1. Home
  2. Cybersecurity, Privacy & Compliance
  3. Identity & Access Management Software
  4. Identity & Access Management Software for Digital Marketing Agencies

Ranking · Identity & Access Management Software

Best Identity & Access Management Software for Digital Marketing Agencies

8 products scored on six criteria. CyberArk leads at 9.1 and the field is tight, with 0.4 points between first and last, so read the catches before you pick. Every product opens to the evidence behind its number.

8 products scored6 criteria97 sources citedUpdated Jul 13, 2026
1 CyberArkcyberark.com

CyberArk wins 7 straight Gartner PAM leader rankings

Read the reviewVisit ↗
2 Oktaokta.com

Okta's integration network passes 7,000 pre-built apps

Read the reviewVisit ↗
3 Thalescpl.thalesgroup.com

Thales includes a free hardware token with every subscription

Read the reviewVisit ↗
8Products
8.7 to 9.1Score spread
0Free plan or tier
01

The ranking

Order follows the score. Six little boxes show each product's criterion scores: green or red is above or below the category average, grey means too few products share that criterion to compare. The full review sits right under each one.

Nothing matches that filter here. Tap All to see every product.

1

CyberArk

cyberark.com · CyberArk Identity Security · scored Dec 2025

CyberArk wins 7 straight Gartner PAM leader rankings

Best forLarge enterprises with complex privileged access needs across hybrid and multi-cloud setups

Quote only SOC 2FedRAMP Highenterprise
Top score

Identity security platform combining privileged access management, workforce SSO/MFA, and secrets management for large enterprises.

Standout factMore than 50% of Fortune 500 companies and 35% of the Global 2000 use CyberArk.topadvisor.com
Biggest catchSetup is complex and often needs specialized consultants or professional services.infisign.ai
50%+Fortune 500 using CyberArktopadvisor.com
110Countries with customerstopadvisor.com
7 yearsGartner MQ Leader streakcyberark.com

Compliance

✓ SOC 2 Type 2✓ FedRAMP High? ISO 27001

Source: cyberark.com

Adoption

50%+of Fortune 500 companies use CyberArk

Source: topadvisor.com

Upside

  • Unifies human and machine identity security
  • FedRAMP High and SOC 2 Type 2 certified
  • 300+ out-of-the-box integrations

Catch

  • High cost versus competitors
  • Complex setup needs consultants
  • Documentation lacks specificity at times
Pick it ifLarge enterprises with complex privileged access needs across hybrid and multi-cloud setups
Skip it ifSMBs with limited security budgets or teams wanting a quick SSO setup
PricingEnterprise pricing, contact sales

Editor's takeCyberArk holds the top Gartner Magic Quadrant spot for privileged access management for seven straight years. Fortune 500 adoption and FedRAMP High authorization support its enterprise security reputation. The tradeoff is cost and setup time, which favor larger IT teams over small ones.

Does CyberArk have FedRAMP certification?

Yes. CyberArk Endpoint Privilege Manager and Workforce Identity both hold FedRAMP High authorization to operate, a standard met by few identity vendors and required by many government agencies.

How many integrations does CyberArk support?

CyberArk lists more than 300 out-of-the-box integrations through its C3 Alliance partner network, covering platforms like AWS, Microsoft, and SailPoint for hybrid environments.

The evidence: 6 criteria, 3 penalties (−0.16 points)
9.5
Product Capability & DepthLooked for: We evaluate the breadth of identity management features, including SSO, MFA, PAM, and lifecycle management for both human and machine identities.CyberArk offers a comprehensive Identity Security Platform that unifies Privileged Access Management (PAM), Workforce Identity (SSO/MFA), and Secrets Management, securing access across hybrid, multi-cloud, and DevOps environments.growhackscale.cominfisign.aig2.com
9.8
Market Credibility & Trust SignalsLooked for: We assess market leadership, analyst rankings, customer adoption rates among major enterprises, and long-standing reputation.CyberArk is a dominant market leader, recognized as a Leader in the Gartner Magic Quadrant for Privileged Access Management for seven consecutive times and trusted by over 50% of the Fortune 500.gartner.comcyberark.comtopadvisor.com
8.4
Usability & Customer ExperienceLooked for: We examine user feedback regarding ease of implementation, interface design, documentation quality, and administrative overhead.While powerful, the platform is frequently cited for its steep learning curve, complex initial setup requiring specialized expertise, and documentation that sometimes lacks specificity.infisign.aipeerspot.comgartner.com
8.2
Value, Pricing & TransparencyLooked for: We analyze pricing models, public availability of costs, and value delivered relative to the financial investment.CyberArk is generally considered a premium, expensive solution with a complex licensing model that often requires professional services, and pricing is not publicly transparent.infisign.aistrongdm.comsennovate.com
9.9
Security, Compliance & Data ProtectionLooked for: We evaluate the product's adherence to rigorous security standards, government certifications, and data protection protocols.CyberArk maintains top-tier security certifications including FedRAMP High Authorization, SOC 2 Type 2, and SOC 3, making it suitable for highly regulated industries and government use.cyberark.comcyberark.comcyberark.com
9.3
Integrations & Ecosystem StrengthLooked for: We look for the breadth of pre-built integrations, API availability, and the strength of the partner ecosystem.The platform boasts over 300 out-of-the-box integrations and a massive C3 Alliance partner ecosystem, ensuring compatibility with a vast array of enterprise tools and cloud platforms.cyberark.comtrafford.plfbcinc.com

