding.
When to pick something other than Iden
- A health system with an IAM team of 10 or more, a mainframe or SAP, and auditors who expect conflicting requests blocked should start with SailPoint. It documents role discovery, RACF, ACF2 and Top Secret connectors, and a setting that cancels requests with SoD conflicts. Iden's llms.txt says it isn't for IAM teams of that size already running SailPoint or Saviynt.
- If most of your clinical and business apps have APIs or SCIM and role-level provisioning is the priority, pick Lumos. Check time-bound access app by app, because Lumos offers it only where it can assign the user through your IdP or a deprovisioning webhook.
- A hospital already on Entra ID P1 or P2 with Workday or SuccessFactors as the HR source can add Entra ID Governance at a published $7 per user per month. Its HR provisioning covers contingent workers, but for apps with their own directory and no provisioning integration Microsoft says removals may be manual.
What to test before you buy
- Pull 5 agency or per-diem staff whose engagement ended last quarter and trace each to removal in the EHR and in 3 apps outside SSO. That is the sample an auditor would take.
- Have the vendor connect the EHR test environment and move a test nurse between units. The old unit's role template should come off, and the change should be written in the EHR.
- Run 1 review campaign on the EHR and check that a revoke executes in the EHR rather than opening a ticket.
- Grant a time-bound emergency access role and confirm it expires and comes up for review afterwards.
- Ask how a per-diem nurse who works 2 shifts a month is counted for licensing.
- Get the vendor's BAA position and the connector service account's exact permissions in writing. Under 164.308(b)(1), a vendor that creates, receives, maintains or transmits ePHI for you needs one. Iden's FAQ doesn't mention a BAA, so ask.
Scorecards
Each score, the reason for it and the page it rests on. Every score comes from the vendor's own public pages.
1Iden91.4
Iden is an identity governance (IGA) platform that automates onboarding, offboarding, access requests and access reviews across SaaS, internal and legacy apps, including apps without SCIM or an API. It runs alongside an existing SSO (Okta, Entra, Google Workspace, JumpCloud) rather than replacing it. idenhq.com
| Connectors for SCIM and API apps | Iden publishes 176 per-app connector pages across 14 categories and provisions any SCIM app out of the box, with major SaaS such as Slack, Salesforce, Google Workspace, GitHub and AWS listed. The catalog is smaller than the 300 to 400 connector libraries some peers publish. [1] [2] | |
| Apps with no SCIM and no API | Iden documents a vendor-built method for apps with no SCIM and no API: console automation that drives the admin UI, plus custom connectors that Iden builds and maintains at no extra cost, so the customer does not build them. [1] [2] | |
| Entitlements below the group level | Iden summary pages claim channel-, repository- and project-level provisioning, but the published capability tables for GitHub, Slack and Salesforce list user create, update and delete plus read-only groups or group membership. Public pages do not describe any connector writing an in-app role, repo or channel grant, so provisioning is documented only at the user and group level. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Iden documents an HRIS-triggered joiner plan built before the start date from department, title, manager and employment type (birthright), a mover recompute that removes grants tied to the old department, and leaver workflows. [1] [2] [3] | |
| Depth of offboarding | Offboarding goes beyond SSO: session revocation, data and ownership transfer before deletion, a record of how each account closed, and an offboarding that stays open until every account is closed, as a verification step. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests in Slack or Teams go to the owner for approval, and grants expire automatically: time-boxed, tied to a task, or break-glass. [1] [2] [3] | |
| Access reviews | Campaigns give reviewers context such as HR employment status, last use and capability descriptions, and revocation runs from the review decision. [1] [2] [3] | |
| Audit evidence and compliance mapping | Review and finding evidence is exportable and mapped to named controls: SOC 2 CC6.1 to CC6.3, ISO 27001 A.9 and A.5.18, and HIPAA. [1] [2] | |
| Separation of duties | SoD rules are checked continuously across connected apps, including cross-app and self-grant patterns, and conflicts surface as findings after the fact, with compensating controls recorded. Public pages do not describe an SoD check at request or approval time. [1] [2] | |
| Non-human identities | Iden documents an inventory of service accounts, API keys and AI agents with required owners, expiry on long-lived credentials, inclusion in access reviews, and revocation. Iden states one limit: discovery covers only connected apps. [1] [2] [3] | |
| Time to deploy and services needed | Iden publishes a deployment time in days to weeks with no systems integrator, and offers a 2-week trial. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price, with every connector included, non-SCIM and custom connectors among them. [1] [2] | |
| Enterprise depth | Public docs cover on-premises Active Directory over LDAP and LDAPS, database connectors such as PostgreSQL, and an on-premises deployment option. Public pages do not describe role mining, ERP (SAP, Oracle EBS) or mainframe connectors, or large-scale deployments, and the Iden comparison page with SailPoint concedes deeper role mining and SoD modeling to SailPoint. [1] [2] [3] |
