1. Home
  2. Cybersecurity, Privacy & Compliance
  3. Identity & Access Management Software
  4. Identity & Access Management Software for Marketing Agencies

Ranking · Identity & Access Management Software

Best Identity & Access Management Software for Marketing Agencies

10 products scored on six criteria. CyberArk leads at 9.1 and the field is tight, with 0.4 points between first and last, so read the catches before you pick. Every product opens to the evidence behind its number.

10 products scored6 criteria115 sources citedUpdated Aug 27, 2026
1 CyberArkcyberark.com

7-time Gartner PAM Leader, steep cost and setup

Read the reviewVisit ↗
2 Oktaokta.com

Okta connects 7,000+ apps but requires a $1,500 minimum

Read the reviewVisit ↗
3 Thalescpl.thalesgroup.com

Thales bundles tokens and support into one flat price

Read the reviewVisit ↗
10Products
8.7 to 9.1Score spread
1Free plan or tier
01

The ranking

Order follows the score. Six little boxes show each product's criterion scores: green or red is above or below the category average, grey means too few products share that criterion to compare. The full review sits right under each one.

Nothing matches that filter here. Tap All to see every product.

1

CyberArk

cyberark.com · CyberArk Identity Security · scored Dec 2025

7-time Gartner PAM Leader, steep cost and setup

Best forLarge enterprises securing privileged accounts in regulated industries.

From $2 per user/mo FedRAMPSOC 2ISO 27001
Top score

A unified identity security platform securing human and machine accounts with FedRAMP High authorization.

Standout factGartner Magic Quadrant Leader for Privileged Access Management for 7 straight cyclescyberark.com
Biggest catchDeployment is often complex, requiring professional services for large environments.trustradius.com
7Years as Gartner PAM Leadercyberark.com
960+Marketplace integrationscommunity.cyberark.com
$2/user/moWorkforce Identity starting priceg2.com

Standout number

7 yearsas Gartner PAM Magic Quadrant Leader

Source: cyberark.com

Connects to

AWSAzureSalesforceMicrosoft 365IBM QRadar960+ total

Source: community.cyberark.com

Upside

  • 7-time Gartner PAM Leader
  • FedRAMP High authorization
  • 960+ marketplace integrations

Catch

  • High total cost of ownership
  • Complex deployment needs pro services
  • Steep learning curve for admins
Pick it ifLarge enterprises securing privileged accounts in regulated industries.
Skip it ifSmall businesses needing only basic single sign-on.
PricingWorkforce Identity from $2/user/mo; core PAM pricing not public

Editor's takeCyberArk has led Gartner's Privileged Access Management Magic Quadrant for seven straight cycles and holds FedRAMP High authorization for its Endpoint Privilege Manager and Workforce Identity products. Its marketplace lists over 960 integrations across cloud, RPA and SIEM tools. Deployment is often complex, and users report needing professional services to implement it in large environments.

How much does CyberArk cost?

Workforce Identity starts at $2 per user a month, but core Privileged Access Management pricing is not public and requires a custom quote, according to G2 and Vendr data.

Is CyberArk approved for government use?

Yes. CyberArk Endpoint Privilege Manager and Workforce Identity have achieved FedRAMP High authorization, the highest federal cloud security standard, according to CyberArk's press release.

The evidence: 6 criteria, 3 penalties (−0.16 points)
9.6
Product Capability & DepthLooked for: We evaluate the breadth of identity management features, including PAM, MFA, and lifecycle management for both human and machine identities.CyberArk offers a comprehensive Identity Security Platform covering Privileged Access Management (PAM), Endpoint Privilege Manager (EPM), Secrets Management, and the new CORA AI for automated threat detection.cyberark.comcyberark.comcyberark.com
9.8
Market Credibility & Trust SignalsLooked for: We assess market leadership, analyst rankings, and adoption by high-security organizations.CyberArk is a dominant market leader, trusted by the majority of Fortune 500 companies and holding top-tier analyst recognitions from Gartner, Forrester, and KuppingerCole.cyberark.combankinfosecurity.com
8.2
Usability & Customer ExperienceLooked for: We look for ease of deployment, intuitive interfaces, and the quality of administrative workflows.While powerful, the platform is frequently described as complex to deploy and manage, often requiring specialized knowledge or professional services to implement effectively.gartner.comtrustradius.com
8.0
Value, Pricing & TransparencyLooked for: We evaluate pricing transparency, total cost of ownership, and value relative to cost.CyberArk is a premium solution with a high total cost of ownership, often necessitating budget for professional services and add-ons; public pricing is limited to specific modules.vendr.comg2.com
9.9
Security, Compliance & Data ProtectionLooked for: We examine certifications, federal authorizations, and compliance capabilities for regulated industries.CyberArk holds the highest level of federal authorization (FedRAMP High) for key products and maintains comprehensive certifications like SOC 2 Type 2 and ISO 27001.cyberark.comcyberark.combusinesswire.com
9.4
Integrations & Ecosystem StrengthLooked for: We assess the availability of pre-built integrations and the breadth of the technology partner ecosystem.The CyberArk Marketplace offers a massive library of over 960 integrations, covering everything from cloud platforms (AWS, Azure) to robotic process automation and SIEM tools.cyberark.comcommunity.cyberark.comcyberark.com

Score adjustments−0.16 points in total

−0.07Users frequently cite high complexity in deployment and configuration, often requiring professional services or specialized staff to manage effectively.trustradius.com · severity 65/100
−0.04The solution is widely regarded as expensive, with a high total cost of ownership due to licensing fees and the operational overhead required to maintain it.strongdm.com · severity 60/100
−0.05Some users report frustration with support responsiveness and the time required to resolve technical issues.gartner.com · severity 45/100
2

Okta

okta.com · Okta IAM · scored Dec 2025

Okta connects 7,000+ apps but requires a $1,500 minimum

Best forEnterprises requiring extensive pre-built integrations across 7,000+ apps

From $6 per user/mo FedRAMPSOC 2enterprise

Independent identity provider offering unified workforce and customer identity management with the industry's largest integration network.

