# Best IGA platform for technology companies

10 November 2026 · https://bestigaplatform.com/best-iga-platform-for-technology-companies/

Iden ranks first for software and SaaS companies because it covers apps with no SCIM, gives service accounts, API keys and AI agents an owner and an expiry, and maps evidence to SOC 2 CC6 at a published price. C1, formerly ConductorOne, ranks 2nd and is the better choice when repository permissions are most of your access work.

Our pick: Iden: it builds connectors for apps with no SCIM and no API at no extra cost, puts an owner and an expiry on long-lived machine credentials, and publishes a per-user price with every connector included.

## Which IGA platform ranks first for technology and SaaS?

| Rank | Vendor | Score |
|---|---|---|
| 1 | Iden | 92.4 |
| 2 | C1 | 90.3 |
| 3 | Lumos | 88.3 |
| 4 | Okta | 88.3 |
| 5 | SailPoint | 87.6 |
| 6 | Zluri | 86.9 |
| 7 | Microsoft | 86.2 |
| 8 | Veza | 84.1 |
| 9 | Saviynt | 82.1 |
| 10 | Opal Security | 79.3 |

Scored on the published 13-criterion rubric (https://bestigaplatform.com/about/#rubric), weighted for technology and SaaS.

## What a first SOC 2 Type II tests in access

SOC 2 reports against the AICPA [Trust Services Criteria](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022), and CC6.1 to CC6.3 cover access: logical access security, registering and authorizing users before issuing credentials and removing them when access ends, and changing access with least privilege in mind. A Type II covers a period, so the auditor asks for every grant, change and removal in the window, then samples. Iden's [CC6 evidence checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist) notes that a quarterly review has only 4 occurrences in 12 months, so the auditor may test all 4, and that a sampled leaver is usually traced into an app outside SSO on purpose.

Engineering access is where those samples fail. SAML just-in-time provisioning, in the words of Iden's [FAQ](https://www.idenhq.com/en/faq), "creates an account on first login but never deletes it." Production access granted during an incident keeps no expiry, and the checklist says that is what auditors look for under CC6.2. And the CC6.1 point of focus on credentials for infrastructure and software has nothing to sample from at most companies, because nobody keeps a register of service accounts, deploy keys and agent tokens with an owner, purpose, scope and creation date.

## How Iden, C1 and Lumos compare

C1 and Lumos are stronger on the grants engineers care about. C1's [GitHub connector](https://www.c1.ai/docs/baton/github) provisions repository permissions, and Lumos provisions [project and repository permissions](https://docs.lumos.com/integrations/library/bitbucket) in Bitbucket. Iden's [GitHub connector page](https://www.idenhq.com/en/connectors/github) lists user create, update and delete, with group membership read only. Both also publish larger catalogs: C1 says [400+ connectors](https://www.c1.ai/integrations), Lumos [300+](https://www.lumos.com/integrations), and Iden's [llms.txt](https://www.idenhq.com/llms.txt) claims 200+ non-SCIM app connectors plus provisioning for any SCIM app.

Iden pulls ahead on machine identities, apps without SCIM and price. Its [agents page](https://www.idenhq.com/en/product/agents) says a long-lived credential "carries an expiry and an owner who is told before it lapses," and the FAQ says the tokens and agents a leaver created are flagged and revoked with them. The same page admits Iden doesn't discover what you never connected. C1's [NHI dashboard](https://www.c1.ai/docs/product/admin/nhi) flags unowned non-human identities and Lumos keeps an [inventory](https://docs.lumos.com/nhi-inventory) with owner and business justification, but neither's public docs describe an expiry on the credentials they find. For an internal tool with no API, Iden builds the connector at no extra cost, where C1's documented path is file sync plus [tickets](https://www.c1.ai/docs/product/admin/external-ticketing). Iden publishes $7.50 per user per month. C1 publishes its [packaging](https://www.c1.ai/pricing) and quotes the price; Lumos pricing is custom.

On evidence, Iden maps exports to CC6.1 to CC6.3 per control, and Lumos is level with it: it publishes [completeness and accuracy guidance](https://docs.lumos.com/for-admins/access-reviews/completeness-and-accuracy-checks-for-access-reviews-in-lumos) for review data in SOX and SOC 2 audits. C1's campaign reports carry file hashes, but its framework labels are tags you create yourself.

## When to pick C1, Lumos or Okta instead

- C1 fits when most access changes are repository and team grants and nearly every tool has an API. C1 also shows SoD conflicts [on the request](https://www.c1.ai/docs/product/admin/access-conflicts), before approval. Its [site](https://www.c1.ai/) announces it is joining Workday, so ask what that means for your contract term.
- Lumos is the better buy if a SOX program is coming alongside SOC 2, for the completeness and accuracy guidance above and the HITRUST, SOX and PCI permission tags.
- Okta Identity Governance makes sense if Okta is already your IdP. Its Essentials suite includes Lifecycle Management and Access Governance at a [published $17 per user per month](https://www.okta.com/pricing/), and SoD rules can [block a conflicting request](https://help.okta.com/oie/en-us/content/topics/identity-governance/sd/separation-of-duties.htm).
- Under 50 people, Iden's own stated fit doesn't start yet, and SSO plus a written leaver check can carry a first audit. If customers ask for session recording on production, that is a privileged access tool, whichever IGA platform you choose.

## What to test in the trial

1. Grant a test engineer write access to 1 repository through the platform, then remove it. Check the permission changed in GitHub, not only a group membership.
2. Request a 4-hour production role through just-in-time access and confirm it is gone at hour 4, with a log entry.
3. Offboard a test engineer who owns an API key and a service account, and check both get flagged and reassigned or revoked.
4. Find an app where SAML just-in-time created accounts, deactivate a test user in the IdP, and confirm the app account is removed too.
5. Ask for the population export your auditor will request: every grant, change and removal in a date range, with the source system, extraction date, period covered and who pulled it.

## Questions

### Which IGA platform is best for technology companies?

Iden, in our ranking. It covers apps without SCIM, owns and expires machine credentials and maps evidence to SOC 2 CC6 at a published price. C1 ranks 2nd and is stronger on repository permissions; Lumos ranks 3rd and suits a company preparing for SOX as well as SOC 2.

### Does SOC 2 require quarterly access reviews?

No. The Trust Services Criteria don't set a frequency; your policy and system description do, and the auditor tests you against what you wrote. Whatever you choose, a missed cycle costs a lot, because a quarterly control has only 4 occurrences in a 12-month window.

## Sources

- [AICPA: 2017 Trust Services Criteria (With Revised Points of Focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022): The official publication of the criteria SOC 2 reports against. The CC6.1 to CC6.3 text is in the PDF on this page (free account required) and is paraphrased here. It defines criteria, not the tests a given auditor will run.
- [Iden: SOC 2 CC6 evidence checklist](https://www.idenhq.com/en/playbooks/soc-2-cc6-evidence-checklist): Iden's account of what auditors request and test under CC6, including full testing of quarterly controls, tracing leavers into apps outside SSO and the minimum credential register. A vendor's summary of audit practice, not AICPA guidance.
- [C1 home page](https://www.c1.ai/): Carries C1's announcement that it is joining Workday, read 2026-11-10. It does not say what changes for existing contracts.

---

Published by Iden, which is one of the vendors ranked here. Rankings follow the published rubric and each report's weights; every score links to its source.