Best Identity Governance (IGA) Tools in 2026: Live Graphs vs Certification Campaigns
Seven ways to decide who should have access, from AI-native challengers to the suites that built the access review.
Many access reviews still run on a quarterly cycle, and the cost shows: Okta cites Workday saving about USD 1M on certification campaigns and audit preparation, a figure Okta says is based on customer reporting. A manager gets a spreadsheet of hundreds of entitlements, approves nearly all of them in an afternoon, and the audit evidence says the review happened. Oak’s founding pitch is that this records what was true, never what is true now.
Identity governance and administration (IGA) covers joiner, mover, and leaver automation, access requests, certification campaigns, role models, and separation of duties. The suites that defined it, SailPoint and Saviynt, now add AI recommendations and agent identities. Microsoft bundles governance into the Entra Suite at USD 12 per user per month. C1, formerly ConductorOne, sells a lighter SaaS-first take.
The challengers argue the campaign model itself is the problem. Oak and NewCore build a live graph of what each identity holds and actually uses, and decide continuously. Both came out of stealth in 2026, so their capabilities are launch claims, stated rather than independently demonstrated.
How we evaluated
We read each vendor’s product pages, launch announcements, pricing pages, and public documentation on 14 Oct 2026, and checked each one against the same questions: how lifecycle automation is fed, how reviews work, whether AI agents and machine identities are governed, how connectors are built, and how pricing is published. Where public material does not cover a question, we write “not documented”.
| Tool | Best for | What to check |
|---|---|---|
| SailPoint Identity Security Cloud | Large-enterprise IGA with certifications, roles, and SoD | Cloud or self-managed · quote |
| Saviynt | Converged IGA plus Zuma for AI agents and NHIs | Zuma launched Jul 2026 · quote |
| Okta Identity Governance | Requests, certifications, and entitlements inside Okta | In Okta Essentials USD 17/user/mo, billed annually |
| Microsoft Entra ID Governance | Governance for Entra tenants: lifecycle, reviews, PIM | Entra Suite USD 12/user/mo |
| C1 | SaaS-first access reviews, requests, and AI access controls | Platform or Flex pricing · quote |
| Oak | Continuous governance on a live graph of held versus used access | Launched Jul 2026 · quote |
| NewCore | Governance inside a security-first IdP for people and agents | Launched Jun 2026 · quote |
SailPoint
Saviynt
Okta OIG
Entra ID Governance
C1
Oak
NewCore
Enterprise criteria: what to check before a shortlist
Oak and NewCore sit after the established suites because neither has independent validation or published customer references yet. Each cell summarizes the vendor documentation cited in that vendor’s entry below.
| Criterion | SailPoint | Saviynt | Okta OIG | Entra ID Governance | C1 | Oak | NewCore |
|---|---|---|---|---|---|---|---|
| Connector coverage | Cloud, on-prem, mainframe, and custom apps | Hundreds of pre-built integrations across SaaS, hybrid, on-prem, IaaS, ERP, CRM, and HR (vendor page) | Okta integrations; apps outside them not documented | Microsoft, hundreds of SaaS, and on-prem apps | Open source Baton connectors | AI connector framework (vendor says hours per connector) | not documented |
| Certification campaigns | Yes, with AI recommendations | AI-assisted certification campaigns across every identity type: workforce, external, non-human, and AI agents | Scheduled periodic certifications | AI-driven and standard access reviews | Access reviews | Continuous reviews by platform agents | not documented |
| Separation of duties | SoD policies | Cross-Application SoD listed as a Saviynt use case | SoD rules define conflicting entitlement combinations | Separation of duties checks on access packages (incompatible packages and groups) | not documented | not documented | not documented |
| HR-source integration | Lifecycle from HR sources | Integrates HR apps among supported app types | Profile sourcing from apps such as SAP SuccessFactors Employee Central | Lifecycle workflows plus API-driven inbound provisioning from HR sources | Lifecycle product | not documented | not documented |
| On-prem and legacy apps | On-prem and mainframe connectors; IdentityIQ self-managed | Cloud, hybrid, and on-prem apps | Okta Provisioning Agent with SCIM server or custom connectors | ECMA Connector Host for on-premises provisioning | not documented | not documented | not documented |
| AI agents and NHIs | AI agents in lifecycle scope | Zuma Insights, Access, and Governance | Okta for AI Agents extends discovery, lifecycle management, and governance to agents (Okta secure AI page) | Agent identities with human sponsors and Lifecycle Workflows | LLM gateway, MCP gateway, AI access vault | Human, machine, and AI-agent identities in one graph | Agents as first-class identities |
| Deployment and data residency | SaaS or self-managed IdentityIQ | Identity Cloud SaaS, with the option to deploy in your private cloud | Okta SaaS | Entra SaaS | SaaS, with a Commercial EU instance in AWS Frankfurt | not documented | not documented |
Only SailPoint documents role mining among these tools.
