Microsoft Identity Manager Alternatives in 2026: Six Options Compared

Microsoft Identity Manager alternatives are no longer a theoretical question. Extended support for MIM 2016 ends on 9 January 2029, Service Pack 3 is the last compatibility update Microsoft has promised, and the product’s reporting, MFA and BHOLD pieces are already being switched off around it. This guide compares the six realistic options for a MIM estate in 2026 — Microsoft Entra ID Governance, SailPoint, Saviynt, One Identity Manager, Omada and open source midPoint — on where they run, what they cost, how long a replacement takes and which kind of organisation each one fits. It also lays out what Microsoft’s own migration path covers and what it quietly leaves out.

Published November 2026. Inalogy is a midPoint Gold Partner and does not resell any of the other platforms. We migrate MIM estates to midPoint for a living, and we have advised customers to go to Entra ID Governance where that was the right answer. Read the midPoint section with that in mind.

If you want the case for midPoint specifically, with our migration framework and phase timelines, that is in Microsoft Identity Manager replacement: options and timeline. This article is the vendor-neutral comparison that sits in front of it.

Where MIM stands in November 2026

Three things changed in 2026 for anyone still running Microsoft Identity Manager, and none of them changed the deadline.

Sources: Microsoft’s MIM 2016 documentation (support update, SP3, deprecations) and the SP3 briefing by Kocho, a Microsoft partner, for the SP2 date.

What Microsoft’s own migration path covers, and what it leaves out

Microsoft publishes a migration guide from MIM to Microsoft Entra. It is honest about its shape: a scenario table, with a cloud service against each MIM use case, and a note that the document “will be updated as new scenarios become available to migrate”. Read it before you shortlist anything, because it defines the baseline every alternative has to beat.

What the guide maps today:

• HR-driven provisioning. Workday and SuccessFactors through built-in connectors; other on-premises HR systems through the API-driven inbound provisioning endpoint, with joiner and leaver automation in Lifecycle Workflows.
• Provisioning to on-premises applications. The ECMA Connector Host, a lightweight agent that reuses MIM-style connectors for SQL, LDAP, PowerShell, SOAP and REST web services and custom ECMA2 code.
• Groups. Dynamic and self-service groups in Entra ID; Cloud Sync can now write group memberships back to on-premises Active Directory for Kerberos applications.
• Self-service. Password reset with writeback to AD; access requests with multi-stage approval through entitlement management access packages.
• Governance. Access reviews for groups, applications, access packages and roles; guidance for moving an organisational role model into Entra ID Governance.
• Reporting and privileged access. Azure Monitor for audit history; Privileged Identity Management and the hybrid security guidance in place of MIM PAM.

What it does not map, and what we see in almost every MIM estate older than five years:

• The metaverse logic. Multi-source attribute precedence, join rules, scoped sync rules and the “who wins” decisions that accumulated over a decade have no cloud equivalent. They are re-modelled, not migrated.
• Custom workflow activities. The guide says “some” Workflow Activity Library activities can move to Lifecycle Workflows. The rest, typically the ones that call internal systems, are rewritten or dropped.
• Anything that must stay on-premises. Entra ID Governance is a cloud service. The agent reaches on-premises targets, but policy, data and decisions live in Microsoft’s tenant. For regulated organisations that must keep identity data in their own jurisdiction, this is the question, not a footnote.
• Certificate Management and BHOLD. MIM CM is not in the scenario table; BHOLD role mining and attestation map only partially to access reviews and the role-model guidance.
• Non-Microsoft estates. Mainframes, bespoke LDAP schemas, SAP landscapes that are staying on-premises: reachable through the ECMA host and the SAP integration guidance, but every one is an exception to design rather than a template to apply.

The practical consequence: the more your MIM is a plain AD-plus-HR provisioning engine, the better Microsoft’s path fits. The more it is a custom integration hub, the sooner you are comparing full identity governance platforms.

Microsoft Identity Manager alternatives at a glance

Timelines are our estimates for a mid-size estate, from public case studies and our own projects; vendor accelerators shorten them and your procurement cycle lengthens them. Prices are list prices from the vendors’ public pages as of November 2026, or third-party benchmarks where the vendor publishes none. A wider comparison of the governance platforms themselves, including Okta, is in our identity governance software comparison.

Microsoft Entra ID Governance

Entra ID Governance is the alternative Microsoft wants you to choose, and for a specific kind of MIM estate it is the right one. It adds entitlement management, access reviews, Lifecycle Workflows and the on-premises provisioning agent to Entra ID. It is sold as a $7 per user per month add-on, paid yearly, on top of Entra ID P1 or P2; P1 is included in Microsoft 365 E3 and P2 in E5, so for most Microsoft 365 customers the governance add-on is the only new line. The Entra Suite bundles governance with network access and verified ID at $12.