2Lumos89.3
Lumos is an identity governance and security platform covering access requests (AppStore), lifecycle management, access reviews and non-human identity and AI agent governance, with an AI agent (Albus) for role design and reviews. It is aimed at security, identity and IT teams governing human, machine and AI identities. lumos.com
Public ratings (not scored): G2 (via AWS Marketplace, external reviews from G2) 4.7 (69 reviews)
| Connectors for SCIM and API apps | Lumos publishes a catalog of 300+ integrations, with 253 integration docs pages, plus a generic SCIM 2.0 connector that syncs and provisions any SCIM app without a dedicated connector. [1] [2] | |
| Apps with no SCIM and no API | For apps with an API or database, Lumos documents generic REST and database connectors, a Connector SDK and provisioning webhooks, but the customer configures or builds these. For apps with no API, the documented path is CSV sync plus Manual Tasks routed to a person and tracked to completion. [1] [2] [3] | |
| Entitlements below the group level | Connector docs describe provisioning in-app permissions below the group level, such as per-user Bitbucket project and repository permissions, and the AppStore syncs assignable permissions. [1] | |
| Joiner, mover, leaver from the HRIS | The HRIS is the source of truth, triggering onboarding on start date or account creation and offboarding on deactivation or end date, with access policies for birthright and mover workflows that re-evaluate policies when an attribute changes. [1] [2] [3] | |
| Depth of offboarding | Removal workflows run in order and go beyond account disable: session sign-out, data transfer and group ownership transfer in Google Workspace, and manual tasks for app admins. An offboarding completes only when all its tasks finish. [1] [2] [3] | |
| Access requests and time-bound access | Self-service AppStore requests from web, Slack or Teams go through flexible approvals, and time-based access is removed automatically at the end of the window. Time-based access needs either IdP assignment or a deprovisioning webhook for the app. [1] [2] | |
| Access reviews | Campaigns at account and permission level give reviewers context such as employment status and AI insights from usage and prior decisions, and rejected access is removed automatically through deprovisioning workflows. [1] [2] | |
| Audit evidence and compliance mapping | Lumos produces a PDF audit report per review, guidance on proving completeness and accuracy for SOX and SOC 2 audits, and built-in permission tags for named frameworks (SOC2, SOX, ISO27001, PCI, HITRUST). [1] [2] [3] | |
| Separation of duties | Native SoD rules, including cross-app rules, are flagged during access reviews, so conflicts are found after the fact. Blocking at request time is documented only as a pattern the customer builds with a request validation webhook, and no out-of-the-box rule templates are provided. [1] [2] | |
| Non-human identities | Lumos documents discovery and inventory of service principals, IAM roles, API keys and AI agents with owners and business justification, plus MCP governance. Public pages do not describe credential expiry enforcement for NHIs. [1] [2] | |
| Time to deploy and services needed | Lumos publishes lifecycle deployment in weeks and offers a guided self-implementation program (Launchpad). [1] [2] | |
| Pricing transparency and connector cost | No public price and no published plans or packaging; the pricing page is a demo form and Lumos says pricing is custom. [1] | |
| Enterprise depth | Public docs cover role mining (Albus), an on-premise agent for Active Directory, LDAP and JDBC databases with a high-availability architecture, on-prem SAP S/4HANA role provisioning, Oracle HCM and Workday, and customers up to 100,000+ employees. Public pages do not describe a mainframe connector. [1] [2] [3] |
3SailPoint88.6
SailPoint Identity Security Cloud is a SaaS identity governance platform for large enterprises covering lifecycle provisioning, access requests, certifications, separation of duties and machine and AI-agent identities. SailPoint now markets it as SailPoint Human Fabric, which it describes as the evolution of Identity Security Cloud, sold in Agentic Standard, Agentic Business and Agentic Business Plus suites. sailpoint.com
Public ratings (not scored): PeerSpot 4.1 (72 reviews)
| Connectors for SCIM and API apps | SailPoint publishes a large connector catalog (deep governance, quick compliance and discovery connectors, covering SaaS such as GitHub, Salesforce, Workday, Okta and Entra ID) plus a SCIM 2.0 source that manages any SCIM 2.0 compliant system. [1] [2] [3] | |
| Apps with no SCIM and no API | SailPoint supplies a Disconnected Application Connector that provisions accounts to web apps with no API by recording browser operations, plus an RPA connector for apps without modern APIs. The connector does not work with apps behind SSO, MFA or federated sign-in, and the RPA route depends on an RPA platform the customer already runs. [1] [2] [3] | |
| Entitlements below the group level | Connector docs show provisioning of in-app objects below the group level, such as adding and removing Salesforce permission sets, permission set groups, roles and managed packages, and GitHub teams as entitlements. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Public docs describe HR-driven lifecycle states (pre-hire, active, leave of absence, terminated), birthright roles, and mover handling that removes access granted by role criteria when an identity no longer matches. [1] [2] [3] [4] | |