Standout factOkta has been named a Gartner Magic Quadrant Leader for Access Management for nine consecutive years.okta.com
Biggest catchA 2023 breach exposed HAR files containing session tokens for 134 customers.nightfall.ai
7,000+Pre-built integrationsokta.com
9 yearsGartner Leader streakokta.com
19,450+Global customersokta.com

Standout number

7,000+pre-built integrations in the Okta Integration Network

Source: okta.com

Starting price

$6/user/moStarter Suite, $1,500 annual contract minimum applies

Upside

  • 7,000+ pre-built integrations (OIN)
  • Gartner Leader for 9 straight years
  • FedRAMP High and SOC 2 certified

Catch

  • $1,500 minimum annual contract
  • History of high-profile security breaches
  • Expensive add-ons increase total cost
Pick it ifEnterprises requiring extensive pre-built integrations across 7,000+ apps
Skip it ifSmall businesses with very limited IT budgets
PricingFrom $6 per user monthly, $1,500 minimum annual contract

Editor's takeOkta's biggest edge is scale: the Okta Integration Network lists more than 7,000 pre-built app connections, more than any other identity provider, and it has held Gartner Leader status for Access Management for nine straight years. It holds FedRAMP High and SOC 2 certification, though a 2023 breach exposed session token files for 134 customers. Pricing starts publicly at $6 per user monthly but carries a $1,500 minimum annual contract plus add-ons that can push total cost higher.

How much does Okta cost?

The Starter Suite begins at $6 per user monthly and Essentials at $17, billed annually, with a $1,500 minimum annual contract required for Workforce Identity products.

Has Okta had any security breaches?

Yes. In October 2023, attackers accessed customer support system files, exposing session tokens tied to 134 customers, despite Okta's FedRAMP High and SOC 2 certifications.

The evidence: 6 criteria, 3 penalties (−0.15 points)
9.6
Product Capability & DepthLooked for: We evaluate the breadth of identity features including SSO, MFA, lifecycle management, and directory services tailored for complex enterprise environments.Okta provides a comprehensive Identity Cloud covering Workforce and Customer Identity with deep capabilities in SSO, Universal Directory, and Lifecycle Management.okta.comokta.comapplytosupply.digitalmarketplace.service.gov.uk
9.4
Market Credibility & Trust SignalsLooked for: We assess market leadership, analyst ratings, customer adoption rates, and public company status as indicators of long-term stability.Okta is a dominant market leader, recognized by Gartner as a Leader for nine consecutive years and serving over 19,000 global customers.okta.comokta.com
8.9
Usability & Customer ExperienceLooked for: We examine the ease of administration, end-user login experience, and the quality of documentation and support resources.Users consistently praise the clean, intuitive interface for end-users, though administrative configurations for advanced features can require specialized knowledge.g2.comgartner.com
8.4
Value, Pricing & TransparencyLooked for: We analyze pricing structures, public availability of costs, contract minimums, and total cost of ownership including add-ons.While base pricing is public, Okta enforces a strict annual contract minimum and often requires expensive add-ons or professional services.okta.comokta.comokta.com
9.7
Integrations & Ecosystem StrengthLooked for: We measure the quantity and quality of pre-built integrations, API robustness, and the breadth of the partner network.The Okta Integration Network (OIN) is the industry leader with over 7,000 pre-built integrations, making it the most connected IAM platform available.okta.comokta.comokta.com
8.8
Security, Compliance & Data ProtectionLooked for: We evaluate security certifications (SOC2, FedRAMP), data residency options, and the vendor's history of security incidents.Okta holds top-tier certifications like FedRAMP High and SOC 2, but has suffered significant reputational damage from high-profile breaches in 2022 and 2023.trust.okta.comsecurity.okta.comnightfall.ai

Score adjustments−0.15 points in total

−0.08Okta experienced a significant breach in October 2023 where attackers accessed customer support HAR files, exposing sensitive session tokens for 134 customers.nightfall.ai · severity 75/100
−0.04A mandatory annual contract minimum of $1,500 applies to Workforce Identity products, creating a barrier for very small teams or startups.okta.com · severity 50/100
−0.03Implementation often incurs hidden costs, with analysts noting professional services can cost significantly more than the initial license for complex deployments.avatier.com · severity 45/100
3

Thales

cpl.thalesgroup.com · Thales IAM Solution · scored Dec 2025

Thales bundles tokens and support into one flat price

Best forRegulated sectors needing FIPS-validated, high-assurance authentication

FIPS validatedSOC 2MFA
−0.1 vs #1

Cloud access management with smart SSO, broad MFA options, and all-inclusive licensing pricing.

Standout fact90 percent of surveyed IT organizations said STA was easy to deploy.cpl.thalesgroup.com
Biggest catchUsers describe some UI features and documentation as cumbersome and unclear.g2.com
1,000+Pre-built integrationsexpertinsights.com
90%IT orgs finding deployment easycpl.thalesgroup.com
GBP 13.94/userG-Cloud listed priceapplytosupply.digitalmarketplace.service.gov.uk

In every 100

90 of 100 IT orgs found STA easy to deploy

Source: cpl.thalesgroup.com

Starting price

GBP 13.94/user/moG-Cloud listed price, all-inclusive

Upside

  • All-inclusive pricing, no hidden fees
  • 1,000+ pre-built integrations
  • Broad MFA including hardware tokens

Catch

  • UI features can feel cumbersome
  • Documentation unclear for complex setups
  • Support varies for advanced issues
Pick it ifRegulated sectors needing FIPS-validated, high-assurance authentication
Skip it ifSMBs wanting a simple, dashboard-based SSO tool
PricingAll-inclusive pricing, about GBP 13.94/user on G-Cloud

Editor's takeThales SafeNet Trusted Access bundles access management, authentication, tokens, and support into one license with no hidden fees, a rare structure in identity management. It supports over 1,000 pre-built integrations and authentication methods from push notifications to FIDO2 hardware tokens. Ninety percent of surveyed IT organizations found it easy to deploy, though some G2 reviewers describe specific UI features and documentation as cumbersome.

Does Thales charge extra for hardware tokens?

No. The pricing model is all-inclusive, covering access management, authentication, tokens, and support with no hidden costs, according to Thales' own pricing page.

Is Thales IAM easy to deploy?

Most IT teams say yes. Ninety percent of surveyed IT organizations found it easy to deploy, according to Thales, though some reviewers cite unclear documentation for complex scenarios.