Score adjustments−0.16 points in total

−0.07Users consistently report that initial setup and configuration, particularly for the PAM solution, is complex and often requires specialized expertise or professional services.infisign.ai · severity 65/100
−0.04The solution is widely cited as being more expensive than competitors, with a complex pricing model that often necessitates additional budget for implementation and maintenance.strongdm.com · severity 60/100
−0.05Documentation has been criticized by users for lacking specificity, which can complicate the integration and setup process.peerspot.com · severity 45/100
2

Okta

okta.com · Okta IAM · scored Dec 2025

Okta's integration network passes 7,000 pre-built apps

Best forEnterprises requiring extensive pre-built app integrations

From $6 per user/mo FedRAMPSOC 2enterprise

Enterprise identity platform with adaptive MFA, lifecycle management, and the industry's largest pre-built integration network.

Standout factOkta serves more than 18,800 global customers and has been a Gartner Access Management Leader for nine straight years.businesswire.com
Biggest catchA 2023 breach of Okta's customer support system led to downstream attacks on clients including Cloudflare and 1Password.nightfall.ai
7,000+Pre-built integrationsokta.com
18,800+Global customersokta.com
9 yearsGartner Leader streakbusinesswire.com

Standout number

7,000+pre-built integrations in the Okta Integration Network

Source: okta.com

Starting price

$6/user/moStarter Suite, $1,500 annual contract minimum applies

Upside

  • 7,000+ pre-built integrations (OIN)
  • FedRAMP High and SOC 2 Type II certified
  • Gartner Leader for 9 straight years

Catch

  • History of significant security breaches
  • Modular pricing can get expensive
  • Minimum annual contract of $1,500
Pick it ifEnterprises requiring extensive pre-built app integrations
Skip it ifSmall businesses with very tight software budgets
PricingFrom $6 per user monthly, $1,500 minimum annual contract

Editor's takeOkta's identity cloud covers workforce and customer access with SSO, adaptive MFA, and lifecycle provisioning, backed by the Okta Integration Network's 7,000-plus pre-built app connections, the deepest in the category. It has held Gartner Access Management Leader status for nine consecutive years and serves over 18,800 organizations. The scar tissue is security history: a 2023 breach of its support system led to downstream attacks on clients like Cloudflare, despite Okta holding FedRAMP High authorization.

Is Okta's pricing transparent?

Base pricing is public, starting at $6 per user monthly for Starter Suite and $17 for Essentials, but Okta requires a $1,500 minimum annual contract and modular add-ons raise total cost.

Has Okta had a security breach?

Yes. In October 2023, attackers accessed Okta's customer support system and exposed session-related files for 134 customers, leading to follow-on attacks against some of those clients.

The evidence: 6 criteria, 3 penalties (−0.16 points)
9.5
Product Capability & DepthLooked for: We evaluate the breadth of identity features including SSO, MFA, lifecycle management, and directory services tailored for enterprise needs.Okta provides a comprehensive suite including Single Sign-On (SSO), Adaptive Multi-Factor Authentication (MFA), Universal Directory, and Lifecycle Management for automated provisioning.okta.comokta.comapplytosupply.digitalmarketplace.service.gov.uk
9.4
Market Credibility & Trust SignalsLooked for: We assess market leadership, analyst rankings, customer adoption rates, and industry reputation.Okta is a dominant market leader, recognized as a Leader in the Gartner Magic Quadrant for Access Management for nine consecutive years and serving over 18,800 customers.businesswire.comokta.com
8.9
Usability & Customer ExperienceLooked for: We examine end-user ease of access, administrative interface quality, and deployment complexity.Users consistently praise the seamless single sign-on experience and centralized dashboard, though some administrators report that initial configuration and complex integrations can be challenging.okta.comg2.comg2.com
8.7
Value, Pricing & TransparencyLooked for: We analyze pricing structures, transparency of costs, and value relative to features and competitors.Okta uses a modular per-user pricing model that is transparent but can become expensive with add-ons; it requires a minimum annual contract.okta.comokta.comunderdefense.com
9.9
Integrations & Ecosystem StrengthLooked for: We evaluate the quantity and quality of pre-built integrations and the ease of connecting third-party tools.The Okta Integration Network (OIN) is the industry leader with over 7,000 pre-built integrations, covering virtually every major SaaS application and infrastructure provider.okta.commedium.comokta.com
8.5
Security, Compliance & Data ProtectionLooked for: We assess security certifications, compliance standards (FedRAMP, SOC2), and historical breach incidents.Okta holds top-tier certifications including FedRAMP High and SOC 2 Type II, but its score is impacted by significant documented security breaches in 2022 and 2023.trust.okta.combusinesswire.comnightfall.ai

Score adjustments−0.16 points in total

−0.08In October 2023, a threat actor breached Okta's customer support system, accessing files for 134 customers, which led to downstream attacks on clients like Cloudflare and 1Password.nightfall.ai · severity 75/100
−0.04Users report a 'SSO tax' where costs escalate due to modular pricing for essential features like Lifecycle Management and Adaptive MFA.accessowl.com · severity 50/100
−0.04Reviews indicate that the initial setup and configuration can be complex and overwhelming for teams without dedicated identity management expertise.g2.com · severity 40/100
3

Thales

cpl.thalesgroup.com · Thales IAM Solution · scored Dec 2025

Thales includes a free hardware token with every subscription

Best forSecurity-focused enterprises requiring FIPS-validated hardware tokens

FIPS validatedFedRAMPhardware tokens
−0.1 vs #1

High-assurance identity platform pairing cloud SSO with FIPS-validated hardware and PKI tokens.