| Depth of offboarding | Beyond account disable or delete, a terminated lifecycle state can revoke roles, access profiles and entitlements across all sources, and SailPoint can publish Session Revoked (Shared Signals) events when an identity enters a lifecycle state. Public pages do not describe ownership transfer or token cleanup when someone leaves. [1] [2] | |
| Access requests and time-bound access | Self-service requests with approvals can require an end date and maximum duration, and Just-In-Time (Privilege on Demand) access is removed when the activation period ends. Time-bound requests are in the core docs, while the suites page places JIT provisioning for elevated access in Agentic Business and above. [1] [2] [3] | |
| Access reviews | Certification campaigns revoke rejected access automatically on direct-connect sources, and reviewers can see activity data such as days active in the last 90. Activity data needs Activity Insights connectors, which SailPoint says to arrange through the CSM. [1] [2] | |
| Audit evidence and compliance mapping | Audit reports can be downloaded, the compliance page names SOX, GDPR and HIPAA, and Agentic Fabric produces framework-aligned evidence exports for AI agents. Public pages do not describe a framework-mapped evidence pack for human access governance. [1] [2] [3] | |
| Separation of duties | SoD policies can be enforced at request time, with global settings that automatically cancel access requests that create SoD conflicts. SAP-specific SoD (Access Risk Management) is an add-on. [1] [2] | |
| Non-human identities | SailPoint documents discovery and classification of machine accounts, certification of application identities, a credentials inventory (API keys, tokens, client secrets) with owners and expiry status, and an AI agent registry. Agentic governance requires the Agentic Business or Business Plus suite. [1] [2] [3] | |
| Time to deploy and services needed | SailPoint does not publish a deployment time for the core platform, on-prem sources need a virtual appliance cluster, and it sells implementation services covering application onboarding and role modeling. The only claim of weeks is for the Access Risk Management add-on. [1] [2] [3] | |
| Pricing transparency and connector cost | No public price, but packaging is public: 3 suites, add-ons, and an NHI allotment per licensed human identity. [1] [2] | |
| Enterprise depth | Public docs cover role discovery (role mining), SAP and ERP deep governance, mainframe connectors (RACF, ACF2, Top Secret), Active Directory, and Fortune 500 scale. [1] [2] [3] |
4C188.6
ConductorOne now trades as C1 (c1.ai; conductorone.com now serves c1.ai), and its site banner announces that C1 is to join Workday. C1 is an identity platform covering identity governance (lifecycle, access requests and JIT, access reviews, SoD) alongside AI agent, MCP and secrets products for IT, security, IAM and compliance teams. c1.ai
Public ratings (not scored): G2 (via Toolradar aggregator) 4.8 (13 reviews)
| Connectors for SCIM and API apps | C1 publishes a library of 400+ out-of-the-box connectors, with about 400 connector docs pages, plus a configurable SCIM connector. [1] [2] | |
| Apps with no SCIM and no API | Apps with an API can be covered by HTTP and SQL connectors the customer configures, the Baton SDK, or AI-built custom connectors, which are in early access, sync only and need an API that lists users. For apps with no API, the documented path is file-based sync plus tickets in an external ITSM; the marketing FAQ says no-API legacy apps can be integrated, but public pages do not describe provisioning or deprovisioning them without tickets. [1] [2] [3] | |
| Entitlements below the group level | Requests and provisioning work at resource level, such as groups, repos and roles within an app, and the GitHub v2 connector provisions repository permissions. [1] | |
| Joiner, mover, leaver from the HRIS | The HRIS or IdP directory is the source of truth, with user created and updated triggers, birthright access profiles, automatic re-enrollment when a mover starts matching a different profile, and revocation for leavers. [1] [2] | |
| Depth of offboarding | Leaver automation revokes entitlements across connected apps and opens a review campaign for any access that remains, as a verification step. Connector actions include signing out all sessions, revoking OAuth tokens and transferring Drive and Calendar ownership in Google Workspace. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests from web, Slack, Teams or CLI go through approval policies with a max request duration, after which C1 revokes the grant automatically, and there is an emergency access path. [1] | |
| Access reviews | Campaigns give reviewers insights such as peer access, risk level and recommendations, and revocation can run automatically after the campaign. [1] [2] | |
| Audit evidence and compliance mapping | Campaign reports export with verifiable file hashes, alongside conflict-monitor reports and logs that can be exported to a SIEM. Campaigns can be scoped by a compliance framework attribute, but its values are tags the customer creates rather than a built-in framework mapping, and SOX and ISO 27001 are named only in the SoD context. [1] [2] [3] | |