The evidence: 6 criteria, 3 penalties (−0.15 points)
9.1
Product Capability & DepthLooked for: We evaluate the breadth of access management features including SSO, MFA adaptability, policy granularity, and identity governance capabilities.Thales SafeNet Trusted Access (STA) provides a comprehensive cloud-based suite combining Smart Single Sign-On (SSO) with extensive Multi-Factor Authentication (MFA) options ranging from push notifications to high-assurance hardware tokens.cpl.thalesgroup.comcpl.thalesgroup.comcpl.thalesgroup.com
9.4
Market Credibility & Trust SignalsLooked for: We assess industry recognition, analyst rankings, and the vendor's reputation in the cybersecurity market.Thales is a recognized heavyweight in security, designated as a Visionary in the 2025 Gartner Magic Quadrant for Access Management and a Leader in KuppingerCole's Leadership Compass.cpl.thalesgroup.comcybersummit.io
8.6
Usability & Customer ExperienceLooked for: We examine ease of deployment, user interface design, documentation quality, and customer support responsiveness.While deployment is generally rated as easy by IT organizations, user reviews highlight friction with the user interface and documentation for complex scenarios.cpl.thalesgroup.comcpl.thalesgroup.comg2.com
9.0
Value, Pricing & TransparencyLooked for: We analyze pricing structures, hidden costs, and the overall value proposition relative to features.Thales differentiates itself with a fully transparent, all-inclusive pricing model that includes tokens and support without hidden fees.cpl.thalesgroup.comcpl.thalesgroup.comapplytosupply.digitalmarketplace.service.gov.uk
9.6
Security, Compliance & Data ProtectionLooked for: We evaluate the product's adherence to rigorous security standards, certifications, and encryption protocols suitable for regulated industries.Thales leverages its hardware security heritage to offer a solution with extensive certifications including ISO 27001, SOC2 Type II, CSA STAR, and FIPS validated modules.cpl.thalesgroup.comcpl.thalesgroup.comcpl.thalesgroup.com
8.8
Integrations & Ecosystem StrengthLooked for: We assess the breadth of pre-built integrations, API availability, and support for standard protocols like SAML and OIDC.The platform supports over 1,000 out-of-the-box integrations and standard protocols (SAML, OIDC, RADIUS), though some users find the setup process for these integrations complex.cpl.thalesgroup.comthalestct.comexpertinsights.com

Score adjustments−0.15 points in total

−0.05Users have reported that the user interface (UI) features can be cumbersome and unintuitive.g2.com · severity 50/100
−0.05Some users noted that technical support for advanced features can be slow or provide basic manual-based answers.g2.com · severity 45/100
−0.05Documentation is described as unclear for certain integration scenarios, making the transition difficult for some end users.g2.com · severity 45/100
4

Auth0

auth0.com · Auth0: User & AI Authentication · scored Dec 2025

Auth0 gives 25,000 free users, then pricing cliffs hit

Best forDevelopers building custom apps needing flexible, code-first authentication.

Free tier From $35 per month SOC 2HIPAAAI agent security
−0.2 vs #1

An Okta-owned identity platform adding Token Vault and Fine-Grained Authorization to secure AI agents.

Standout factProcesses more than 10 billion authentications monthly and blocks over 3 billion attacks each month.auth0.com
Biggest catchCosts can escalate disproportionately once a business needs B2B features like Enterprise SSO or exceeds MAU limits.ssojet.com
10B+Monthly authentications processedauth0.com
25,000 MAUFree tier limitauth0.com

Standout number

10B+authentications processed monthly

Source: auth0.com

Free vs paid

Free plan

$0
  • Up to 25,000 MAU
  • Basic auth flows

Essentials from

$35/mo
  • More B2B features
  • Higher usage limits

Source: auth0.com

Upside

  • Free tier covers 25,000 monthly users
  • Token Vault secures AI agent API keys
  • SOC 2, HIPAA, ISO 27001 compliant

Catch

  • Steep pricing cliffs for B2B SSO
  • Documentation quality declined post-Okta merger
  • RBAC gated behind higher tiers
Pick it ifDevelopers building custom apps needing flexible, code-first authentication.
Skip it ifNon-technical teams wanting a no-code identity solution.
PricingFree up to 25,000 MAU, Essentials from $35/month

Editor's takeAuth0's free tier, up to 25,000 monthly active users, is genuinely generous for B2C apps, and its new Token Vault and Fine-Grained Authorization features specifically target the security gaps in AI agent workflows accessing third-party APIs and RAG data. Backed by Okta's infrastructure, it processes over 10 billion authentications monthly. The well-documented tradeoff is a 'growth penalty': costs jump disproportionately once a business needs B2B features like Enterprise SSO or exceeds its MAU limit, and developers report documentation quality has slipped since the Okta merger.

How generous is Auth0's free tier?

It covers up to 25,000 monthly active users for B2C apps, though B2B features like SSO and RBAC are limited or unavailable on that tier.

Does Auth0 have AI-specific security features?

Yes. Token Vault secures API keys for AI agents, and Fine-Grained Authorization restricts what data AI agents can access in RAG systems.

The evidence: 6 criteria, 3 penalties (−0.18 points)
9.3
Product Capability & DepthLooked for: We evaluate the breadth of authentication features, including SSO, MFA, and specialized capabilities for modern AI agent workflows.Auth0 offers a comprehensive identity suite including Universal Login, MFA, and the new 'Auth0 for AI Agents' which features Token Vault for secure API key management and Fine-Grained Authorization (FGA) for RAG systems.auth0.comauth0.comauth0.com
9.4
Market Credibility & Trust SignalsLooked for: We assess the vendor's market standing, uptime guarantees, and adoption by major enterprises to ensure long-term reliability.As a subsidiary of Okta, Auth0 is a market leader handling over 10 billion authentications monthly with a 99.99% uptime SLA for enterprise tiers.gartner.comauth0.comauth0.com
8.8
Usability & Customer ExperienceLooked for: We look for ease of implementation, dashboard intuitiveness, and the quality of the administrative experience for developers.Users consistently praise the 'Universal Login' and ease of initial setup, though recent feedback indicates some friction with documentation quality and dashboard complexity.auth0.comg2.comfrontegg.com
8.2
Value, Pricing & TransparencyLooked for: We analyze the pricing structure, free tier generosity, and cost scalability for growing businesses.Auth0 offers a generous free tier (25k MAU) for B2C, but B2B plans are expensive ($150+), and users report a significant 'growth penalty' with steep price cliffs when exceeding limits.auth0.comauth0.comauth0.com
8.9
Developer Experience & API QualityLooked for: We evaluate the quality of SDKs, documentation, API design, and the ease of integrating complex identity flows.Auth0 provides 30+ SDKs and extensive quickstarts, though recent developer feedback cites frustration with outdated documentation and the forced migration from 'Rules' to 'Actions'.auth0.comsecurityboulevard.com
9.5
Security, Compliance & Data ProtectionLooked for: We examine security certifications, compliance with standards like HIPAA/SOC2, and data protection features for AI.Auth0 maintains top-tier compliance (SOC 2 Type II, ISO 27001, HIPAA) and introduces specific security controls for AI, such as Fine-Grained Authorization (FGA) to prevent data leaks in RAG.auth0.comauth0.comauth0.com