Where it fits. Your sources of truth are a cloud HR system or an on-premises HR database you can expose through an API; your targets are Active Directory, Microsoft 365, SaaS applications with SCIM, and a manageable set of on-premises applications reachable through the ECMA host; your MIM customisation is modest. In that estate the migration is a sequence of scenario moves, each one switching a MIM management agent off, and the operational burden drops to zero.

Where it does not. Identity data and policy move into a US-headquartered cloud, which under NIS2, DORA and national critical-infrastructure rules is a decision your auditors will ask about. Complex multi-source logic, certificate management and custom workflow code have no destination. And the per-user model that looks modest at 500 users is a different conversation at 20,000, before guest identities. Our MIM replacement article goes through the architecture, customisation, sovereignty and cost arguments in detail.

SailPoint

SailPoint is the IGA market leader by revenue and ecosystem, public since 2025, and the default name on a large-enterprise shortlist. Identity Security Cloud is the SaaS product, sold in Standard, Business and Business Plus suites; IdentityIQ, the self-hosted product many MIM customers would have chosen a few years ago, is in transition to the cloud. Pricing is per identity per year on quote; since the Navigators programme of December 2025 there are flexible bundles, and third-party benchmarks put list prices at $30–90 per identity per year before discounts.

Where it fits. A MIM estate that was always undersized for the organisation, where the real need is full governance at scale: role mining, certification campaigns across hundreds of applications, AI-driven access recommendations, and a vendor roadmap for machine and AI-agent identities. SailPoint’s connector catalogue and partner bench are the deepest in the market.

Where it does not. SaaS is the direction, so an organisation that chose MIM partly because it runs on-premises faces the same sovereignty question as with Entra, at a higher price. Licence cost scales with headcount for the life of the contract. We compare the two platforms we see most often on European shortlists in midPoint vs SailPoint.

Saviynt

Saviynt sells one converged cloud platform, Identity Cloud, that covers identity governance, application access governance (fine-grained SoD inside SAP and other ERP systems), privileged access and, since 2026, governance of AI identities. It is SaaS only, in Essentials, Pro and Premium tiers with no public prices, and the company closed a $700 million funding round led by KKR in December 2025, so it is not going anywhere.

Where it fits. A MIM customer whose next requirement is not “replace the sync engine” but “govern SAP, cloud and privileged access from one console”, and who is comfortable with a cloud-only platform. The ERP-level SoD controls are a genuine differentiator for finance-heavy organisations.

Where it does not. There is no on-premises edition at all, which rules it out for estates that must keep identity processing in their own data centre. Implementation partners in Central Europe are fewer than for SailPoint or One Identity.

One Identity Manager

Of the commercial options, One Identity Manager is the closest in shape to MIM: an on-premises product (with a SaaS edition, Identity Manager On Demand) built around a synchronisation engine, a rich data model, connectors and a process orchestration layer, with particularly deep Active Directory and SAP integration. The product’s heritage is in Berlin, which still matters for the German-speaking market where it is widely deployed. Version 10.0, announced in January 2026, added risk-based governance, identity threat detection playbooks and AI-assisted reporting. It is priced per managed person, on quote.

Where it fits. A large, complex on-premises estate with SAP at its centre, an in-house team that will own the platform, and a willingness to customise. MIM administrators recognise the architecture quickly.

Where it does not. The same flexibility that attracts MIM teams is the main project risk: One Identity Manager implementations are known for deep customisation that is expensive to upgrade later. Licence cost scales with headcount, and the vendor is a Quest Software subsidiary headquartered in the United States.

Omada

Omada, headquartered in Copenhagen, is the European SaaS answer. Omada Identity Cloud runs as single-tenant SaaS on Azure, in an EU or US region fixed by contract, and there is an on-premises edition, Omada Identity, for organisations that need it. The product is process-driven: the IdentityPROCESS+ framework ships the joiner, mover, leaver, request and certification processes pre-built, and the company guarantees a twelve-week deployment for its standard scope.

Where it fits. A Microsoft-heavy European organisation that wants out of operating identity software, wants an EU vendor and EU hosting, and whose processes can bend to a standard framework. For a MIM estate that is mostly AD, Entra and a dozen standard applications, the twelve-week route is real.