| Separation of duties | Conflict monitors define mutually exclusive entitlement groups and detect existing and new conflicts, and when requested access would trigger a conflict, approvers see it on the request task. [1] [2] | |
| Non-human identities | An Identities dashboard discovers app registrations, assumable roles, managed identities, service accounts, secrets and agents, with owners and findings such as unowned NHIs. C1 says its NHI capabilities are still expanding, and public pages do not describe expiry or lifecycle for discovered NHIs; expiry is documented only for the service principals and agent tokens C1 itself issues. [1] [2] | |
| Time to deploy and services needed | C1 publishes go-live in weeks, 1 month on average, with guided agentic onboarding; deployment experts are offered but not stated as required. [1] [2] | |
| Pricing transparency and connector cost | No public price, but packaging is public: SKU-based Platform or usage-based Flex pricing, Pro and Advanced platform levels, program size by managed identities, and named modules (Lifecycle, Access, Comply). Exact pricing is quoted per customer. [1] [2] | |
| Enterprise depth | Public docs cover role mining, Active Directory and LDAP provisioning, ERP connectors (Oracle JD Edwards, NetSuite, SAP GRC and Ariba) and self-hosted connectors, but public pages do not describe a mainframe connector. On-prem integrations and connectivity are listed only on the Advanced platform level. [1] [2] [3] [4] |
5Microsoft85.0
Microsoft Entra ID Governance adds entitlement management (access packages), access reviews, lifecycle workflows, privileged identity management and app provisioning to a Microsoft Entra ID tenant. It is sold as a per-user add-on for Entra ID P1/P2 customers and is also bundled in Microsoft Entra Suite and Microsoft 365 E7. microsoft.com
Public ratings (not scored): PeerSpot 3.9 (14 reviews)
| Connectors for SCIM and API apps | Microsoft publishes a gallery of preintegrated provisioning connectors, which it describes as hundreds of apps rather than thousands, plus generic SCIM 2.0 support. [1] [2] | |
| Apps with no SCIM and no API | Non-SCIM on-prem apps can be reached through the provisioning agent and ECMA connector host (SQL, LDAP or imported ECMA2 connectors), which the customer configures or builds. For apps with their own directory and no provisioning integration, Microsoft says removals may have to be done manually. [1] [2] [3] | |
| Entitlements below the group level | Access packages can assign application app roles, Teams and SharePoint sites below the group level, and SAP IAG business roles in preview. Otherwise in-app permissions depend on the app exposing app roles or groups, and public pages do not describe a general entitlement discovery and exchange model like a dedicated entitlement catalog. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Entra documents HR-driven inbound provisioning from Workday and SuccessFactors, lifecycle workflows for joiners, movers and leavers, and attribute-based automatic assignment policies for birthright access. [1] [2] [3] | |
| Depth of offboarding | Leaver workflow tasks disable the account, revoke all refresh tokens, remove groups, Teams, licenses and access packages, and delete the user, while provisioning removes accounts downstream. Content and ownership transfer is left to the app or custom Logic Apps extensions, and public pages do not describe a step that verifies offboarding is complete. [1] [2] [3] | |
| Access requests and time-bound access | Users request access packages through self-service with multi-stage approvals, and policies make assignments time-limited so they expire automatically; PIM adds time-bound role activation. [1] [2] | |
| Access reviews | Recurring reviews come with smart recommendations and inactive-user decision helpers, and denied access is removed automatically when auto-apply is turned on. [1] [2] [3] | |
| Audit evidence and compliance mapping | Access review history and audit logs can be downloaded, and Microsoft publishes guidance mapping Entra governance controls to named frameworks (PCI DSS requirement 7, NIST, FedRAMP). That mapping is guidance, not an evidence export tagged by framework. [1] [2] | |
| Separation of duties | Access packages can declare incompatible access packages or groups, which blocks the request at request time. [1] | |
| Non-human identities | Agent identities need a human sponsor, get time-bound access packages and pass to a new sponsor when the sponsor leaves, and service principals can be assigned access packages. All of this needs Microsoft Agent 365 or Microsoft 365 E7 on top of ID Governance. [1] [2] | |
| Time to deploy and services needed | Setup is self-serve in the tenant with no required services, but Microsoft does not publish a typical deployment time. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price of $7/user/month standalone, billed annually, on top of a required Entra ID P1 ($7) or P2 license. Gallery and on-prem provisioning connectors are included from P1, not priced per connector. [1] [2] [3] | |
| Enterprise depth | Public docs cover SAP R/3 and S/4HANA, on-prem SQL, LDAP and AD, hybrid and enterprise scale, and access packages with multiple policies. Public pages do not describe role mining. [1] [2] |
6Okta84.3
Okta Identity Governance (OIG) is the IGA product from Okta, made of Lifecycle Management, Workflows and Access Governance (access requests, access certifications, entitlement management, separation of duties) on top of the Okta workforce identity platform. Okta positions it as security-driven governance for the modern enterprise and sells it inside its Essentials suite and above or as an add-on. okta.com