Score adjustments−0.18 points in total

−0.05Significant 'Growth Penalty' and Pricing Cliffs: Users report unpredictable and disproportionate cost increases when exceeding MAU limits or requiring B2B features like Enterprise SSO.ssojet.com · severity 75/100
−0.08Feature Gating on Lower Tiers: Critical B2B features like Role-Based Access Control (RBAC) and Enterprise SSO are severely limited or unavailable on the Free and lower-tier plans.blog.logto.io · severity 60/100
−0.05Documentation Quality Decline: Post-acquisition feedback indicates that documentation can be outdated, contradictory, or difficult to navigate, increasing integration time.securityboulevard.com · severity 50/100
5

Optimal IdM

optimalidm.com · Optimal IdM IAM Suite · scored Dec 2025

Concierge support, but $250 monthly minimum applies

Best forMid-to-large enterprises wanting a fully managed, white-glove IAM service.

From $2 per user/mo SOC 2GDPRtransparent pricing
−0.2 vs #1

Managed IAM suite with a 'concierge' service model, transparent per-user pricing, and 11,000+ pre-integrated apps.

Standout factThe Silver Plan starts at $2 per user per month and includes MFA and SSO.optimalidm.com
Biggest catchThere is a stated monthly contract minimum of $250, which can raise costs for very small teams.optimalidm.com
$2/user/moStarting priceoptimalidm.com
11,000+Pre-integrated appsoptimalidm.com

Starting price

$2/user/mo$250 monthly minimum, MFA included

Connects to

Google WorkspaceSalesforceMicrosoft 365Oracle EBSWorkday11,000+ total

Source: optimalidm.com

Upside

  • Concierge support handles integrations
  • Transparent pricing from $2/user/mo
  • 11,000+ pre-integrated applications

Catch

  • $250 monthly contract minimum
  • Limited customization flexibility
  • Mobile experience criticized
Pick it ifMid-to-large enterprises wanting a fully managed, white-glove IAM service.
Skip it ifSmall businesses or DIY teams wanting self-service setup.
PricingFrom $2/user/month, $250 monthly minimum

Editor's takeOptimal IdM's concierge model has the vendor manage configurations and integrations directly, unusual in a self-service market. Pricing is published down to the dollar, starting at $2 per user monthly with MFA included in every tier. A $250 monthly minimum applies though, and some users report the platform leans heavily toward Windows compatibility.

How much does Optimal IdM cost?

The Silver Plan lists at $2 per user per month and includes MFA and SSO. A $250 monthly contract minimum applies, according to Optimal IdM's pricing page.

What is Optimal IdM's concierge support model?

Optimal IdM manages configurations and application onboarding for customers directly, rather than leaving setup to the customer, according to the company's integration page.

The evidence: 6 criteria, 3 penalties (−0.19 points)
8.8
Product Capability & DepthLooked for: We evaluate the breadth of identity management features, including SSO, MFA, directory services, and lifecycle management capabilities.The suite offers a comprehensive set of IAM features including a Virtual Identity Server (VIS), Universal Directory, and behavioral biometrics via TypingDNA.optimalidm.comoptimalidm.comoptimalidm.com
9.2
Market Credibility & Trust SignalsLooked for: We look for third-party validations, industry awards, analyst recognition, and compliance certifications.The company holds significant industry recognition including placement in the Gartner Magic Quadrant and compliance with SOC 2 Type II standards.optimalidm.comoptimalidm.com
9.3
Usability & Customer ExperienceLooked for: We assess ease of use, support quality, and unique service models that reduce administrative burden.Optimal IdM differentiates itself with a 'concierge' support model where they handle configurations and integrations for the customer.optimalidm.comoptimalidm.com
9.5
Value, Pricing & TransparencyLooked for: We look for clear, publicly available pricing, flexible terms, and value-for-money relative to features.The pricing is exceptionally transparent with published per-user rates starting at $2/month and clear tier differentiations.optimalidm.comoptimalidm.comoptimalidm.com
9.0
Security, Compliance & Data ProtectionLooked for: We examine security protocols, data residency options, and compliance with standards like GDPR and SOC 2.The platform offers robust security including a Virtual Identity Server that allows for private dedicated cloud deployment and full GDPR compliance.optimalidm.comoptimalidm.com
8.9
Integrations & Ecosystem StrengthLooked for: We evaluate the number of pre-built integrations and support for standard protocols like SAML and OIDC.The platform boasts a massive catalog of over 11,000 pre-integrated applications and supports all major federation protocols.optimalidm.comoptimalidm.com

Score adjustments−0.19 points in total

−0.08Some users have reported rigidity regarding customization, noting that the vendor pushed back on custom requests or that the product lacked flexibility in specific scenarios.gartner.com · severity 60/100
−0.05Historical reviews have cited a less-than-optimal mobile user experience, describing it as not user-friendly.gartner.com · severity 50/100
−0.06The platform has been noted to have limited compatibility with non-Windows operating systems for certain components.selecthub.com · severity 45/100
6

Delinea

delinea.com · Delinea Identity Security · scored Dec 2025

Delinea leads Gartner's PAM quadrant for the 7th time

Best forEnterprises needing easier-to-use Privileged Access Management

From $22 per user/mo Gartner LeaderFedRAMP in processSOC 2 Type II
−0.3 vs #1

Cloud-native identity security platform extending Privileged Access Management with AI-driven authorization for hybrid enterprises.