Sources: Okta Identity Governance docs, Okta on-premises provisioning, Entra ID Governance overview, Entra separation of duties, Entra inbound provisioning, Entra on-premises provisioning, Entra agent ID governance, Okta secure AI, Saviynt IGA. “not documented” means we checked these pages on 14 Oct 2026 and found nothing.
SailPoint Identity Security Cloud
Best for large enterprises with complex roles, SoD, and on-premises apps
SailPoint sells Identity Security Cloud as SaaS in Standard, Business, and Business Plus tiers, and IdentityIQ for self-managed deployments. It covers lifecycle automation from HR sources, access requests, certification campaigns with peer-group recommendations, role mining, and separation-of-duties policies.
Connectors span cloud, on-premises, mainframe, and custom applications, and SailPoint lists AI agents beside employees, contractors, and machine identities in its lifecycle scope.
Key features:
- Certification campaigns with AI recommendations
- Role modeling and mining
- Separation-of-duties policy
- Self-managed option through IdentityIQ
Why we like it:
Its role mining and separation-of-duties policies let auditors see role-based access and toxic combinations across hundreds of apps, including mainframe.
Limits:
Implementations are long and often partner-led. Price is per identity by quote.
License or pricing: Quote per identity for Standard, Business, and Business Plus. No public USD price.
Saviynt
Best for converged IGA with dedicated controls for AI agents
Saviynt sells converged identity governance on its Identity Cloud. On 28 Jul 2026 it launched Zuma, an AI identity security platform with three parts: Zuma Insights for discovering agents, LLMs, and NHIs, Zuma Access for runtime authorization, and Zuma Governance for ownership, lifecycle, and access reviews.
The same release said Saviynt had passed USD 300M in annual recurring revenue.
Key features:
- Converged IGA, PAM, and application access governance
- Zuma Insights discovery of agents and NHIs
- Zuma Access runtime intent checks
- Zuma Governance ownership and reviews for agents
Why we like it:
It gives one vendor for classic IGA and for agent governance, with the agent side built as a separate product rather than a checkbox.
Limits:
Zuma is new. Whether it is licensed separately from Identity Cloud is not documented.
License or pricing: Commercial. No public pricing.
Okta Identity Governance
Best for Okta customers who want governance in the same platform as SSO and lifecycle
Okta Identity Governance (OIG) adds access requests, access certifications, entitlement management, and reporting to the Okta platform. Requests run through a self-service portal and Slack or Teams, and Okta routes each one to the right approver.
Entitlements give fine-grained control inside an app, such as Admin versus read-only, and are managed on the unified user profile so a role change updates downstream permissions.
Key features:
- Self-service access requests via portal, Slack, and Teams
- Scheduled periodic access certifications
- Entitlement management inside downstream apps
- Queryable reporting for compliance
- Okta Lifecycle Management for onboarding and offboarding
Why we like it:
If Okta is already your IdP, governance uses the same directory, app integrations, and admin console, with no second connector layer to build.
Limits:
Role mining is not documented. Value drops if Okta is not your IdP.
License or pricing: Access Governance is included in Okta Essentials at USD 17 per user per month, billed annually, with a USD 1,500 annual contract minimum.
Microsoft Entra ID Governance
Best for organizations already standardized on Entra
Entra ID Governance adds entitlement management, lifecycle workflows driven by HR signals, AI-driven and standard access reviews, and privileged identity management for users or groups to an Entra tenant.
It connects to Microsoft apps, hundreds of other SaaS apps, and on-premises apps, and it ships inside the Microsoft Entra Suite.
Key features:
- Entitlement management and access packages
- Lifecycle workflows from HR sources
- AI-driven access reviews
- PIM for users and groups
Why we like it:
For an Entra shop it is the lowest-friction start, and PIM evidence alone fixes a common audit finding.
Limits:
Role mining is not documented. Non-Microsoft app coverage depends on provisioning connectors.
License or pricing: Included in Microsoft Entra Suite at USD 12 per user per month, paid yearly.
C1
Best for SaaS-heavy companies that want reviews and requests running in weeks
ConductorOne rebranded as C1 in April 2026. Its Govern products are Identity Governance, Lifecycle, Access, and Comply, and its Run products add an LLM gateway, an MCP gateway, and a vault for AI access.