Public ratings (not scored): PeerSpot (Okta Platform, all modules) 4.3 (127 reviews)
| Connectors for SCIM and API apps | The Okta Integration Network lists 8,000+ integrations, 969 of them tagged Lifecycle Management, and Okta states SCIM provisioning for thousands of apps out of the box. [1] [2] [3] | |
| Apps with no SCIM and no API | Apps without SCIM or an API are reached through the On-Premises Provisioning agent with a SCIM server or custom connectors the customer supplies, or through request tasks routed to Jira or ServiceNow. The new on-demand connectors still need the app to publish an OpenAPI spec, so public pages do not describe a path for apps with no API that the customer does not build. [1] [2] [3] | |
| Entitlements below the group level | Entitlement Management stores app entitlements in Okta, assigns them by policy and exchanges them with downstream apps that have provisioning turned on, so in-app permissions below the group level are provisioned, not just read. [1] [2] | |
| Joiner, mover, leaver from the HRIS | The HRIS (Workday, BambooHR, SuccessFactors) is the source of truth with real-time triggers, birthright app provisioning, and explicit mover handling that removes old permissions. [1] [2] [3] | |
| Depth of offboarding | Deactivation deprovisions the user from assigned apps and ends Okta sessions, and a Workflows template transfers Google Drive ownership. Session and token revocation in apps (Universal Logout) sits in Identity Threat Protection, an add-on below the Professional suite, and public pages do not describe a step that verifies offboarding is complete. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests from the dashboard, Slack or Teams go through multi-step approval sequences, and conditions set a duration after which access is revoked automatically. [1] [2] | |
| Access reviews | Certification campaigns revoke access automatically on the reviewer decision, and Governance Analyzer shows reviewers usage history, past decisions, SoD conflicts and how access was assigned. [1] [2] | |
| Audit evidence and compliance mapping | Okta documents campaign and request reports covering 3 years of closed campaigns, plus System Log events, and names SOC2 and SOX as goals. Public pages do not describe an evidence export mapped to named framework controls. [1] [2] | |
| Separation of duties | Entitlement and group SoD rules can block a conflicting request, or allow it with oversight, at request time, and campaigns surface existing conflicts. Okta notes that checks run against existing assignments, so open requests made at the same time are not checked against each other. [1] [2] | |
| Non-human identities | AI agents get registered identities with human owners and certification campaigns, service accounts can be certified and vaulted, and ISPM discovers unmanaged NHIs. These sit in Okta for AI Agents (an add-on), ISPM (Professional and Enterprise) and Privileged Access, not in base OIG. [1] [2] [3] [4] | |
| Time to deploy and services needed | Okta offers a self-serve trial and admin-console setup with no required services and publishes deployment times, but its own figures show about a quarter of customers live within 30 days and the median customer taking up to 6 months. [1] [2] | |
| Pricing transparency and connector cost | Public per-user price: Essentials at $17/user/month includes Lifecycle Management and Access Governance, and OIN connectors and the new on-demand connectors carry no extra fee. Billing is annual, with a $1,500 annual minimum and Workflows flow caps by suite. [1] [2] [3] | |
| Enterprise depth | Public docs cover on-prem provisioning through AD and the provisioning agent, entitlement policies and resource collections, and Fortune 100 scale. Public pages do not describe role mining (role discovery) or mainframe or ERP connectors. [1] [2] |
7Omada82.1
Omada Identity Cloud is the Omada SaaS IGA platform (Azure-hosted) covering identity lifecycle management, access requests, certification campaigns, role and policy modeling, SoD and provisioning, with an on-premises edition (Omada Identity) and a private-cloud option. Omada sells it to large and regulated enterprises with a fixed 12-week Accelerator implementation package; Omada Agent Governance for AI agents is announced but in technical preview. omadaidentity.com
Public ratings (not scored): PeerSpot 4 (69 reviews)
| Connectors for SCIM and API apps | Omada publishes a moderate connector directory of about 150 listings, mixing Omada Certified and community Omada Ready packages, plus a generic SCIM 2.0 template built on the REST connector. SCIM apps are covered through that generic template rather than per-app connectors. [1] [2] [3] | |
| Apps with no SCIM and no API | Systems not connected to Omada are handled by manual provisioning tasks emailed to a provisioner who confirms completion, or by generic REST, SQL and LDAP connectors the customer configures. Public pages do not describe an automated method for apps without SCIM or an API. [1] [2] | |
| Entitlements below the group level | Connectors provision in-app entitlements, such as Salesforce profiles, roles and permission sets, and SAP role assignments with validity dates. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Creating an HR record triggers onboarding with predefined birthright access, transfers entered in HR trigger a mover recalculation that removes old-role access, and the HR end date triggers termination. [1] [2] [3] | |
