Identity and Access
Identity protection tools for the accounts attackers actually use (2026)
A 2026 shortlist of IdP, self-hosted, and privileged-access controls that still close stolen-session and standing-admin holes. Public docs, not a bake-off.
Expertise: Identity and Access · Level: Intermediate · 15 min read
A stolen session is a live login, not a forgotten password.
The password held. The cookie did not. Token replay and a standing admin are the two holes this shortlist is actually about. Secure authentication still matters at the login ceremony. This page is the controls that stay useful after the ceremony is over: kill the session, provision and deprovision on a standard, and stop treating Global Admin as a convenience account.
Six tools. Two cloud IdPs most enterprises already pay for. Three self-hosted IdPs you can read the source of. One privileged-access specialist that is not an IdP.
Technical check: we cross-check first-party product pages, public pricing, SCIM documentation, and GitHub licenses. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Okta | Workforce IdP with SCIM and session kill | Commercial. Starter from $6/user/month, billed annually |
| Microsoft Entra ID | Microsoft-stack IAM, PIM, and ID Protection | Commercial. P1 $7, P2 $10 user/month, paid yearly |
| Keycloak | Self-hosted OIDC/SAML IdP | Apache-2.0 |
| authentik | Self-hosted IdP with inbound and outbound SCIM | MIT (core). Enterprise from $5/user/month |
| Zitadel | Multi-tenant IdP, cloud or self-hosted | AGPL-3.0. Cloud Pro from $100/month |
| CyberArk | Privileged access and vaulting | Commercial. Sales-led |
Okta
Best for a vendor-neutral workforce IdP that still documents SCIM and session kill
Okta is still the independent cloud IdP teams reach for when the directory cannot be Microsoft-only. The product page now talks AI agents. The pages that matter for this list are Lifecycle Management, which documents SCIM provisioning, and Identity Threat Protection, which documents session hijacking and Universal Logout.
Key features
- Workforce SSO, MFA, and Universal Directory on the public suite cards
- SCIM 2.0 and 1.1 provisioning in the developer and Admin Console docs
- Identity Threat Protection: continuous session risk, Universal Logout, Shared Signals
- Lifecycle Management for joiner, mover, and leaver into downstream apps
Why we like it
Use it when you need an IdP that is not the hyperscaler’s directory, and when the app catalog plus SCIM is the actual job. Identity Threat Protection is the honest answer to token theft: Okta’s own FAQ says it watches impossible travel and device-context change, then can terminate the session.
gtsteve wrote it in April 2023, administering Okta for years: “The key thing for me is SCIM provisioning support, but not just that. There are quite a few apps that don’t support SCIM, but Okta has built integrations for them anyway using API keys, etc.” Deprovisioning still drops a manual task list for the apps that never grew a SCIM server. That is the catalog argument: the integrations you do not have to write.
Limits
Identity Threat Protection and Privileged Access sit on the higher suites or as add-ons, not on Starter. A 30-day trial exists. You still need a privileged-access product if the standing account is a domain admin outside Okta.
License
Commercial SaaS. Workforce suites are billed annually. The public pricing page lists Starter at $6 per user/month, Essentials at $17, and a $1,500 annual contract minimum. Professional and Enterprise are inquire.
Microsoft Entra ID
Best for Microsoft-stack workforce IAM, just-in-time admin, and risk-based access
Entra ID is the cloud directory most Microsoft 365 tenants already have. The rename from Azure AD landed in 2023. The controls that close this list’s holes are Conditional Access, ID Protection, Privileged Identity Management, and the SCIM provisioning service.
Key features
- SSO, passwordless, and Conditional Access on P1
- ID Protection and risk-based Conditional Access on P2
- Privileged Identity Management: eligible roles, approval, MFA to activate, time-bound access
- SCIM 2.0 as a client to SaaS apps, and as a service provider API under Graph
Why we like it
If the estate is already Microsoft, starting a second workforce IdP is usually politics. PIM is the first-party answer to standing Global Admin inside Entra and Azure. ID Protection is the first-party answer to leaked credentials and risky sign-ins, and Microsoft documents that risk policies need P2.
Limits
PIM and full ID Protection are not the free edition. SCIM deprovisioning follows Entra’s soft-delete window: the provisioning service disables on soft-delete and sends DELETE after hard-delete, which the public Q&A has been explaining since Azure AD. Entra PIM is not a vault for a non-Microsoft domain admin.