Where it does not. Organisations whose processes cannot bend. The accelerator covers the standard scope; the custom MIM logic sits outside it and is priced and scheduled separately. Per-user pricing, as with every commercial option.

midPoint, the open source alternative

midPoint is a complete identity governance and administration platform developed by Evolveum in Bratislava and published under Apache 2.0 and the EUPL. There is no licence fee and no per-identity metric: the budget goes to implementation, operations and an optional vendor subscription. Release 4.11 “Čapek” shipped in October 2026 and is supported until October 2028; the 4.8 long-term-support line runs to October 2028 and the next LTS, 4.12, is planned for October 2027, so a migration can be planned against a published release calendar.

For a MIM team the architecture is familiar and the scope is bigger. Resources, connectors (the ConnId framework: LDAP, Active Directory, databases, CSV, REST, SCIM and a community catalogue) and mappings replace management agents and sync rules; on top sit roles, org structures, access requests, certification campaigns, segregation-of-duties policies and a full audit trail. Simulation runs a new configuration against production data read-only before cut-over, which is how we de-risk the moment a MIM rule becomes a midPoint mapping.

Where it fits. Organisations that must keep identity data and policy under their own control, in their own jurisdiction: public sector, financial services, critical infrastructure, higher education. Organisations with large or growing headcounts for which per-identity licensing is the wrong shape. Estates with non-standard targets, because open source lets you build the connector instead of waiting for it. And organisations that want governance, not just provisioning, but do not want to pay a commercial suite for it. midPoint runs in your data centre, in your private cloud, or as a managed service on German infrastructure through IAM Factory.

Where it does not. midPoint needs an experienced partner or a trained in-house team; there is no SaaS from the vendor, only from partners; the user interface and reporting are functional rather than polished; and privileged access management is not in the product. We say so to every customer before they sign, and we lay the cost drivers out on our midPoint implementation pricing page.

How we replace MIM with it, in four phases from discovery to decommission, is on the Microsoft Identity Manager migration service page. For how midPoint compares with the other open source candidates, see our comparison of open source IGA platforms.

Other names on the alternative lists

Review sites list a dozen more “MIM alternatives”. Most are not. Three that come up often:

• Okta Identity Governance is a governance add-on to Okta’s workforce identity suites. If Okta is already your identity provider it is worth a look; it is cloud-only and its provisioning reach into on-premises systems is narrower than any option above. It is in our seven-platform comparison.
• Netwrix Directory Manager (formerly GroupID) manages users and groups in Active Directory and Entra ID with self-service and dynamic membership. It replaces the group-management slice of MIM well and nothing else: no HR-driven provisioning to non-Microsoft targets, no governance.
• Entra-native specialists, often from the Microsoft partner channel, that package Entra ID Governance with their own workflow layer for a flat fee. They inherit every property of Entra ID Governance, including where the data lives.

Single sign-on and MFA products (Ping, JumpCloud and others) appear on the same lists because they share the word “identity”. They do not replace a provisioning engine.

How to choose: five questions that decide it

1. Where must identity data and decisions live? If the answer is “in our jurisdiction, on infrastructure we control”, the list shortens to One Identity Manager, Omada’s on-premises edition and midPoint. If a Microsoft, SailPoint or Saviynt cloud is acceptable to your regulator and your board, every option stays.
2. How much of the estate is not Microsoft? Count the management agents that point at something other than AD and Exchange. Under five with standard protocols: Entra ID Governance is a serious candidate. Fifteen with custom code: you need a platform built for heterogeneous estates.
3. How much MIM logic is really business policy? Export the sync rules and workflows and sort them into “policy we need”, “workaround for a MIM limitation” and “nobody knows”. Only the first pile has to survive the migration. In our MIM discoveries it is usually under half.
4. Who will operate it in 2030? No team: SaaS (Entra, SailPoint, Saviynt, Omada) or a managed service (midPoint through a partner). A team that wants to own it: One Identity Manager or midPoint.
5. What does year five cost? Multiply the per-identity price by your 2030 headcount, including contractors and guests, and add implementation. Compare that to a one-off implementation plus operations with no licence line. The answer flips depending on headcount, which is why there is no single best alternative.

Cost bands and the calendar

Take an organisation with 5,000 identities as a worked example, list prices, licences only, per year:

• Entra ID Governance: $7 × 5,000 × 12 = $420,000 for the governance add-on; the same again for Entra ID P1 if it is not already covered by Microsoft 365 E3 or E5.
• SailPoint, at the $30–90 benchmark: $150,000–450,000 before discounts; Saviynt, Omada and One Identity sit in the same per-identity shape, on quote.
• midPoint: $0 licence. The implementation is a one-off project in the range our pricing page describes, operations are in-house, partner or managed, and the optional Evolveum subscription is a fixed amount independent of headcount.