| Depth of offboarding | Termination disables all accounts in connected systems and starts an ownership-transfer process, and audit policies compare actual against desired state to catch leftovers. Public pages do not describe session or token revocation in target apps. [1] [2] [3] | |
| Access requests and time-bound access | Self-service requests carry a business justification and up to 9 approval layers, access is provisioned automatically on approval, and it is removed automatically on a preset expiry date. [1] [2] | |
| Access reviews | Managers and resource owners get certification surveys where a Remove verdict revokes the assignment and leads to deprovisioning, and AI gives reviewers usage-based access recommendations. [1] [2] | |
| Audit evidence and compliance mapping | Pre-built reports and audit trails provide on-demand compliance evidence for SoD enforcement and policy violations, and Omada names ISO and NIST as targets of its review process. Public pages do not describe an evidence export mapped control by control to named frameworks for the core product; framework mapping is advertised only for the Agent Governance product, which is in preview. [1] [2] | |
| Separation of duties | SoD constraint policies are checked on every self-service request and automated assignment, and violations are blocked or routed for approval with a compensating control. [1] [2] | |
| Non-human identities | The core product supports technical identities created by system owners, and audit policies flag technical accounts without owners. Agent and NHI discovery (Omada Agent Governance) is in technical preview and not yet in production, so it is not counted as available. [1] [2] [3] | |
| Time to deploy and services needed | Omada guarantees a 12-week implementation, delivered through its Accelerator Package by Omada-certified consultants, so delivery is services-led. [1] [2] | |
| Pricing transparency and connector cost | No public price on omadaidentity.com; Omada describes only the Accelerator implementation package and its add-ons. Public pages do not describe editions, a per-user basis or connector licensing. [1] [2] | |
| Enterprise depth | Public docs cover AI role mining, role and constraint policy modeling, mainframe (IBM z/OS RACF), SAP and AD connectors, and an on-premises edition alongside the cloud service. [1] [2] [3] |
8Veza82.1
Veza is an identity security platform built on an access graph of effective permissions across cloud, SaaS, data systems and on-prem apps, with IGA modules for access reviews, lifecycle management, access requests, SoD and NHI and AI-agent security. ServiceNow has completed its acquisition of Veza and Veza is now part of ServiceNow, with the product still sold as Veza; these scores cover its Next-Gen IGA use case (Veza Access Governance). veza.com
Public ratings (not scored): PeerSpot 3.9 (4 reviews) · AWS Marketplace (3 AWS reviews + 1 PeerSpot review) 3.9 (4 reviews)
| Connectors for SCIM and API apps | Veza lists 325+ native integrations plus generic SCIM 2.0 provisioning, but provisioning and deprovisioning run through Lifecycle Management, which requires a separate Veza license. [1] [2] | |
| Apps with no SCIM and no API | Apps without a built-in or SCIM connector are covered through the Open Authorization API (connector scripts the customer builds or deploys), flat files, ServiceNow ticket creation or custom REST payloads. [1] [2] [3] | |
| Entitlements below the group level | Access Profiles and Access Requests provision in-app entitlements such as roles, permission sets, licenses and groups in target apps. Fulfilment runs through Lifecycle Management provisioning policies, which require a separate Veza license. [1] [2] | |
| Joiner, mover, leaver from the HRIS | HR-sourced policies and workflows cover joiners, movers and leavers, with birthright Access Profiles and Business Roles. Lifecycle Management requires a separate Veza license. [1] [2] | |
| Depth of offboarding | Leaver workflows disable or suspend accounts, remove all entitlements, can end active sessions on supported integrations and cover local accounts, and review remediations can be verified. All of this ships in Lifecycle Management, which requires a separate Veza license. [1] [2] [3] | |
| Access requests and time-bound access | Access Hub supports self-service and on-behalf requests with multi-level approvals, JIT access policies and policy-enforced auto-expiration. Approved requests are fulfilled by Lifecycle Management provisioning policies, though the Access Requests pages carry no separate license note. [1] [2] | |
| Access reviews | Campaigns show risk scores, usage insights and past certification decisions, and Veza can verify that rejected access was removed. Automatic revocation on sign-off needs Access Reviews Advanced and works only for apps with provisioning turned on. [1] [2] [3] | |
| Audit evidence and compliance mapping | Audit-ready reports are named against SOX, ISO 27001, SOC 2 and GDPR, review reports export to Excel, and completeness-and-accuracy procedures for auditors are documented. [1] [2] | |
| Separation of duties | Veza offers out-of-the-box SoD rule sets, cross-application detection queries, continuous monitoring with alerts, mitigating controls and SoD-scoped reviews. Public pages do not describe a check at access-request time, so conflicts are found after the fact. [1] [2] | |
| Non-human identities | Veza discovers service accounts, keys, secrets and AI agents across 40+ integrations, assigns owners linked to the lifecycle of the human owner, tracks credential expiry and rotation, and can disable NHI accounts. [1] [2] [3] | |