Standout factOne OTP110 hardware token ships free with the initial STA subscription purchase.assets.applytosupply.digitalmarketplace.service.gov.uk
Biggest catchUsers say customer support responses can be slow and generic for advanced issues.g2.com
FIPS 140-2, EAL 6+Hardware certificationcpl.thalesgroup.com
FIDO2, PKI, OTPAuthentication methods supportedthalestct.com

In their words

“One OTP110 token can be ordered Free of Charge with the initial purchase of an STA subscription.”

assets.applytosupply.digitalmarketplace.service.gov.uk

Compliance

✓ FIPS 140-2✓ FedRAMP✓ SOC 2✓ ISO 27001

Source: cpl.thalesgroup.com

Upside

  • Free hardware token with subscription
  • FIDO2, PKI, and OTP support
  • FIPS 140-2 certified tokens

Catch

  • Support can be slow for advanced issues
  • Admin UI called cumbersome by some
  • Documentation unclear for complex setups
Pick it ifSecurity-focused enterprises requiring FIPS-validated hardware tokens
Skip it ifSMBs wanting a modern, consumer-grade interface
PricingAll-inclusive licensing, one free token with signup

Editor's takeThales SafeNet Trusted Access bridges cloud SSO with physical security, supporting FIDO2, PKI smart cards, and OTP hardware tokens in one console. New subscribers get one OTP110 hardware token free with their initial purchase, and the eToken 5300 line carries FIPS 140-2 and Common Criteria EAL 6+ certification. Some G2 reviewers report slow, generic customer support responses and describe the admin interface as cumbersome for complex integration scenarios.

Does Thales include a free hardware token?

Yes, for new subscribers. One OTP110 token can be ordered free of charge with the initial purchase of an STA subscription, according to a public G-Cloud pricing document.

What certification do Thales hardware tokens carry?

The SafeNet eToken 5300 line is FIPS 140-2 certified and holds Common Criteria EAL 6+ certification at the chip boundary, according to Thales' own product page.

The evidence: 6 criteria, 2 penalties (−0.11 points)
9.1
Product Capability & DepthLooked for: We evaluate the breadth of access management features, including SSO, MFA options, and policy granularity.Thales SafeNet Trusted Access (STA) offers a robust policy engine supporting diverse authentication methods including FIDO2, PKI, and hardware tokens, alongside standard SSO capabilities.cpl.thalesgroup.comcpl.thalesgroup.comthalestct.com
9.4
Market Credibility & Trust SignalsLooked for: We assess the vendor's industry standing, security certifications, and history of reliability in the IAM space.Thales, having acquired Gemalto, is a global leader in digital security with extensive certifications including ISO 27001, SOC 2 Type II, and FedRAMP readiness.danish-french.comcpl.thalesgroup.com
8.4
Usability & Customer ExperienceLooked for: We examine user interface design, ease of deployment, and quality of customer support based on user feedback.While end-user authentication is smooth, administrators report that the management UI can be cumbersome and technical support is sometimes slow to resolve complex issues.cpl.thalesgroup.comg2.comg2.com
9.0
Value, Pricing & TransparencyLooked for: We evaluate pricing models, transparency, and inclusion of essential features like tokens in the base cost.Thales offers a transparent, all-inclusive pricing model that notably includes hardware or software tokens in the license cost, avoiding hidden fees.cpl.thalesgroup.comcpl.thalesgroup.comassets.applytosupply.digitalmarketplace.service.gov.uk
9.3
Authentication Versatility & Hardware SupportLooked for: We look for the range of supported authentication methods, specifically bridging physical hardware and cloud software.The solution uniquely bridges cloud IAM with physical security, supporting FIDO2, PKI smart cards, and classic OTP hardware tokens in a single platform.cpl.thalesgroup.comthalestct.comcpl.thalesgroup.com
9.6
Security, Compliance & Data ProtectionLooked for: We analyze the product's adherence to high-security standards, government regulations, and encryption capabilities.Thales excels here with FIPS 140-2 validated tokens, FedRAMP support, and a strong heritage in hardware security modules (HSMs) and encryption.cpl.thalesgroup.comcpl.thalesgroup.comcpl.thalesgroup.com

Score adjustments−0.11 points in total

−0.06Users report slow and generic responses from customer support, particularly for advanced technical issues.g2.com · severity 60/100
−0.05Administrators describe the integration process and UI features as 'cumbersome and unintuitive' in some scenarios.g2.com · severity 50/100
4

Rippling

rippling.com · Rippling Identity Management · scored Dec 2025

600+ app provisioning, but requires the core HRIS

Best forMid-sized companies wanting to unify HR and IT

From $8 per user/mo HR-driven access600+ integrationsSOC 2
−0.2 vs #1

Identity and device management platform that ties access automatically to HR employee data.

