Identity Governance Software Compared (2026): SailPoint, Saviynt, Omada, One Identity, Entra, Okta and midPoint

Identity governance software is bought on a shortlist of five to seven names, and in 2026 the shortlist has changed shape: SailPoint has new pricing and AI agents, Saviynt has a billion-dollar war chest, Omada and Okta carry fresh analyst badges, One Identity shipped a major release, Microsoft sells governance as a seven-dollar add-on, and open source midPoint has become the sovereignty option that European buyers ask about by name. This guide compares the seven platforms on what actually decides the choice — governance scope, deployment and data sovereignty, licensing model, ecosystem, and how each handles machine and AI identities — and says which one fits which organisation.

Published October 2026. Inalogy is a midPoint Gold Partner and does not resell any of the other platforms. We have implemented midPoint, migrated organisations off commercial suites, and advised customers to stay on a commercial suite where that was the right answer. Read the midPoint section with that in mind; the rest is written from public sources and project experience.

Two analyst documents frame the market this year: Gartner’s Market Guide for Identity Governance and Administration (October 2025) and KuppingerCole’s Leadership Compass for IGA (2026), which several vendors below cite in their own announcements. Neither tells you which platform fits your estate. That is what the sections below are for.

How we compared the platforms

Six questions, asked of every platform in the same order:

• Governance scope. Joiner-mover-leaver lifecycle, role model, access requests and approvals, access certification, segregation of duties, audit evidence. Products that only do single sign-on or provisioning were left out.
• Deployment and data sovereignty. SaaS only, on-premises only, or both; where the data sits; who holds the keys. For organisations under NIS2, DORA or KRITIS this is a hard requirement, not a preference.
• Licensing model and what is public. Per identity per year, per user per month, or no licence at all — and whether the vendor publishes a price.
• Ecosystem. Partners, connectors, documentation, how easy it is to find people who have done it before.
• Machine and AI identities. Service accounts, workloads and, since this year, AI agents: can the platform give them an owner, a role and an expiry?
• Fit. The honest answer to “who should buy this” — including when the answer is “not you”.

We quote vendor list prices only where the vendor publishes them. Everything else is labelled as a third-party benchmark, and all of it is negotiable.

Identity governance software compared: the 2026 shortlist

A note on what is missing. Oracle, IBM and Broadcom still sell identity governance, mostly to their installed bases; SAP’s own IDM reaches end of mainstream maintenance in 2027 and has no successor product, which is covered in our SAP IDM end-of-life guide; Microsoft Identity Manager ends in January 2029, covered in the MIM replacement guide. Both are exits, not shortlist candidates.

SailPoint: the market leader, now with flexible contracts and AI agents

SailPoint returned to the public market in 2025 and has spent the year reshaping how it sells. Navigators, announced in December 2025, replaces fixed SKUs with flexible agreements — including a “Modernization Flex” track built to move IdentityIQ customers to Identity Security Cloud. Identity Security Cloud itself is sold in Standard, Business and Business Plus suites. In March 2026 SailPoint added Harbor Pilot, a set of AI agents inside the product that answer documentation questions and generate workflows from prompts, and it positions its Agentic Fabric as the control plane for discovering and governing AI agents and MCP servers.

What you get: the broadest governance feature set in the market, the largest partner ecosystem, mature certification and role-mining tooling, and a vendor that will still exist in ten years. What you pay: a per-identity subscription that grows with headcount whether or not you use more of the product, with third-party benchmarks around 30 to 90 US dollars per identity per year at list before discounts, plus the implementation partner. What to watch: IdentityIQ, the on-premises product, is still sold and supported, but the commercial energy has moved to the cloud. Customers who chose IdentityIQ for on-premises control should decide actively, not by default, where they go next. We compare the two platforms in depth in midPoint vs SailPoint.

Saviynt: converged identity cloud with a new war chest

Saviynt sells one SaaS platform — Identity Cloud — that bundles identity governance with application access governance, privileged access management and, since 2026, controls for AI agents: Identity Security for AI arrived in March and intent-aware runtime authorisation, which evaluates an agent’s actions as they happen, in June. In December 2025 the company raised 700 million dollars in a KKR-led round at a valuation of about three billion, so the roadmap is funded for years.

What you get: the most complete single-vendor stack if you want governance, PAM and fine-grained application controls together, strong SAP and healthcare references, and a cloud-only architecture that upgrades itself. What you pay: Essentials, Pro and Premium tiers with no published prices; third-party estimates range from the low tens of dollars per identity per year to several times that once PAM and application governance modules are added, and implementation services are commonly as large as the first-year subscription. What to watch: there is no on-premises option, so data residency is a contractual question (EU regions exist) rather than an architectural one.