| Time to deploy and services needed | Veza publishes connection in minutes and says no professional-services integration build is needed; the platform is agentless SaaS with a getting-started guide customers follow themselves. On-prem sources need an Insight Point container the customer runs. [1] [2] | |
| Pricing transparency and connector cost | No public price on veza.com (it has no pricing page); the Veza AWS Marketplace listing shows packaged list prices with identity and connector caps ($100,000 per 12 months for the platform, $150,000 with Workflows), so connectors are capped per package. [1] | |
| Enterprise depth | Public docs cover on-prem systems (Active Directory, Exchange Server, SharePoint Server, Oracle Database, SAP), graph-based policy at 30M+ identities, and role mining. Role mining sits in the Advanced Access Intelligence tier, and public pages do not describe mainframe support. [1] [2] [3] |
9Saviynt80.7
Saviynt Identity Cloud is a cloud-native converged identity platform combining identity governance and administration with application access governance, privileged access management, identity security posture management and non-human identity governance. Saviynt sells it in Essentials, Pro and Premier tiers to enterprises, and markets AI-agent governance separately as Zuma. saviynt.com
Public ratings (not scored): PeerSpot 3.7 (28 reviews)
| Connectors for SCIM and API apps | The Saviynt Exchange lists 445 apps, 119 of them tagged Saviynt-developed, and Saviynt says it onboards apps with SCIM and REST APIs. Saviynt-developed connectors are included in tier pricing. [1] [2] [3] | |
| Apps with no SCIM and no API | Saviynt describes a vendor-supplied way to bring apps with no integration protocol under management: an AI onboarding agent with a computer-use agent that drives the app UI, and support for web, CLI and thick-client apps. This is described only on product pages, since the docs need a login, and the disconnected-app connectors on the Exchange (Cerby, Redblock, Torch) are partner products. [1] [2] [3] | |
| Entitlements below the group level | Saviynt documents provisioning of fine-grained entitlements below the group level, such as Salesforce entitlements down to object fields, through rules-based and request-based provisioning. [1] [2] | |
| Joiner, mover, leaver from the HRIS | Public pages describe an HR-driven lifecycle from Workday HR records, with access assigned at onboarding and revoked at departure, plus rules-based (ABAC) provisioning. Public pages do not describe mover handling or birthright rules; birthright appears only in a partner services listing, and product docs need a login. [1] [2] | |
| Depth of offboarding | Saviynt describes automatic revocation of access on departure across connected apps. Public pages do not describe session or token revocation, local accounts or ownership transfer at offboarding, and product docs need a login. [1] | |
| Access requests and time-bound access | Self-service requests get risk-based approvals, and Just-in-Time access grants time-bound access and removes it automatically. The pricing page lists just-in-time access in the Pro tier, not Essentials. [1] [2] [3] | |
| Access reviews | Certification campaigns offer AI recommendations, automatic decisions for low-risk items and risk-aware remediation suggestions. Marketing copy implies rejected access is revoked, but public docs do not describe automatic revocation. [1] [2] [3] | |
| Audit evidence and compliance mapping | Reporting controls are mapped to named regulations (SOX, PCI, FedRAMP, HIPAA), a Unified Controls Framework is cross-mapped to standards such as CIS and NIST CSF, and compliance audit reports cover GDPR and SOX. [1] [2] [3] | |
| Separation of duties | Preventive SoD at the access request point is documented, with out-of-the-box rulesets for SAP, Workday and Oracle. These capabilities are presented as Application Access Governance, which the pricing page sells as a separate solution alongside the IGA tiers. [1] [2] [3] | |
| Non-human identities | Saviynt documents discovery of workloads, accounts and credentials, ownership and risk context, and AI agent ownership and offboarding (Zuma). Public pages do not describe credential expiry or rotation, and AI-agent governance is marketed as the separate Zuma platform. [1] [2] | |
| Time to deploy and services needed | The Saviynt commitment of value in less than 12 weeks is tied to its Expert Services packages, and its own success package schedules a deployment review 4 to 6 months after purchase, which points to services-assisted deployments over months. [1] [2] | |
| Pricing transparency and connector cost | No public price, but packaging is public (Essentials, Pro and Premier tiers plus independent solutions), and Saviynt-developed connectors are included. [1] [2] | |
| Enterprise depth | Public docs cover on-prem, ERP, EMR and SAP apps with app-specific SoD rulesets, large-scale deployments, and mainframe RACF through a partner (IdentityForge) connector on the Exchange. Public pages do not describe role mining. [1] [2] [3] [4] |
10One Identity77.9
One Identity Manager is a self-managed identity governance and administration product that runs on-premises, hybrid or in your own cloud. It covers provisioning to on-prem and cloud targets, an IT Shop for access requests, attestation, and compliance rules. A hosted SaaS edition is sold separately as Identity Manager On Demand; scores here cover the self-managed product, based on the version 9.3 guides. oneidentity.com