Standout factAutomates provisioning across more than 600 pre-built app integrationsrippling.com
Biggest catchIdentity Management cannot be bought standalone; it requires the core Rippling Unity subscription.accessowl.com
$8/user/moIdentity Management starting pricerippling.com
4.8/5, 10,000+ reviewsG2 ratingrippling.com

Standout number

600+pre-built app integrations for provisioning

Source: rippling.com

Compliance

✓ SOC 2 Type II✓ ISO 27001✓ ISO 42001

Source: rippling.com

Upside

  • 600+ pre-built app integrations
  • Access auto-updates from HR data
  • SOC 2, ISO 27001, ISO 42001

Catch

  • Requires core HRIS subscription
  • Support routes through admins only
  • Steep curve for advanced rules
Pick it ifMid-sized companies wanting to unify HR and IT
Skip it ifCompanies needing standalone IAM without HR features
PricingFrom $8/user/mo, plus a mandatory $35/mo base platform fee

Editor's takeRippling ties access permissions directly to HR data, so provisioning updates instantly when a role changes. It connects to over 600 apps and holds SOC 2 Type II, ISO 27001, and ISO 42001 certifications. Identity Management is not sold standalone, so buyers must first subscribe to the core Rippling Unity platform.

Can I buy Rippling Identity Management on its own?

No. It requires a subscription to the core Rippling Unity platform before Identity Management can be added.

How many app integrations does Rippling support?

Over 600 pre-built integrations for user provisioning, deprovisioning, and single sign-on.

The evidence: 6 criteria, 3 penalties (−0.15 points)
9.0
Product Capability & DepthLooked for: We evaluate the breadth of identity features, including SSO, MFA, lifecycle management, and the ability to handle complex provisioning workflows.Rippling combines Identity and Access Management (IAM) with Device Management (MDM) and HRIS data, allowing for automated provisioning across 600+ apps based on employee role, department, and status.rippling.comrippling.comrippling.com
9.2
Market Credibility & Trust SignalsLooked for: We assess market presence, user adoption, third-party reviews, and the reliability of the vendor in the enterprise software space.Rippling holds dominant ratings on major review platforms like G2 and Capterra, backed by a large user base and significant venture capital funding.rippling.comrippling.com
8.9
Usability & Customer ExperienceLooked for: We look for intuitive design, ease of setup, quality of documentation, and the responsiveness of customer support channels.Users consistently praise the clean, modern interface and fast onboarding, though some report a steep learning curve for advanced automation features and gated support access.rippling.comemployborderless.comconnecteam.com
8.5
Value, Pricing & TransparencyLooked for: We evaluate pricing models, hidden fees, contract terms, and whether the product offers good ROI relative to competitors.Rippling uses a modular pricing model starting at $8/user/month, but requires the core HRIS platform and hides final costs behind custom quotes.rippling.comrippling.comcloudappcritic.com
9.1
Integrations & Ecosystem StrengthLooked for: We examine the library of pre-built integrations, API quality, and support for standards like SAML, SCIM, and OIDC.The platform boasts over 600 pre-built integrations with deep provisioning capabilities, plus support for custom SAML and SCIM apps.rippling.comrippling.comrippling.com
9.3
Security, Compliance & Data ProtectionLooked for: We review security certifications, encryption standards, compliance tools, and features like MFA and device enforcement.Rippling maintains an impressive array of certifications including SOC 2 Type II, ISO 27001, and the rare ISO 42001 for AI safety.rippling.comrippling.comrippling.com

Score adjustments−0.15 points in total

−0.05Platform Dependency: Customers cannot purchase Identity Management as a standalone product; subscription to the core HRIS 'Unity' platform is mandatory.accessowl.com · severity 70/100
−0.06Gated Support Model: Regular employees are blocked from contacting support directly; all tickets must be routed through company administrators.connecteam.com · severity 60/100
−0.04Opaque Pricing: Specific costs for modules and implementation are not publicly listed and require a sales quote, with reports of hidden implementation fees.employborderless.com · severity 50/100
5

Delinea

delinea.com · Delinea Identity Security · scored Dec 2025

Delinea leads Gartner's PAM ranking, support runs slow.

Best forEnterprises wanting PAM with usability and fast deployment.

Quote only FedRAMP High (pending)SOC 2ISO 27001
−0.3 vs #1

A cloud-native privileged access management platform combining AI authorization with faster deployment.

Standout factDelinea has been named a Gartner Magic Quadrant PAM Leader 6 times running.delinea.com
Biggest catchSome support tickets reportedly sit unresolved for weeks to months.reddit.com
6 yearsGartner MQ Leader streakdelinea.com
~$19,705Median annual priceinfisign.ai

Standout number

6 yearsconsecutive Gartner Magic Quadrant PAM Leader

Source: delinea.com

Starting price

~$19,705/year (median)Per Vendr third-party data; some report extra EC2 costs

Upside

  • 6-time Gartner PAM Leader
  • Iris AI for real-time authorization
  • Deploys in weeks, not months

Catch

  • Support response called slow
  • Hidden EC2 infrastructure costs reported
  • Mobile app rated poorly
Pick it ifEnterprises wanting PAM with usability and fast deployment.
Skip it ifSmall businesses needing only basic password management.
PricingCustom quote. Median buyer price around $19,705/year, per third-party data.