Omada: European, process-driven, twelve weeks to live

Omada is the European pure-play on this list: headquartered in Copenhagen, with Omada Identity Cloud delivered as single-tenant SaaS on Microsoft Azure and Omada Identity still available for on-premises deployment. The company leans on a standardised process framework — IdentityPROCESS+ — and an implementation accelerator with a guaranteed twelve-week deployment, and it was named a leader in all four categories of KuppingerCole’s 2026 IGA Leadership Compass according to its own announcement.

What you get: a governance-first product with strong certification, role and policy capabilities, an EU vendor, and a predictable implementation if you accept the standard processes. What you pay: per user per year on quote; nothing is published. What to watch: the hosting region (EU or US) is chosen per contract, so write it down; and the twelve-week promise assumes your data and processes fit the framework — organisations with heavily customised processes should budget for the gap.

One Identity Manager: the customisable on-premises heavyweight, now 10.0

One Identity Manager, part of Quest Software’s One Identity portfolio, has its product heritage in Berlin and a long record in large German-speaking enterprises with SAP at the centre. Version 10.0, announced in January 2026, adds risk-based governance, identity threat detection and response playbooks and AI-assisted reporting. It is available on-premises and as a vendor-operated SaaS edition.

What you get: a deeply customisable data model and workflow engine, the strongest SAP coverage among the commercial suites, and the option to keep everything on your own infrastructure. What you pay: per managed person, on quote, plus the specialist skills the product demands — One Identity Manager projects are rarely small. What to watch: customisation is also the risk; estates that have bent the product far from standard find upgrades expensive, and the skills market is thinner than SailPoint’s.

Microsoft Entra ID Governance and Okta Identity Governance: governance as a suite add-on

Two platforms on the shortlist are not standalone governance products but add-ons to an identity platform you may already own. Microsoft Entra ID Governance is the only product in this comparison with a public price: 7 US dollars per user per month on top of Entra ID P1 or P2, or 12 dollars for the Entra Suite bundle (check Microsoft’s pricing page for your region). It delivers lifecycle workflows, access packages, access reviews and entitlement management natively for everything behind Entra, and reaches other systems through SCIM, API-driven provisioning and the Microsoft Identity Manager successor connectors. For a Microsoft-centric estate it is hard to beat on price; for a landscape with mainframes, SAP, bespoke databases and on-premises directories outside Entra’s reach, it becomes a second governance layer rather than the only one.

Okta Identity Governance plays the same role inside Okta Workforce Identity: access requests, certification campaigns and lifecycle management in the console Okta customers already use, priced as an add-on to the Professional and Enterprise suites on request. Okta announced a leader placement in KuppingerCole’s 2026 IGA Leadership Compass. Its strength is the same as its limit: it governs what Okta sees. Both products are SaaS only; data residency is a region choice, not a deployment choice.

midPoint: full identity governance under your own control

midPoint is the open source platform on the list, developed by Evolveum in Bratislava under Apache 2.0 and EUPL licences. It is not a lightweight alternative: the lifecycle engine, role model with inheritance, access requests and approvals, certification campaigns, segregation-of-duties policies and audit trail are all in the core product, and the platform has been in production in banks, universities and public administrations for over a decade. Release 4.11 “Čapek” shipped in October 2026; 4.8 is the long-term-support line with support to October 2028, and the next LTS, 4.12, is planned for October 2027 (release schedule). The product has also become a practical base for governing AI agents as identities with owners, roles and expiry — the subject of our AI agent governance article.

What you get: the complete governance scope with no licence fee and no per-identity growth in cost, deployable on-premises, in a private cloud, on Kubernetes or as a managed service from a partner, with an EU vendor and an EU partner network of seven Gold partners. What you pay: implementation and operations, plus an optional Evolveum subscription for support and maintenance releases; the cost drivers are explained on our midPoint implementation pricing page. What to watch, honestly: the user interface and reporting are functional rather than polished, analytics are thinner than SailPoint’s or Saviynt’s, there is no native PAM module, and SaaS exists only through partners. If the deciding factor is a glossy end-user portal, it is not the winner; if it is control, cost and sovereignty, it usually is.

What identity governance software costs: three pricing models

Strip the packaging away and there are three models on this list.