License
Commercial. The product page lists Entra ID P1 at $7.00 user/month and P2 at $10.00 user/month, paid yearly. A free edition ships with qualifying Microsoft cloud subscriptions and covers basic directory, sync, and SSO. ID Protection and PIM require the paid SKUs Microsoft documents for those features.
Keycloak
Best for a self-hosted OIDC and SAML IdP you can run without a per-user SaaS bill
Keycloak is the open-source IdP a lot of shops already run in a container. Single sign-on, single logout, identity brokering, LDAP and Active Directory federation, and an admin console that owns users and sessions. You operate the server. There is no Okta-style per-user card.
Key features
- OpenID Connect, OAuth 2.0, and SAML 2.0
- Identity brokering and social login from the admin console
- User federation to LDAP and Active Directory
- SCIM Realm API for users and groups, preview in the 26.7 docs, disabled by default
Why we like it
Reach for Keycloak when the requirement is a standards IdP on your own iron, and when you can staff the upgrades. The account console lets users see sessions. That is the self-hosted version of “kill this login,” if you actually look at it. Native SCIM is finally in-tree. Treat the preview flag as a preview flag.
Limits
You run Java, clustering, backups, and the upgrade train. The April 2026 project blog shipped SCIM as experimental in 26.6; the 26.7.0 notes promote it to preview and still require --features=scim-api. Bulk operations, password management, and custom schemas are called out as missing. A third-party SCIM plugin is not the same as the in-tree API.
License
Apache License 2.0. Project home is keycloak.org. Source is the keycloak/keycloak repository. No per-user fee on the open-source server. Red Hat sells a supported build separately; that contract is not on the community pricing page because there isn’t one.
authentik
Best for a self-hosted IdP that already documents inbound and outbound SCIM
authentik is the self-hosted IdP that keeps the directory on your side of the wire. The public site lists OIDC, SAML, LDAP, RADIUS, SCIM, proxy, passkeys, and conditional access. The vendor does not currently host it for you. You deploy Docker Compose, Kubernetes, or their AWS template.
Key features
- OIDC, SAML2, LDAP, RADIUS, Kerberos, and an application proxy
- SCIM 2.0 provider to push users and groups into apps, including vendor compatibility modes
- SCIM source so Entra ID, Okta, or Google Workspace can provision into authentik
- Policies, GeoIP / impossible travel, and OIDC back-channel logout on the public feature list
Why we like it
If the job is “we will run the IdP” and SCIM has to work in both directions, authentik’s docs are further along than Keycloak’s preview flag. Outbound SCIM is a backchannel provider next to SSO. Inbound SCIM mints a bearer token and a /source/scim/.../v2 base URL. The docs are explicit that a SCIM DELETE removes the authentik user, not only the link. Read that before you point Entra at it.
Limits
There is no hosted authentik. You own uptime. Privileged Access Management, Entra and Google Workspace integrations, scheduled offboarding, and OAuth-authenticated SCIM sit on Enterprise rather than the MIT core. Community support is Discord and GitHub. Ticket support starts on paid plans over $1k.
License
Core is MIT (copyright Jens Langhammer, 2023 license file). The authentik/enterprise/ tree is separately licensed. Open Source is free. Enterprise is $5 per internal user/month and $0.02 per external user/month, billed annually, no charge for service accounts. Enterprise Plus starts at $20k annually.
Zitadel
Best for a multi-tenant IdP you can run in their cloud or yours
Zitadel sits between “self-host Keycloak” and “pay Okta.” Hosted login, passkeys, MFA, organizations for B2B, Actions for post-event workflows, and APIs first. You can take the cloud SKU or run the same software. The license on the repository is AGPL-3.0. A commercial license exists if copyleft is a legal problem.
Key features
- Hosted login, social IdP templates, MFA, and passkeys
- Organizations and project grants for multi-tenant B2B
- Actions: custom workflow after events, without shipping a sidecar
- SCIM v2.0 service provider for user create, update, deactivate, and delete, including an Okta inbound guide
Why we like it
Use it when you need tenant isolation that is not “another Keycloak realm and a prayer,” or when you want someone else to run the control plane. Cloud Free is real: $0, 100 daily active users. SCIM is documented as a service provider with provisioning-domain scoping for externalId.
Limits
First-party SCIM docs are honest about the hole: only the core User schema. Group provisioning is not supported. name.givenName, name.familyName, and at least one email are required. One API page is still titled SCIM v2.0 (Preview). Self-host means you accept AGPL-3.0 or you buy the commercial license Zitadel documents for Enterprise Self-Hosted.