Editor's takeDelinea has been named a Gartner Magic Quadrant PAM Leader six years running, backed by Iris AI. Users consistently rate its interface easier than legacy PAM tools like CyberArk, and deployment runs weeks instead of months. The gaps show in support, with Reddit threads describing tickets unresolved for weeks and surprise EC2 charges.

How much does Delinea cost?

Pricing is not public. Third-party data from Vendr shows a median buyer price around $19,705 a year, though some users report surprise extra costs for cloud infrastructure.

Is Delinea easier to use than CyberArk?

Reviewers generally say yes for the interface, rating it 4.7 out of 5 on Gartner Peer Insights, though support response times and the mobile app draw more complaints.

The evidence: 6 criteria, 3 penalties (−0.18 points)
9.0
Product Capability & DepthLooked for: We evaluate the breadth of privileged access features, including vaulting, session management, and AI-driven authorization capabilities.Delinea offers a comprehensive cloud-native PAM platform featuring 'Vault AI' for credential governance, 'Secure AI' for entitlement management, and 'Iris AI' for real-time authorization and auditing.delinea.comdelinea.comdelinea.com
9.4
Market Credibility & Trust SignalsLooked for: We look for industry analyst recognition, market presence, and adoption by major enterprises or government entities.Delinea holds top-tier analyst rankings from Gartner and Forrester and is currently 'Under Assessment' for FedRAMP High authorization, signaling strong federal trust.securitybrief.com.aupr.sandyjournal.com
8.7
Usability & Customer ExperienceLooked for: We assess the ease of deployment, user interface quality, and the responsiveness of customer support channels.Users consistently praise the UI as more intuitive than competitors like CyberArk, though significant complaints exist regarding support responsiveness and mobile app quality.delinea.cominfisign.aiinfisign.ai
8.5
Value, Pricing & TransparencyLooked for: We evaluate pricing models, transparency of costs, and the presence of hidden fees or unexpected infrastructure charges.Pricing is generally quote-based with some reseller transparency, but users have reported unexpected costs for cloud infrastructure components like EC2 instances.delinea.cominfisign.aig2.com
9.2
Security, Compliance & Data ProtectionLooked for: We examine security certifications, encryption standards, and compliance with federal or industry regulations.Delinea maintains robust security standards including SOC 2 Type II, ISO 27001, and is actively pursuing FedRAMP High authorization.prnewswire.comtrust.delinea.com
8.8
Integrations & Ecosystem StrengthLooked for: We assess the availability of pre-built integrations, API quality, and the breadth of the technology partner ecosystem.The platform offers a wide range of integrations (AWS, Azure, Okta, ServiceNow) but some users report difficulties with API access in the SaaS version.docs.delinea.comgartner.com

Score adjustments−0.18 points in total

−0.07Multiple users report slow response times and unhelpful resolutions from technical support, with some tickets sitting for weeks.reddit.com · severity 65/100
−0.04Customers have reported unexpected hidden costs for supplementary EC2 instances required for the solution.g2.com · severity 60/100
−0.07Some users describe the unified platform as feeling 'unfinished' with bugs and a clunky interface in certain modules.infisign.ai · severity 50/100
6

Optimal IdM

optimalidm.com · Optimal IdM IAM Suite · scored Dec 2025

Optimal IdM charges a flat fee, not per user

Best forEnterprises with complex multi-forest Active Directory wanting flat-fee pricing.

From $25,000 per month flat-fee pricingmulti-forest ADprivate cloud
−0.3 vs #1

An IAM suite that merges multi-forest directories without syncing, billed at a flat monthly rate instead of per user.

Standout factThe Virtual Identity Server integrates with more than 5,000 federated applications.globenewswire.com
Biggest catchHistorical reviews cite monthly costs easily running in the $25,000 to $30,000 range.pcmag.com
5,000+Federated applications supportedglobenewswire.com
$25,000-$30,000Historical monthly fee rangepcmag.com

Standout number

5,000+federated applications integrated with VIS

Source: globenewswire.com

Starting price

$25,000/moHistorically cited flat-fee range, per PCMag review

Upside

  • Flat monthly fee, not per user
  • Virtual Identity Server skips syncing
  • Private single-tenant cloud option

Catch

  • Historically priced near $25k a month
  • Interface feels outdated to some
  • Steep learning curve for admins
Pick it ifEnterprises with complex multi-forest Active Directory wanting flat-fee pricing.
Skip it ifDevelopers wanting a large self-service API ecosystem.
PricingFlat monthly fee, historically cited near $25,000-$30,000/mo

Editor's takeOptimal IdM's Virtual Identity Server merges AD, LDAP and SQL directories into one view without synchronization, a real advantage for messy multi-forest environments. The flat monthly fee model rewards large organizations more than small ones, since historical pricing reports put entry costs in five figures a month.

What is the Virtual Identity Server?