• Per identity per year — SailPoint, Saviynt, Omada, One Identity. The bill scales with headcount, contractors and service accounts, and discounts depend on commitment length. Worked example from third-party benchmarks: 5,000 identities at 50 dollars is 250,000 dollars a year before implementation, roughly 1.25 million over five years, rising with every hire.
• Per user per month as an add-on — Microsoft and Okta. Cheap per unit, especially Microsoft’s published 7 dollars, but only for users who are already licensed on the parent platform, and only for the systems that platform reaches.
• No licence, pay for the work — midPoint. Implementation, an optional subscription and operations; the cost grows with the number of connected systems and the quality of your data, not with the number of people. We explain the drivers, project sizes and durations in midPoint implementation pricing.

For every platform, implementation services are a large part of year one and operations are the cost that lasts. Compare five-year totals, not licence quotes.

Which identity governance software fits which organisation

• Global enterprise, 20,000 or more identities, budget for the leader: SailPoint Identity Security Cloud, with Saviynt as the converged alternative if PAM and application access governance belong in the same programme.
• Mid-size European organisation that wants SaaS from an EU vendor and standard processes: Omada Identity Cloud, with the hosting region fixed in the contract.
• SAP-heavy, on-premises, in-house identity team, deep customisation: One Identity Manager, or midPoint if the licence line and vendor lock-in are the concern.
• Everything already behind Microsoft Entra, few legacy systems: Entra ID Governance first; add a full platform only when the systems outside Entra make it necessary.
• Okta shop that needs requests and reviews quickly: Okta Identity Governance, with the same caveat about reach.
• Regulated organisation under NIS2, DORA or KRITIS that must keep identity data and keys on infrastructure it controls, or any organisation whose per-identity bill has become the problem: midPoint, implemented by a partner, operated in-house or as a managed service in the EU.
• Leaving Microsoft Identity Manager or SAP IDM: any of the above is a candidate; the migration path matters more than the destination, which is why we run MIM migration and SAP IDM migration as defined services.

Frequently asked questions about identity governance software

What is the best identity governance software in 2026?

There is no single best. SailPoint has the broadest feature set and ecosystem, Saviynt the most converged cloud platform, Omada the strongest European SaaS story, One Identity the deepest on-premises customisation, Microsoft and Okta the cheapest path for estates already on their platforms, and midPoint the only full-scope platform without a licence fee that you can run anywhere. The best choice depends on your systems, your sovereignty requirements and your five-year budget.

What is the difference between identity governance and identity management?

Identity management (or administration) creates, changes and removes accounts and access — provisioning and lifecycle. Identity governance adds the control layer: role models, access requests with approvals, periodic certification, segregation-of-duties policies and the audit evidence that proves access is appropriate. IGA platforms do both; single sign-on products do neither.

Is open source identity governance software good enough for a regulated enterprise?

Yes, if the platform delivers the full governance scope. midPoint does — lifecycle, roles, requests, certification, SoD and audit are in the core — and it runs in banks and public-sector organisations across Europe. What open source does not include is a licence, so the budget goes to implementation and operations instead. Our comparison of open source IGA platforms looks at the candidates in detail.

How much does identity governance software cost?

Commercial suites are priced per identity per year, typically on quote; third-party benchmarks put the leading SaaS platforms in the range of tens of dollars per identity per year at list before discounts, so a 5,000-identity organisation spends in the low hundreds of thousands of dollars a year on licences alone. Microsoft publishes 7 dollars per user per month for Entra ID Governance. midPoint has no licence fee; its cost is implementation, optional subscription and operations.

Which identity governance platforms support EU data residency and sovereignty?

All the SaaS platforms offer EU hosting regions; what differs is who operates the platform and holds the keys. Omada and Evolveum are EU-headquartered vendors. midPoint and One Identity Manager can run entirely on infrastructure you control, which is the strongest position under NIS2, DORA and KRITIS.

Can identity governance software manage AI agents and service accounts?

Increasingly, yes. SailPoint, Saviynt and Okta have all announced controls for AI agents in 2026, and midPoint already models non-human identities as first-class objects with owners, roles and expiry. Ask each vendor for a live demonstration of agent onboarding, approval and revocation rather than a roadmap slide.

Choosing identity governance software: decide on control, not on logos

The seven platforms above all do identity governance. They differ in who controls the platform, how the bill grows, and how much of your estate they can reach. If you want a second opinion on a shortlist, a migration plan away from MIM or SAP IDM, or an honest assessment of whether midPoint fits your organisation — including the cases where it does not — tell us about your systems and identity count and let’s talk. We answer with a concrete recommendation, not a sales deck.