C1 sells two ways: Platform, priced per managed identity, or Flex, billed monthly in C1 Tokens across usage. A Commercial EU instance keeps tenant data in AWS Frankfurt.
Key features:
- Access reviews, requests, and lifecycle
- Open source Baton connectors
- LLM and MCP gateways for AI access
- EU data residency instance
Why we like it:
It is the quickest of the established options to stand up, and it covers AI tool access in the same console.
Limits:
Role mining and SoD depth for very large enterprises are not documented. Federal authorization is planned, not current.
License or pricing: Platform per managed identity, or Flex usage billing. No public USD price.
Oak
Best for replacing quarterly campaigns with continuous, evidence-based decisions
Oak came out of stealth in July 2026, founded by Shai Morag, who previously founded Ermetic, and Tal Marom.
Its answer to the quarterly campaign is a continuous review: built-in agents onboard apps through an AI connector framework that Oak says builds connectors in hours, compare the access each identity holds with what it uses, and remediate at the root cause.
Key features:
- Live identity graph of held versus used access
- AI connector framework for new apps
- Continuous reviews run by platform agents
- Up to 500 hours of White Gloves implementation for qualified Fortune 500 buyers
Why we like it:
It attacks the part of IGA everyone hates, onboarding apps and rubber-stamp reviews, instead of adding features around it.
Limits:
Launch-stage. Oak says it is generally available but does not name customers. Separation-of-duties and role modeling depth are not documented.
License or pricing: Commercial. No public pricing.
NewCore
Best when governance and the identity provider should be one product
NewCore came out of stealth in June 2026 with USD 66M; its co-founders include Zohar Alon, who previously founded Dome9.
For governance, the point is that there is no separate system to connect: its Agentic Governance module applies one policy grammar and one audit trail to humans and AI agents, on top of Identity Discovery and its own sign-in layer.
Key features:
- One policy grammar for humans and agents
- Identity Discovery graph
- Agents as first-class identities with trust scores and revocation
- Sign-in, MFA, and token signing in the same platform
Why we like it:
Buyers replacing an IdP can collapse governance into it, with agents governed the same way as staff.
Limits:
Launch-stage. Certification campaigns, SoD, and HR-source integrations are not documented.
License or pricing: Commercial. No public pricing.
How to choose an IGA tool
- Check your IdP first. If you run Okta, price Okta Identity Governance against a standalone suite before buying a second platform.
- Count your apps and their connectors. List apps that need provisioning, not just SSO. The connector story decides both cost and timeline.
- Decide on the review model. If auditors accept continuous evidence, Oak and NewCore are worth a pilot. If they expect campaigns, the suites fit.
- Check agent ownership. Ask each vendor to show an AI agent with a named human owner, its access, and how it is revoked.
- Price the Microsoft baseline. If Entra Suite covers most needs, the question is what a second tool adds.
What we left out
- One Identity and Omada: credible suites, left off to keep the list to seven.
What the internet thinks about identity governance
Live threads, quoted for the argument, not the score.
Hacker News · March 2026
“What Microsoft sells to enterprise is governance, and they really don’t have any competition in this area.”
From a European energy-sector IT lead explaining why replacing Microsoft is hard. The reply from others in the thread: Keycloak-based stacks can replace sign-in, not the governance layer.
Hacker News · June 2026
“What’s cooler is then it can view/add/remove people from channels, so it can conduct access reviews — overall I consider it a security improvement.”
An engineer describing an agent acting with a user’s OAuth permissions. Skeptics answer that an agent inheriting all of a user’s access is exactly what governance has to catch.
Choose SailPoint for large, audit-heavy estates with SoD and on-premises apps. Choose Saviynt for converged IGA with dedicated agent controls. Choose Okta Identity Governance if Okta is already your IdP and you want governance in the same console. Choose Entra ID Governance if you run Entra. Choose C1 for fast SaaS-first rollouts. Choose Oak when you want to replace campaigns with continuous decisions and can pilot a launch-stage vendor first. Choose NewCore when the IdP is also up for replacement and you can pilot it first.
FAQs
What is IGA?
Identity governance and administration: automating joiner, mover, and leaver changes, access requests, access reviews, roles, and separation of duties.
How is IGA different from ISPM?
IGA decides and provisions who should have access. ISPM finds risky configurations and unused access across identity systems. See ISPM tools.
Do IGA tools govern AI agents?
Increasingly. Saviynt Zuma, C1, Oak, and NewCore document AI agent identities, and SailPoint lists agents in lifecycle scope.