It is Optimal IdM's core technology, a universal directory that abstracts and merges data from sources like Active Directory, LDAP and SQL without altering the backend data or requiring synchronization.

How is Optimal IdM priced?

The OptimalCloud uses a flat monthly fee rather than per-user pricing. Historical reviews put that fee in the $25,000 to $30,000 per month range for larger deployments.

The evidence: 6 criteria, 3 penalties (−0.13 points)
8.7
Product Capability & DepthLooked for: We evaluate the breadth of identity management features, including SSO, MFA, directory virtualization, and lifecycle management capabilities.Optimal IdM provides a comprehensive suite centered on its Virtual Identity Server (VIS), which aggregates data from multiple sources (AD, LDAP, SQL) without requiring synchronization, alongside robust SSO and MFA offerings.optimalidm.comoptimalidm.complatform.softwareone.com
9.2
Market Credibility & Trust SignalsLooked for: We assess industry recognition, years in operation, and third-party validations such as analyst reports and certifications.Founded in 2005, Optimal IdM is a long-standing player with SOC 2 Type II and ISO 27001 certifications, previously recognized as a 'Niche Player' in Gartner's Magic Quadrant.optimalidm.comoptimalidm.com
8.9
Usability & Customer ExperienceLooked for: We examine user feedback regarding ease of use, interface design, and the quality of customer support services.Users consistently praise the 'concierge' level support and responsiveness, though some reviews note the interface can be outdated and the system has a learning curve.optimalidm.comgartner.comsaashub.com
8.5
Value, Pricing & TransparencyLooked for: We analyze pricing models, transparency, and overall value proposition compared to market standards.Optimal IdM offers a unique 'flat monthly fee' model for enterprises, which can offer significant savings over per-user pricing, though the entry cost may be high for smaller firms.optimalidm.comoptimalidm.compcmag.com
9.3
Security, Compliance & Data ProtectionLooked for: We evaluate the product's security infrastructure, compliance certifications, and data privacy features.The platform offers a private dedicated cloud option (single-tenant) and maintains rigorous compliance standards including GDPR, SOC 2, and ISO 27001.optimalidm.comoptimalidm.comoptimalidm.com
8.8
Integrations & Ecosystem StrengthLooked for: We look for the ability to integrate with various directories, applications, and identity standards.The Virtual Identity Server excels at integrating disparate on-premise directories (AD, LDAP, Oracle) and supports standard federation protocols for thousands of apps.optimalidm.comoptimalidm.comoptimalidm.com

Score adjustments−0.13 points in total

−0.04High entry cost barrier for smaller organizations, with historical reviews citing monthly fees in the $25,000 range.pcmag.com · severity 60/100
−0.05Users have reported a steep learning curve and an interface that can feel outdated compared to modern competitors.saashub.com · severity 45/100
−0.04The company has been excluded from some recent major analyst reports (like the 2020 Gartner MQ) due to not meeting specific revenue or growth criteria.solutionsreview.com · severity 40/100
7

CDW

cdw.com · CDW IAM Solutions · scored Dec 2025

CDW charges about 30% more than competitors, per users

Best forEnterprises wanting a managed IAM consultancy across multiple vendor platforms.

Quote only managed servicevendor-agnosticGDPR
−0.4 vs #1

Vendor-agnostic IAM consultancy that architects and manages identity solutions from Okta, Microsoft, and CyberArk.

Standout factCDW acquired Focal Point Data Risk to deepen its identity and data protection consulting.msspalert.com
Biggest catchOne user reports CDW pricing runs about 30% higher than competitors.reddit.com
15+Years focused on IAMwebobjects2.cdw.com
~30%Reported price premiumreddit.com

In their words

“Anything I buy off cdw is roughly 30% more expensive than competitors.”

reddit.com

Connects to

Microsoft Entra IDOktaPing IdentityCyberArkIBM Security VerifyMultiple IAM vendors total

Source: cdw.com

Upside

  • Vendor-agnostic across Okta, Microsoft, CyberArk
  • 15+ years of dedicated IAM focus
  • Acquired Focal Point Data Risk consultancy

Catch

  • Pricing runs about 30% higher, per users
  • Account manager response times vary
  • No proprietary IAM software of its own
Pick it ifEnterprises wanting a managed IAM consultancy across multiple vendor platforms.
Skip it ifSMBs wanting a direct-purchase, self-serve SaaS tool without sales calls.
PricingContact for pricing, custom-quoted

Editor's takeCDW does not build its own identity software. Instead it architects and manages IAM programs across partners like Microsoft Entra ID, Okta, and CyberArk. That vendor-agnostic model, backed by the Focal Point Data Risk acquisition, suits large enterprises juggling several identity platforms. Reddit users report slow account management and pricing around 30 percent above competitors.

Does CDW sell its own IAM software?

No. CDW is a consultancy and managed service that designs and implements identity solutions built by partners like Microsoft, Okta, Ping Identity, and CyberArk.

Is CDW a good fit for a small business?

Usually not. Reviewers report inconsistent support for smaller accounts and pricing that runs higher than buying directly from a single vendor.