Over five years the licence lines dominate for the commercial options and the implementation line dominates for midPoint, which is why midPoint’s advantage grows with headcount and shrinks for a 300-user organisation that already owns Microsoft 365 E5.

The calendar is the same for everyone: 26 months to 9 January 2029. A mid-market estate needs three to four months of project after procurement, an enterprise five to eight, a large estate eight to fourteen. Add a European procurement cycle of three to nine months and a buffer, and a large enterprise that intends to be off MIM before the deadline starts discovery no later than mid-2027. Partner capacity is the constraint we already see: the same pattern as SAP IDM, whose maintenance ends in December 2027, where organisations that started 18 to 24 months ahead got their pick of partners.

Frequently asked questions about Microsoft Identity Manager alternatives

What are the alternatives to Microsoft Identity Manager?

Six options cover the realistic choices: Microsoft Entra ID Governance (Microsoft’s own cloud path), SailPoint Identity Security Cloud, Saviynt Identity Cloud, One Identity Manager, Omada Identity Cloud, and open source midPoint. Entra ID Governance fits Microsoft-centric estates with simple provisioning; the commercial suites fit large enterprises that want a vendor-run SaaS platform; One Identity and midPoint are the options that run on-premises; midPoint is the only one without a per-identity licence.

Does MIM 2016 Service Pack 3 extend support beyond 2029?

No. Service Pack 3, released in spring 2026, is a compatibility update for current SharePoint, Exchange, SQL Server and Windows Server versions. Extended support for MIM 2016 still ends on 9 January 2029 for Entra ID P1 and P2 customers, and Service Pack 2 is supported only until May 2027, so every estate has to apply SP3 even if it plans to leave MIM.

Which MIM alternative is closest to how MIM works?

One Identity Manager and midPoint. Both are built around a synchronisation engine with connectors, a central identity repository and policy that decides what each connected system should contain, which is the MIM mental model with governance added on top. Entra ID Governance is a different architecture: cloud services that each replace one MIM scenario, with an agent for on-premises targets.

Is Microsoft Entra ID Governance enough to replace MIM?

For an estate whose sources are HR and whose targets are Active Directory, Microsoft 365, SCIM-capable SaaS applications and a few on-premises applications reachable through the ECMA Connector Host, usually yes, and Microsoft’s migration guide maps each scenario. It is not enough where identity data must stay on-premises, where MIM holds complex multi-source logic or certificate management, or where many targets are outside the Microsoft ecosystem.

What is the cheapest way to replace MIM?

It depends on headcount and what you already own. A small organisation on Microsoft 365 E5 pays only the governance add-on and little implementation, which is hard to beat. From a few thousand identities upwards, open source midPoint is usually the lowest five-year cost because it has no licence line; the money goes into a one-off implementation and into operations that do not grow with headcount.

When does a MIM replacement project have to start?

Count backwards from 9 January 2029: project duration (three to fourteen months by estate size), procurement (three to nine months in the public sector), and a buffer for the SP3 and SharePoint upgrade you must do anyway. Large estates should be in discovery by mid-2027; mid-market estates have until early 2028, if a partner is available then.

The bottom line on Microsoft Identity Manager alternatives

MIM has a hard end date, a last service pack and no successor. Microsoft’s path covers the simple estates well and the complex ones partially. SailPoint, Saviynt and Omada move you to a vendor-run cloud at a per-identity price; One Identity Manager keeps you on-premises at a per-identity price; midPoint keeps you on-premises, or in the EU cloud of your choice, with no licence at all. Which one is right depends on where your data must live, how much of your MIM is business policy, who will run the platform in 2030 and what your headcount does to the bill.

If you are running MIM and have not yet sorted your management agents into those piles, that is where we start. Inalogy offers a Migration Readiness Assessment: we inventory your MIM estate, say honestly whether Entra ID Governance would do, and if it would not, deliver a midPoint migration roadmap with phases and a timeline. Scope and phases are on our Microsoft Identity Manager migration page; to talk it through, contact us.

Inalogy is a European IAM specialist and midPoint Gold Partner (Evolveum), based in Bratislava. We deliver midPoint and Keycloak implementations and MIM, SAP IDM and DirX migrations across Central and Western Europe.

Sources: Microsoft Learn, MIM 2016 and the MIM to Entra migration guide (both updated October 2026) · Microsoft Entra pricing page · Kocho, MIM SP3 briefing (July 2026) · Evolveum midPoint release page · vendor announcements as cited in our identity governance software comparison.