Standout factDelinea has been named a Leader in the Gartner Magic Quadrant for Privileged Access Management for the seventh consecutive time.delinea.com
Biggest catchReviews cite poor customer service and unprofessional behavior in dealings with Delinea support.g2.com
7 yearsGartner Magic Quadrant Leader streakdelinea.com
10,000+Organizations serveddelinea.com

In their words

“Delinea has been named a Leader in the 2025 Gartner Magic Quadrant for Privileged Access Management (PAM) for the seventh consecutive time.”

delinea.com

Starting price

$22/user/moCloud Suite module; enterprise PAM pricing requires a quote

Upside

  • Gartner PAM Leader 7 years running
  • VPN-less remote access built in
  • AI-driven authorization via Iris AI

Catch

  • Mobile app called terrible by users
  • Support response is inconsistent
  • Hidden infrastructure costs reported
Pick it ifEnterprises needing easier-to-use Privileged Access Management
Skip it ifSmall businesses needing only basic workforce SSO
PricingCustom quote; some modules publicly priced from about $22/user/mo

Editor's takeDelinea has held a Leader spot in Gartner's PAM Magic Quadrant for seven straight years and is pursuing FedRAMP High authorization. Its Iris AI engine drives real-time access decisions and VPN-less remote access. Reviewers report a rough mobile app and inconsistent support, plus surprise infrastructure costs like extra EC2 charges.

How much does Delinea cost?

Enterprise pricing needs a custom quote. Some cloud suite modules are listed around $22 per user a month, with a reported median contract near $20,000.

Does Delinea have FedRAMP authorization?

Delinea has initiated the FedRAMP High authorization process for Secret Server, alongside existing SOC 2 Type II and ISO 27001 certifications.

The evidence: 6 criteria, 3 penalties (−0.18 points)
9.2
Product Capability & DepthLooked for: We evaluate core Privileged Access Management (PAM) features, vaulting capabilities, secret rotation, and advanced identity security tools like AI-driven authorization.Delinea offers a cloud-native platform combining enterprise vaulting, VPN-less remote access, and the new 'Iris AI' for real-time authorization and threat detection.delinea.comdelinea.comdelinea.com
9.5
Market Credibility & Trust SignalsLooked for: We look for industry leadership recognition, analyst rankings, and adoption by major enterprises or government entities.Delinea is a dominant market leader, recognized as a Leader in the Gartner Magic Quadrant for PAM for seven consecutive times as of 2025.delinea.comdelinea.comdelinea.com
8.3
Usability & Customer ExperienceLooked for: We assess user interface design, ease of deployment, mobile app quality, and the responsiveness of customer support.While the desktop interface is often praised for ease of use, significant complaints exist regarding the mobile app quality and inconsistent customer support experiences.delinea.cominfisign.aig2.com
8.2
Value, Pricing & TransparencyLooked for: We evaluate pricing models, public availability of costs, and the presence of hidden fees or complex licensing structures.Pricing is partially transparent with some public figures, but users have reported hidden costs for infrastructure and confusion over licensing changes.delinea.comvendr.comg2.com
9.6
Security, Compliance & Data ProtectionLooked for: We examine security certifications (SOC 2, ISO), encryption standards, and federal authorizations (FedRAMP).Delinea demonstrates top-tier security compliance, including SOC 2 Type II, ISO 27001, and is currently in process for FedRAMP High authorization.delinea.comdelinea.comtrust.delinea.com
8.8
Integrations & Ecosystem StrengthLooked for: We look for the breadth of third-party integrations, API availability, and the ease of connecting with existing IT infrastructure.A vast library of integrations exists (AWS, ServiceNow, Okta), though some users report that custom integrations can be difficult to implement without community support.docs.delinea.comgartner.comstore.servicenow.com

Score adjustments−0.18 points in total

−0.08Multiple reviews cite poor customer support experiences, including slow response times and lack of technical expertise.g2.com · severity 75/100
−0.06Users report significant issues with the mobile application, describing it as 'terrible' and noting functionality problems.infisign.ai · severity 60/100
−0.04Customers have reported unexpected 'hidden costs' for supplementary infrastructure (e.g., EC2 instances) not disclosed during sales.g2.com · severity 50/100
7

CDW

cdw.com · CDW IAM Solutions · scored Dec 2025

CDW aggregates IAM vendors, keeps pricing opaque

Best forEnterprises wanting a single partner to manage multi-vendor identity stacks

Quote only Managed serviceSOC 2HIPAA
−0.4 vs #1

Managed IAM service that bundles Microsoft, Okta and CyberArk software with expert consulting and 24/7 support.

Standout factCDW manages 250,000+ identities and partners with 25+ IAM solution providers.webobjects2.cdw.com
Biggest catchPricing requires a quote, and some buyers report costs around 30% higher than competitors.reddit.com
25+IAM partnerswebobjects2.cdw.com
250K+Identities managedwebobjects2.cdw.com

Standout number

25+IAM software partners

Source: webobjects2.cdw.com

In their words

“Anything I buy off cdw is roughly 30% more expensive than competitors.”

reddit.com

Upside

  • Deep Microsoft and Okta partnerships
  • 24/7 managed support options
  • SOC 2 and HIPAA aligned

Catch

  • No public pricing
  • High account manager turnover
  • Costs often exceed competitors
Pick it ifEnterprises wanting a single partner to manage multi-vendor identity stacks
Skip it ifSmall businesses wanting self-service software with public pricing
PricingQuote-only, no published rates

Editor's takeCDW positions itself as an aggregator rather than a software vendor, wrapping Okta and Microsoft Entra ID inside managed services. Reviewers praise the partner network but flag inconsistent account management and above-market pricing. It fits large enterprises that want one contract covering software and staffing.

Does CDW build its own IAM software?

No. CDW resells and manages identity software from partners like Microsoft, Okta and CyberArk, adding consulting and 24/7 support on top, according to its published solution page.

How is CDW IAM priced?

CDW does not publish rates. Pricing is based on manufacturer list price or a custom quote, and user reports say costs often run higher than buying direct.