The evidence: 6 criteria, 2 penalties (−0.11 points)
8.9
Product Capability & DepthLooked for: We look for comprehensive identity management features including SSO, MFA, lifecycle management, and privileged access control tailored to complex enterprise needs.CDW delivers a full spectrum of IAM services including strategy, assessments, and implementation for major platforms like Microsoft Entra ID, Okta, Ping Identity, and CyberArk, covering IGA, PAM, and CIAM use cases.webobjects2.cdw.comcdw.com
9.2
Market Credibility & Trust SignalsLooked for: We look for established market presence, financial stability, and proven expertise in delivering security solutions to large organizations.As a Fortune 500 company with over 15 years of IAM focus, CDW reinforced its credibility by acquiring Focal Point Data Risk to deepen its security consulting and identity management expertise.msspalert.comwebobjects2.cdw.com
8.2
Usability & Customer ExperienceLooked for: We look for responsive support, ease of engagement, and effective service delivery that minimizes friction for the client's IT team.While their technical engineering teams are praised for expertise, recent customer feedback highlights significant issues with account management responsiveness and declining service quality for non-enterprise clients.reddit.comreddit.com
8.0
Value, Pricing & TransparencyLooked for: We look for competitive pricing structures, clear cost visibility, and a demonstrable return on investment compared to direct vendor engagement.Pricing is custom-quoted and often described by users as higher than competitors, with some reports citing a premium of up to 30% for hardware and services compared to other channels.reddit.comcdw.com
9.1
Security, Compliance & Data ProtectionLooked for: We look for expertise in regulatory frameworks, Zero Trust architecture, and the ability to secure sensitive data against modern threats.They offer specialized assessments for Zero Trust and regulatory compliance (GDPR, HIPAA), supported by the deep security consulting capabilities acquired through Focal Point Data Risk.webobjects2.cdw.comcdw.com
9.4
Integrations & Ecosystem StrengthLooked for: We look for the ability to integrate with a wide range of existing IT infrastructure, applications, and third-party security tools.CDW's vendor-agnostic approach allows them to architect and integrate solutions involving virtually any major IAM vendor, including Microsoft, Okta, Ping, and Delinea, into complex hybrid environments.delinea.comcdw.com

Score adjustments−0.11 points in total

−0.07Users report significant difficulties in reaching account representatives and receiving timely support, particularly for small to mid-sized businesses.reddit.com · severity 65/100
−0.04Multiple customer reports indicate pricing is often higher than competitors, with some citing a premium of around 30%.reddit.com · severity 50/100
8

OpenText

opentext.com · OpenText Identity Management · scored Dec 2025

OpenText IAM scales past 50 million identities but looks dated

Best forEnterprises with complex hybrid environments needing extreme identity scale.

Quote only Common Criteria EAL3+enterprise scaleidentity governance
−0.4 vs #1

Enterprise identity governance platform managing over 50 million identities with real-time, event-based synchronization.

Standout factOne OpenText customer manages more than 50 million identity objects, including entire countries.youtube.com
Biggest catchReviewers describe the interface and Designer tool as old, outdated, and archaic.peerspot.com
50M+Identities managed, case studyyoutube.com
Common Criteria EAL3+Security certificationopentext.com
KuppingerCole Leader, 2024Analyst recognitionblogs.opentext.com

Standout number

50M+identity objects managed by one customer

Source: youtube.com

Learning curve

AfternoonWeeks

Large-scale installation called not trivial; interface described as outdated

Upside

  • Scales past 50 million identities
  • Common Criteria EAL3+ certified
  • Real-time event-based sync

Catch

  • Steep learning curve for admins
  • Interface looks old and outdated
  • Complex installation and upgrades
Pick it ifEnterprises with complex hybrid environments needing extreme identity scale.
Skip it ifSmall IT teams wanting a modern, lightweight, quick-setup SaaS tool.
PricingPriced per managed identity, custom quote only, not published.

Editor's takeOpenText Identity Manager targets the largest, most complex identity environments, with one documented customer managing more than 50 million objects across entire countries. KuppingerCole named it a Leader in its 2024 IGA Leadership Compass, and it holds Common Criteria EAL3+ certification. Reviewers call the interface and Designer tool outdated, and installation at scale is described as far from trivial.

How many identities can OpenText manage?

One documented customer runs more than 50 million identity objects, including entire countries, according to an OpenText presentation. The platform is built to scale to billions.

Is OpenText Identity Manager easy to set up?

Not especially. G2 reviewers describe large-scale installation as not trivial, and Peerspot reviewers call the interface old and outdated.