Public ratings (not scored): PeerSpot 4.1 (194 reviews)
| Connectors for SCIM and API apps | One Identity documents a native SCIM 2.0 connector, says hundreds of cloud connectors are available through One Identity Connect and Starling Connect, and names native integrations (Entra ID, Google, AWS, SAP, Workday, ServiceNow, Epic). The full connector list sits on a support portal that could not be read, so no large catalog could be verified publicly. [1] [2] [3] | |
| Apps with no SCIM and no API | Apps without an automated interface are handled by manual provisioning through ServiceNow tickets, or by modeling them as custom target systems that the customer maps and maintains. [1] [2] [3] | |
| Entitlements below the group level | Public docs describe provisioning of in-app roles and permissions: Entra ID service plans and administration roles, Google admin roles and organizations, and SAP permissions management. [1] [2] [3] | |
| Joiner, mover, leaver from the HRIS | One Identity documents HR data import (for example Workday), automatic account creation from account definitions (birthright), dynamic roles that add and remove access as attributes change (mover), and permanent deactivation on the leaving date. [1] [2] [3] [4] | |
| Depth of offboarding | On leaving, user accounts are locked or deleted and removed from group memberships across connected target systems. Public pages do not describe session or token revocation or ownership transfer as part of offboarding. [1] [2] | |
| Access requests and time-bound access | Users request access through a self-service IT Shop with approval workflows, and products with a validity period are cancelled automatically when the time expires. [1] [2] | |
| Access reviews | Attestation campaigns give reviewers peer group analysis and risk indexes, and denied entitlements can be withdrawn automatically. [1] [2] [3] | |
| Audit evidence and compliance mapping | Compliance frameworks classify attestation policies, compliance rules and company policies by regulation, and access reporting supports compliance. Named regulations (GDPR, PCI-DSS, HIPAA, SOX, ISO 27001) appear only in general marketing copy, not as framework mappings that ship with the product. [1] [2] [3] | |
| Separation of duties | Compliance rules, such as no identity holding entitlements A and B together, are checked inside the IT Shop approval workflow before a request is granted. This requires the Compliance Rules Module. [1] [2] | |
| Non-human identities | Machine and service identities can be modeled with user accounts, permissions and a mandatory manager, and a solutions page says NHIs including API keys and AI agents can be governed. Product docs do not describe NHI discovery, credential expiry or AI-agent lifecycle, so coverage is inventory and ownership only. [1] [2] [3] | |
| Time to deploy and services needed | The product is self-managed, and the installation guide requires a SQL Server database, Job servers running the One Identity Manager Service, and application and web servers. A full installation path is documented, but One Identity does not publish a typical deployment time, a self-serve setup or the services involved. [1] [2] | |
| Pricing transparency and connector cost | No public price and no published packaging: the product page offers only Request Pricing, and module licensing (for example the Compliance Rules Module and Attestation Module) is not published. [1] | |
| Enterprise depth | Public docs cover SAP-certified integration since 2003, Epic, Oracle E-Business Suite, Unix, Active Directory and Entra ID, complex compliance rules and dynamic roles, at large scale. Role mining comes through a partner (NEXIS) integration, and public pages do not describe a mainframe connector. [1] [2] [3] [4] |
Questions
Which IGA platform is best for healthcare?
Iden, in our ranking. It builds connectors for apps with no SCIM and no API itself and ends time-bound access on its date, which covers agency and per-diem staff. Lumos ranks 2nd and SailPoint 3rd; SailPoint suits a large health system with its own IAM team and mainframe or SAP systems.
Does HIPAA require quarterly access reviews?
No. The Security Rule sets no review frequency. 164.308(a)(4)(ii)(C) asks you to establish, document, review and modify access under your own policy, and it is addressable. Set the cadence by risk, the EHR more often than low-risk apps, write it into policy and meet it every cycle.
Sources
- 45 CFR 164.308, Administrative safeguards (eCFR)The workforce security and information access management standards, their Required and Addressable labels, and the business associate requirement in (b). It sets no review frequency and no deadline for terminating access.
- 45 CFR 164.312, Technical safeguards (eCFR)The access control standard, including Required unique user identification and emergency access procedure. It says nothing about how shared workstations should be configured.
- 45 CFR 164.306, Security standards: General rules (eCFR)Paragraph (d)(3) sets what Addressable means: implement the specification, or document why it isn't reasonable and appropriate and adopt an equivalent measure. It does not list which measures count as equivalent.
- 45 CFR 160.103, Definitions (eCFR)Defines workforce to include volunteers, trainees and unpaid persons under the covered entity's direct control. It does not settle whether a particular agency's staff are under your direct control.