The evidence: 6 criteria, 2 penalties (−0.11 points)
8.9
Product Capability & DepthLooked for: We evaluate the breadth of identity features, including SSO, MFA, PAM, and IGA, and the ability to manage complex hybrid environments.CDW delivers a comprehensive IAM portfolio by aggregating top-tier solutions (Microsoft, Okta, Ping, CyberArk) with their own managed services for IGA, PAM, and CIAM.cdw.comwebobjects2.cdw.com
9.4
Market Credibility & Trust SignalsLooked for: We look for industry awards, certifications, and partnership levels that demonstrate the vendor's standing in the security market.CDW holds top-tier partner status with industry giants like Microsoft and Okta, winning multiple 'Partner of the Year' awards in security and identity categories.microsoft.comuk.cdw.com
8.2
Usability & Customer ExperienceLooked for: We assess the ease of engagement, portal quality, and responsiveness of support teams for ongoing management.While CDW launched a new Services Portal in 2023 to improve ticket tracking, customer feedback highlights significant inconsistency in account manager responsiveness.youtube.comreddit.com
8.0
Value, Pricing & TransparencyLooked for: We look for clear pricing structures, public rate cards, and competitive value for the services provided.Pricing is opaque, relying entirely on quotes or MSRP discounts, and user reviews frequently cite higher costs compared to competitors or direct purchasing.omnia-partners.comreddit.com
9.3
Integrations & Ecosystem StrengthLooked for: We assess the breadth of third-party integrations and the strength of the vendor's partner network.As a top-tier VAR, CDW has an immense ecosystem, integrating seamlessly with Microsoft, AWS, Okta, and 25+ other IAM vendors.webobjects2.cdw.commarketplace.microsoft.com
9.1
Security, Compliance & Data ProtectionLooked for: We evaluate the vendor's ability to secure identity data and meet regulatory standards like SOC 2 and HIPAA.CDW's managed services are built on rigorous frameworks (SOC 2, HIPAA) and include 24/7 security monitoring and advanced threat detection capabilities.cdw.comcdw.com

Score adjustments−0.11 points in total

−0.07Numerous customer reports indicate high account manager turnover and poor responsiveness, particularly for small-to-mid-sized business accounts.reddit.com · severity 65/100
−0.04Pricing is not publicly available and requires a quote process; user reviews consistently mention higher costs compared to direct competitors.reddit.com · severity 50/100
8

Fortinet

fortinet.com · Fortinet IAM Solutions · scored Dec 2025

Fortinet IAM supports FIDO2, but users call it outdated

Best forFortinet customers using FortiGate firewalls needing zero-trust access control

Quote only Zero TrustFIDO2Security Fabric
−0.4 vs #1

Identity and access management built into the Fortinet Security Fabric, supporting SAML, OIDC, RADIUS and FIDO2.

Standout factRated 4.8 out of 5 stars on Gartner Peer Insights based on 38 reviewsgartner.com
Biggest catchUsers describe the device as complicated to configure, with an interface that feels outdated.g2.com
4.8/5 (38 reviews)Gartner Peer Insights ratinggartner.com

Standout number

4.8/5Gartner Peer Insights rating (38 reviews)

Source: gartner.com

In their words

“This is an extremely complicated device. It's very feature-packed however the interface is a bit outdated.”

g2.com

Upside

  • Supports SAML, OIDC, RADIUS, FIDO2
  • Deep Fortinet Security Fabric integration
  • Adaptive authentication with risk scoring

Catch

  • Interface called outdated
  • Documentation gaps for advanced setup
  • Licensing can be complex
Pick it ifFortinet customers using FortiGate firewalls needing zero-trust access control
Skip it ifCloud-first companies without Fortinet hardware wanting a standalone cloud IDP
PricingCustom quote, hardware, VM or cloud licensing with stackable user add-ons

Editor's takeFortinet's IAM stack covers everything from legacy RADIUS to modern FIDO2 passwordless login, then folds into the Fortinet Security Fabric for zero-trust enforcement across FortiGate firewalls. That depth comes at a usability cost. G2 reviewers rate it 4.8 out of 5 overall but call the device complicated to configure, with documentation that skips some advanced scenarios.

Does Fortinet IAM support modern authentication protocols?

Yes. It supports RADIUS, TACACS+, SAML, OIDC, OAuth2 and FIDO2 webauthn, alongside adaptive authentication based on location and time of day.

Is Fortinet IAM easy to configure?

Not always. G2 reviewers describe the device as complicated to configure and note documentation gaps for advanced authentication options.

The evidence: 6 criteria, 2 penalties (−0.11 points)
8.9
Product Capability & DepthLooked for: Comprehensive identity management features including MFA, SSO, and support for modern authentication protocols like SAML and OIDC.Fortinet IAM offers centralized authentication with broad protocol support (RADIUS, LDAP, SAML, OIDC, FIDO2) and deep integration into the Fortinet Security Fabric for zero-trust enforcement.fortinet.comfortinetweb.s3.amazonaws.comfortinetweb.s3.amazonaws.com
9.1
Market Credibility & Trust SignalsLooked for: Strong market presence, high user ratings on reputable review platforms, and recognition by industry analysts.Fortinet holds a strong market position with high ratings on Gartner Peer Insights (4.8/5) and recognition as a Customers' Choice in related security sectors.cyberdefenseawards.comgartner.comfortinet.com
8.3
Usability & Customer ExperienceLooked for: Intuitive user interfaces, easy deployment processes, and responsive technical support.While functional, users report the interface can be outdated and complex, with some documentation gaps requiring support intervention for setup.g2.comg2.com
8.5
Value, Pricing & TransparencyLooked for: Clear pricing models, flexible licensing options, and competitive value for features provided.Offers flexible deployment (hardware, VM, cloud) with perpetual and subscription options, though licensing can be complex with stackable add-ons.fortinet.comassets.grandandtoy.comfortinet.com
9.2
Security, Compliance & Data ProtectionLooked for: Advanced security features like Zero Trust enforcement, adaptive access policies, and compliance reporting.Delivers robust security via Zero Trust Network Access (ZTNA) integration, adaptive authentication based on risk factors, and comprehensive audit trails.fortinet.comfortinetweb.s3.amazonaws.com
9.0
Integrations & Ecosystem StrengthLooked for: Seamless integration with existing infrastructure, third-party applications, and the vendor's own product suite.Exceptional integration within the Fortinet Security Fabric (FortiGate, FortiNAC) and broad support for standard third-party protocols.fortinet.comvideo.fortinet.com

Score adjustments−0.11 points in total

−0.06Users report the interface is outdated and the device is complicated to configure, requiring a steep learning curve.g2.com · severity 60/100
−0.05Documentation is described as lacking for complex scenarios, often necessitating direct support contact.g2.com · severity 45/100
9

OpenText IAM

opentext.com · OpenText IAM Solutions · scored Dec 2025

OpenText IAM scales to billions, looks dated doing it

Best forLarge enterprises with complex legacy and mainframe systems.