The evidence: 6 criteria, 3 penalties (−0.19 points)
9.1
Product Capability & DepthLooked for: We evaluate the breadth of identity lifecycle management features, including provisioning, workflow automation, and role-based access control capabilities.OpenText Identity Manager offers an intelligent identity framework that automates the entire lifecycle from onboarding to deprovisioning, supporting event-based real-time synchronization across physical, virtual, and cloud environments.opentext.comopentext.comopentext.com
9.0
Market Credibility & Trust SignalsLooked for: We assess industry recognition, analyst ratings, and the vendor's history of serving high-security or large-scale enterprise clients.OpenText (formerly NetIQ) is recognized as an Overall Leader in the 2024 KuppingerCole Leadership Compass for IGA and holds significant security certifications like Common Criteria EAL3+.securitymagazine.comblogs.opentext.comopentext.com
8.1
Usability & Customer ExperienceLooked for: We look for user interface design, ease of implementation, and the quality of administrative tools for daily operations.While powerful, the platform is frequently cited for its steep learning curve, complex installation process, and interface elements that some users find outdated.opentext.comg2.compeerspot.com
8.5
Value, Pricing & TransparencyLooked for: We evaluate pricing models, transparency of costs, and the perceived return on investment for the target market.Pricing is typically based on a 'per managed identity' model or subscription, but specific costs are not public; users generally find high value for complex enterprise use cases.opentext.comg2.comnetiq.com
9.3
Scalability & PerformanceLooked for: We verify security certifications, compliance features, and the ability to meet rigorous government or industry standards.OpenText Identity Manager holds Common Criteria EAL3+ certification and offers robust governance features like automated access certification and segregation of duties.opentext.comyoutube.comopentext.com
9.1
Integrations & Ecosystem Strengthopentext.com

Score adjustments−0.19 points in total

−0.08Users report a steep learning curve and complex installation process, particularly for large-scale deployments.g2.com · severity 75/100
−0.06The user interface and design software (Designer) are described by some customers as old, outdated, or archaic.peerspot.com · severity 60/100
−0.05Documentation can be fragmented or difficult to navigate, with some users noting challenges in finding specific configuration details.g2.com · severity 45/100
02

Side by side

10 features across 8 products. Green is yes, red is no, grey is not published.

FeatureCyberArkOktaThalesRipplingDelineaOptimal IdMCDWOpenText
Has Mobile App
Has Free Plan
Has Free Trial Contact for trial Contact for trial Contact for trial Contact for trial Contact for trial Contact for trial
Integrates With Zapier
Has Public API
Live Chat Support
SOC 2 or ISO Certified Both
Popular Integrations Google Workspace, Salesforce, Microsoft 365 Slack, Salesforce, Google Workspace
Supports SSO
Starting Price Contact for pricing $6 per user/mo Enterprise pricing available $8 per user/mo Contact for pricing $25,000 per month Contact for pricing Contact for pricing
03

How we chose

Four fixed criteria for every product, plus two chosen for Identity & Access Management Software for Digital Marketing Agencies, weighted and reduced by documented penalties.

Full methodology
Criteria set for this categoryProduct Capability & Depth, Market Credibility & Trust Signals, Usability & Customer Experience, Value, Pricing & Transparency, Security, Compliance & Data Protection, Integrations & Ecosystem Strength
Evidence, then a scoreDocumentation, pricing pages, security pages and third-party reviews. Each criterion records what was found and links its sources.
Penalties, then a rankDocumented problems pull the score down with their evidence attached. Rank follows the score. Sponsored rows, where present, are labelled.
iThe methodology for selecting and ranking Identity & Access Management (IAM) software for digital marketing agencies involved a comprehensive evaluation of key factors such as specifications, features, customer reviews, and overall ratings.
Albert Richer
Albert RicherFounder · Memphis, TN

Sets the criteria and reviews the evidence before a ranking publishes. Email him if something here looks wrong.

04

Questions people ask

Does CyberArk have FedRAMP certification?

Yes. CyberArk Endpoint Privilege Manager and Workforce Identity both hold FedRAMP High authorization to operate, a standard met by few identity vendors and required by many government agencies.

How many integrations does CyberArk support?

CyberArk lists more than 300 out-of-the-box integrations through its C3 Alliance partner network, covering platforms like AWS, Microsoft, and SailPoint for hybrid environments.

Is Okta's pricing transparent?

Base pricing is public, starting at $6 per user monthly for Starter Suite and $17 for Essentials, but Okta requires a $1,500 minimum annual contract and modular add-ons raise total cost.

Has Okta had a security breach?

Yes. In October 2023, attackers accessed Okta's customer support system and exposed session-related files for 134 customers, leading to follow-on attacks against some of those clients.

Does Thales include a free hardware token?

Yes, for new subscribers. One OTP110 token can be ordered free of charge with the initial purchase of an STA subscription, according to a public G-Cloud pricing document.

What certification do Thales hardware tokens carry?

The SafeNet eToken 5300 line is FIPS 140-2 certified and holds Common Criteria EAL 6+ certification at the chip boundary, according to Thales' own product page.

Can I buy Rippling Identity Management on its own?

No. It requires a subscription to the core Rippling Unity platform before Identity Management can be added.

How many app integrations does Rippling support?

Over 600 pre-built integrations for user provisioning, deprovisioning, and single sign-on.

How is the best Identity & Access Management Software for Digital Marketing Agencies decided?

Every product is scored on six criteria for this category, with cited evidence and documented penalties. Rank follows the overall score. Vendors cannot pay for a position.

How often is this ranking updated?

Products are re-scored when pricing, features or evidence change. This ranking was last updated July 13, 2026.

05

More in Identity & Access Management Software

5 related rankings.

All of Identity & Access Management
Research

Machine identities outnumber human identities 500 to 1 in cloud-native infrastructures

Mar 30, 2026

Support centers face 40% annual turnover—more than double the 16% industry average

May 21, 2026

Organizations only recover 57% of data after ransomware attacks hit 41% of systems

May 4, 2026