License
AGPL-3.0 on the zitadel/zitadel repository (the project says the v3 move off Apache 2.0). Cloud Free is $0/month with 100 daily active users. Cloud Pro is $100/month. Enterprise is custom, cloud or self-hosted, and includes a commercial license that replaces AGPL.
CyberArk
Best for privileged access that an IdP will not vault for you
CyberArk is the privileged-access product on this list. Palo Alto Networks closed the acquisition on February 11, 2026 and launched Idira on May 12, 2026 as the next-generation identity security platform built on that PAM. The cyberark.com URL now serves Idira. Existing customers keep the product; the FAQ says the logo and design change first.
Key features
- Privileged access management for human admins, with session isolation and vaulting
- Machine and secrets controls on the Idira platform pages
- Zero standing privilege and just-in-time access in the current Idira messaging
- Agentic / AI-agent identity as a new platform pillar, per the May 2026 launch
Why we like it
Put it on the list for the account that is always on and always too powerful: the shared admin, the break-glass, the service that still has a password. An IdP can refuse SSO to that host. It cannot rotate the password the host still accepts. We did not invent SCIM support here. First-party pages we read do not put SCIM on the CyberArk/Idira homepage, so it stays off this entry.
Limits
This is not a drop-in workforce IdP. The brand is in motion: CyberArk to Idira under Palo Alto. Auditors still ask for PAM. Operators still complain that a vault you copy-paste from is a vault people paste into Notepad. You will buy it through sales, and you will staff it.
License
Commercial. No public per-user card on cyberark.com. Treat it as sales-led. Existing CyberArk contracts continue; Idira is the current platform name on that same URL.
What the internet thinks about identity protection
Live threads. We quoted the argument, not the score.
Hacker News
“There are free and open source solutions like Keycloak and Zitadel. I don’t dispute they are less common than Okta and Entra, but the definitely exist and are deployed in the real world. My workplace (state government) uses Keycloak for example.”
Volundr, 23 Oct 2024, on a post that treated enterprise SSO as a paid luxury. The OSS IdPs are not hypothetical. The same comment argues locking SSO behind a paywall is how small orgs skip deprovisioning.
Stack Overflow
“Both Keycloak and Okta should provide what you’re looking for. … Since both Keycloak and Okta use OAuth 2.0/OIDC, you might even be able to use Keycloak in development, and Okta in production.”
Matt Raible in December 2018, comparing CAS, Okta, and Keycloak. The protocols match. The operating model does not. That is still the fork.
Information Security
“Multiple standards, regulations, and advice beg people not to assign super-user permissions to a normal active user. Active normal users tend to interact with untrusted data and code, which is open to compromise.”
schroeder on 31 Aug 2022, on whether a super-admin should exist. The permission set can exist. Binding it to a daily-driver account is the standing-admin hole this list keeps naming.
FAQs
How do Okta and Entra differ from Keycloak, authentik, and Zitadel?
Okta and Entra ID are commercial cloud IdPs. You pay per user and Microsoft or Okta run the control plane. Keycloak, authentik, and Zitadel are software you can host (Zitadel also sells a cloud). The protocols overlap: OIDC, SAML, and some form of SCIM. The operating model does not. Self-host means you own upgrades, backups, and the SCIM preview-versus-GA reading. Cloud IdP means you own the bill and the vendor’s session-kill SKU.
Which tools on this list document SCIM?
Okta documents SCIM 2.0 and 1.1. Entra ID documents SCIM 2.0 as a client and as a service-provider API. Keycloak documents a SCIM Realm API as a preview feature in 26.7, off by default. authentik documents a SCIM 2.0 provider (outbound) and a SCIM source (inbound). Zitadel documents a SCIM v2.0 service provider for users, not groups. We did not find first-party SCIM language on the CyberArk/Idira homepage we used, so CyberArk is not listed as SCIM here.
Does a workforce IdP replace privileged access management?
No. An IdP authenticates people and, if you turn it on, provisions app accounts. Privileged access management vaults, isolates, and time-boxes the admin session on the system that still has a password. Entra PIM is just-in-time for Entra and Azure roles. CyberArk is the specialist on this list for the standing admin that lives outside that directory. Use both jobs. Do not pretend they are one SKU.
Is this a scored bake-off?
No. Order is editorial. We did not sit in a tenant or assign points. A tool is here if it is a live workforce IdP, a documented self-hosted IdP, or the privileged-access specialist, and if first-party pages still describe the control.