Quote only enterpriseidentity governancehybrid deployment
−0.4 vs #1

Industrial-grade identity platform managing billions of identities across hybrid enterprise systems.

Standout factUnderlying directory service scales to billions of identities without performance loss.netiq.com
Biggest catchNative interface is described as unattractive and not intuitive by reviewers.gartner.com
Billions of identitiesScale capacitynetiq.com
KuppingerCole Leader, 2024Analyst recognitionblogs.opentext.com

Standout number

Billionsof identities managed without performance loss

Source: netiq.com

Learning curve

AfternoonWeeks

Steep learning curve, especially in the Designer interface

Upside

  • Scales to billions of identities
  • Leader in 2024 KuppingerCole report
  • Deep hybrid and on-prem support

Catch

  • Dated, unintuitive interface
  • Steep implementation learning curve
  • Pricing not publicly listed
Pick it ifLarge enterprises with complex legacy and mainframe systems.
Skip it ifCloud-native startups wanting a modern, lightweight interface.
PricingCustom quote, priced per managed identity

Editor's takeOpenText IAM is built for scale over polish, and reviewers call it a Swiss Army Knife for complex identity environments. Entire countries run tax and social service portals on its infrastructure. The interface has not kept pace with modern SaaS design, and implementation typically needs specialized skills.

How many identities can OpenText IAM manage?

Its directory service architecture scales to billions of identities without performance degradation, according to vendor documentation.

Is OpenText IAM easy to implement?

Not typically. Gartner reviewers describe implementation as complex, often needing specialized skills or professional services to deploy effectively.

The evidence: 6 criteria, 3 penalties (−0.17 points)
9.2
Product Capability & DepthLooked for: We evaluate the breadth of identity lifecycle management, access control features, and the ability to handle complex hybrid environments.OpenText offers a comprehensive 'Swiss Army Knife' suite including Identity Manager, Access Manager, and Governance, capable of managing billions of identities across on-prem and cloud systems.opentext.comopentext.comopentext.com
9.2
Market Credibility & Trust SignalsLooked for: We look for analyst recognition, long-standing market presence, and adoption by high-security organizations.OpenText (formerly NetIQ) is a recognized Leader in major analyst reports like KuppingerCole and is trusted by government entities for critical infrastructure.securitymagazine.comblogs.opentext.comyoutube.com
7.8
Usability & Customer ExperienceLooked for: We assess the user interface design, ease of implementation, and the learning curve for administrators.Users report the interface is dated and unintuitive, and the implementation process is complex and requires significant technical expertise.opentext.comgartner.comgartner.com
8.7
Value, Pricing & TransparencyLooked for: We evaluate pricing transparency, flexibility, and cost-effectiveness for large-scale deployments.While pricing is opaque and complex (per identity/FTES), it is considered very cost-competitive for large-scale deployments compared to alternatives.opentext.compeerspot.comgartner.com
9.1
Scalability & PerformanceLooked for: We check for robust governance features, automated compliance controls, and support for regulatory standards.OpenText provides deep governance capabilities, automated certification campaigns, and real-time compliance monitoring suitable for highly regulated industries.opentext.comnetiq.comopentext.com
9.1
Integrations & Ecosystem Strengthopentext.com

Score adjustments−0.17 points in total

−0.08Users consistently report that the user interface is 'not very attractive' and 'not intuitive,' lagging behind modern SaaS competitors.gartner.com · severity 75/100
−0.06Implementation is described as complex and 'not easy,' often requiring specialized skills or professional services to deploy effectively.gartner.com · severity 60/100
−0.03Pricing is opaque and not publicly available, requiring direct contact with sales, and licensing models (per Managed Identity/FTES) can be complex.g2.com · severity 45/100
10

Rippling

rippling.com · Rippling IAM Software · scored Dec 2025

Rippling ties access to HR data, needs HRIS first

Best forMid-sized companies wanting unified HR, IT, and device management

From $8 per user/mo ISO 27001HR-driven IAMdevice management
−0.4 vs #1

Identity and access management that automates provisioning directly from Rippling's HR data core.

Standout factProvides 150+ out-of-the-box automations for onboarding and offboardingrippling.com
Biggest catchRequires subscribing to the Rippling Unity HRIS before accessing IAM features.accessowl.com
4.8/5G2 ratingrippling.com
150+Automations includedrippling.com
$8/user/moIAM starting pricerippling.com

What reviewers say

G2
4.8/5 · 10,000+
Capterra
4.9/5 · 4,160+

Source: rippling.com

In their words

“Rippling is the only IAM solution to truly centralize user identity with a unified HRIS and IdP right out-of-the-box—no SCIM integration needed.”

rippling.com

Upside

  • Automated onboarding and offboarding
  • Built-in device management (MDM)
  • 4.8/5 rating on 10,000+ G2 reviews

Catch

  • Requires core HRIS subscription first
  • Fewer integrations than Okta
  • Costs scale quickly with add-ons
Pick it ifMid-sized companies wanting unified HR, IT, and device management
Skip it ifCompanies not already using Rippling for HR or payroll functions
PricingIAM from $8/user/mo, requires core Rippling Unity subscription

Editor's takeRippling ties access permissions directly to live HR data, so provisioning and deprovisioning happen automatically as employee status changes. It holds a 4.8-star G2 rating across more than 10,000 reviews and ISO 27001 certification. IAM pricing starts at $8 per user monthly, but only after subscribing to the core Rippling Unity HRIS platform.

Can I buy Rippling IAM without their HR platform?

No. You must first subscribe to Rippling Unity, its core HRIS product, before adding IAM modules.

How many integrations does Rippling offer?

Over 600 pre-built integrations, fewer than Okta's 7,000-plus, but enough to cover most common business tools.

The evidence: 6 criteria, 3 penalties (−0.16 points)
8.9
Product Capability & DepthLooked for: We evaluate the breadth of identity management features, including SSO, MFA, provisioning automation, and device security capabilities.Rippling uniquely combines IAM with device management (MDM) and inventory logistics, leveraging a unified HR data core to automate provisioning and access rules instantly without sync delays.rippling.comrippling.comrippling.com
9.3
Market Credibility & Trust SignalsLooked for: We look for third-party validation, high user review scores, and adoption by reputable organizations.Rippling maintains exceptional ratings across major review platforms and holds comprehensive security certifications, signaling strong market trust and reliability.rippling.comrippling.comrippling.com
8.8
Usability & Customer ExperienceLooked for: We assess the ease of setup, interface design, and quality of customer support resources.Users consistently praise the intuitive interface and consolidated dashboard, though some note a learning curve for configuring advanced automation workflows.rippling.comrippling.comtechradar.com
8.2
Value, Pricing & TransparencyLooked for: We evaluate pricing competitiveness, transparency of costs, and flexibility of contract terms.While the starting price is competitive, the modular pricing model is opaque and requires custom quotes, with costs scaling significantly as features are added.rippling.comrippling.comaccessowl.com
8.6
Integrations & Ecosystem StrengthLooked for: We analyze the number of pre-built integrations, API quality, and support for custom applications.Rippling offers over 600 pre-built integrations and an App Shop, which is substantial but smaller than the thousands offered by dedicated IAM leaders like Okta.rippling.comrippling.comsoftwarefinder.com
9.1
Security, Compliance & Data ProtectionLooked for: We examine security certifications, encryption standards, and compliance features like SOC 2 and HIPAA.Rippling maintains a robust security posture with top-tier certifications (SOC 2 Type II, ISO 27001) and advanced features like behavioral detection and device trust enforcement.rippling.comrippling.comrippling.com

Score adjustments−0.16 points in total

−0.04Pricing is opaque and modular, often requiring a base HRIS subscription plus per-user add-ons, which can lead to unpredictable costs.g2.com · severity 60/100
−0.07The platform requires the 'Unity' HRIS module as a prerequisite, which may not suit organizations looking for a standalone IAM solution.accessowl.com · severity 55/100
−0.05Users report a steep learning curve for advanced features and initial configuration, describing the platform as potentially overwhelming at first.g2.com · severity 50/100
02

Side by side

10 features across 10 products. Green is yes, red is no, grey is not published.

FeatureCyberArkOktaThalesAuth0Optimal IdMDelineaCDWFortinetOpenText IAMRippling
Has Mobile App Web-only
Has Free Plan
Has Free Trial Contact for trial Contact for trial Contact for trial Contact for trial Contact for trial Contact for trial Contact for trial
Integrates With Zapier
Has Public API Enterprise API only Enterprise API only Enterprise API only Enterprise API only Enterprise API only Enterprise API only
Live Chat Support Email/Ticket only Email/Ticket only Email/Ticket only Email/Ticket only Email/Ticket only Email/Ticket only
SOC 2 or ISO Certified Both Both
Popular Integrations Salesforce, Microsoft 365, AWS Salesforce, Google Workspace, Slack Custom integrations only Slack, Salesforce, Google Workspace Custom integrations only Custom integrations only Custom integrations only Custom integrations only Custom integrations only Slack, Google Workspace, Microsoft 365
Supports SSO
Starting Price $2 per user/mo $6 per user/mo Contact for pricing $35 per month $2 per user/mo $22 per user/mo Contact for pricing Contact for pricing Contact for pricing $8 per user/mo
03

How we chose

Four fixed criteria for every product, plus two chosen for Identity & Access Management Software for Marketing Agencies, weighted and reduced by documented penalties.

Full methodology
Criteria set for this categoryProduct Capability & Depth, Market Credibility & Trust Signals, Usability & Customer Experience, Value, Pricing & Transparency, Integrations & Ecosystem Strength, Security, Compliance & Data Protection
Evidence, then a scoreDocumentation, pricing pages, security pages and third-party reviews. Each criterion records what was found and links its sources.
Penalties, then a rankDocumented problems pull the score down with their evidence attached. Rank follows the score. Sponsored rows, where present, are labelled.
iVendors cannot buy a position. Every score rests on published evidence, documented problems pull it down, and a 9.1 here is not a 9.1 in another category.
Albert Richer
Albert RicherFounder · Memphis, TN

Sets the criteria and reviews the evidence before a ranking publishes. Email him if something here looks wrong.

04

Questions people ask

How much does CyberArk cost?

Workforce Identity starts at $2 per user a month, but core Privileged Access Management pricing is not public and requires a custom quote, according to G2 and Vendr data.

Is CyberArk approved for government use?

Yes. CyberArk Endpoint Privilege Manager and Workforce Identity have achieved FedRAMP High authorization, the highest federal cloud security standard, according to CyberArk's press release.

How much does Okta cost?

The Starter Suite begins at $6 per user monthly and Essentials at $17, billed annually, with a $1,500 minimum annual contract required for Workforce Identity products.

Has Okta had any security breaches?

Yes. In October 2023, attackers accessed customer support system files, exposing session tokens tied to 134 customers, despite Okta's FedRAMP High and SOC 2 certifications.

Does Thales charge extra for hardware tokens?

No. The pricing model is all-inclusive, covering access management, authentication, tokens, and support with no hidden costs, according to Thales' own pricing page.

Is Thales IAM easy to deploy?

Most IT teams say yes. Ninety percent of surveyed IT organizations found it easy to deploy, according to Thales, though some reviewers cite unclear documentation for complex scenarios.

How generous is Auth0's free tier?

It covers up to 25,000 monthly active users for B2C apps, though B2B features like SSO and RBAC are limited or unavailable on that tier.

Does Auth0 have AI-specific security features?

Yes. Token Vault secures API keys for AI agents, and Fine-Grained Authorization restricts what data AI agents can access in RAG systems.

How is the best Identity & Access Management Software for Marketing Agencies decided?

Every product is scored on six criteria for this category, with cited evidence and documented penalties. Rank follows the overall score. Vendors cannot pay for a position.

How often is this ranking updated?

Products are re-scored when pricing, features or evidence change. This ranking was last updated August 27, 2026.

05

More in Identity & Access Management Software

5 related rankings.

All of Identity & Access Management
Research

Machine identities outnumber human identities 500 to 1 in cloud-native infrastructures

Mar 30, 2026

Support centers face 40% annual turnover—more than double the 16% industry average

May 21, 2026

Organizations only recover 57% of data after ransomware attacks hit 41% of systems

May 4, 2026