Best Identity and Access Management Software in 2026
Identity software decides who may log in to your staff systems or your own product, and its price is set by a meter: users, active users, retained users or customer connections.
This guide ranks twelve identity products on what the first ninety days cost, the bill after single sign-on is added, how users leave, and who runs the server.
Vendors can pay for visibility on this page. It never changes what an entry
says about a product, including the criticism, and we earn nothing when you click through to a
vendor. How that works.
In short
What identity and access management software does
Identity and access management software stores user identities and controls how people and applications authenticate, through single sign-on, multi-factor authentication, directories and permissions, for staff systems or customer-facing products.
In this order: setup effort, what it really costs, how your data comes back out, whether
you can leave, and who each identity and access management tool is built for. One rule sits on top of those tests:
Places 1 to 3 go to challengers, vendors outside the best-known brands in a category, wherever the category has them; the established names follow from place 4 in their ranked order. Why those five, and why there is no
score out of ten, is on the how we work page.
Free edition with an Azure subscription; Premium per user per month, published
Yes
Organisations already running Microsoft 365 and Azure that want one directory
Teams wanting login for customers without any Azure subscription
Country is where the vendor is headquartered or contracts from, which is a
different question from where your data is hosted. Where the two tell different stories, the
entry says so.
Apache-licensed single sign-on server run by you, no vendor invoice
Ranked #1 of 12 in Best Identity and Access Management Software in 2026.
Open sourceSelf-hostablePricing on requestElsewhere
Keycloak asks for hours, not money. Single sign-out, identity brokering to other OpenID Connect or SAML 2.0 providers, and LDAP or Active Directory federation are all in the admin console, and the admin guide also covers organisations and themes.
The first ninety days are your own engineering time, and every upgrade after that is yours too. Plan a rehearsal restore before real users arrive.
What stands out
Apache 2.0
CNCF incubation
Realm export
Where it costs you
Installation, upgrades and security patching are work for your own team
Realm export is documented as unsuitable for backup and omits user events and persisted sessions
Right for
Technical teams that want to own their login server outright and can staff it
Wrong for
Teams without an engineer to patch and monitor a server
Not stated by the vendorNo vendor price list; open source, self-hosted at your own cost
Self-hosted identity provider with a per-user enterprise tier
Ranked #2 of 12 in Best Identity and Access Management Software in 2026.
Open sourceSelf-hostablePublished pricingNorth America
The vendor ships container installs and an AWS CloudFormation template, and nothing hosted, so the first ninety days are container, PostgreSQL and backup work. Pricing counts internal users at one rate and external customers or partners at a much lower one, with service accounts not charged.
Privileged access management, Microsoft Entra and Google Workspace integrations and compliance-grade audit logging are enterprise-only. Settle that licence cost before promising those features.
What stands out
MIT core
Enterprise tier
PostgreSQL
Where it costs you
The vendor offers no hosted version, so operations always sit with you
Support is sold only inside enterprise subscriptions, leaving the open tier on community channels
Right for
Small teams with an infrastructure engineer needing SSO, LDAP and RADIUS together
Wrong for
Buyers who want the vendor to host and operate it
United StatesOpen source core, self-hosted; enterprise tier per user per month, published
Zitadel is the one product here where the same software runs as a cloud service or on your own infrastructure, which makes leaving cheaper than with a hosted-only vendor.
The free cloud tier lets you choose a data region among the EU, US, Switzerland and Australia, and stores unlimited users; the cap is on daily active ones. Pro adds a custom domain and a 99.5 percent uptime guarantee. Larger volumes go through a custom Enterprise contract.
What stands out
Open source (AGPL-3.0)
Data residency
Cloud or self-hosted
Where it costs you
The cloud free tier is capped at 100 daily active users, too few for most consumer apps
AGPL-3.0 licensing deserves a legal read before you modify and run the code
Right for
Product teams that want a hosted start now and a self-hosted exit later
Wrong for
Organisations that cannot accept the AGPL on modified code
SwitzerlandCloud free tier capped by daily active users; Pro monthly, published; self-hosted option
Open source identity components with a metered hosted network
Ranked #4 of 12 in Best Identity and Access Management Software in 2026.
Free tierOpen sourcePublished pricingNorth America
Ory splits identity into separate components, which is why its meters are separate too: active users, machine-to-machine tokens and permission checks each carry a rate. The Developer tier supports two development environments but zero production ones, so a launch means buying Production at least.
Self-hosted use of the components is possible, and an Enterprise licence covers self-hosted production with support. Model all three meters against real traffic before signing.
What stands out
Apache 2.0 components
Usage-based
Enterprise licence
Where it costs you
B2B authentication is not part of the Production plan
An uptime SLA is offered only on the Enterprise plan, which is priced on request
Right for
Engineering teams wanting open components now and a managed option when load grows
Wrong for
Teams that want one flat invoice instead of three usage meters
United StatesFree developer tier; Production and Growth yearly with usage rates, published
Downloadable auth server with a free Community edition or hosted tiers
Ranked #5 of 12 in Best Identity and Access Management Software in 2026.
Self-hostablePublished pricingNorth America
FusionAuth documents a local Docker Compose install, then leaves you to choose between running it yourself on the Community edition and paying for hosting.
The decision point is features: advanced MFA, theming and breached-password detection begin at Starter, and threat detection and a dedicated Slack channel belong to Enterprise. Example apps and libraries are Apache 2 licensed, though the server core is not. Price a year of the hosted tier you would actually need, not the cheapest.
What stands out
Closed source
Community edition
Hosted tiers
Where it costs you
Email support starts only at the Essentials tier
The core is closed source, and the licence FAQ forbids decompiling it
Right for
Developers wanting a downloadable auth server with a hosted option beside it
Wrong for
Buyers who need to fork or audit the server source
United StatesSelf-hosted Community edition free; hosted tiers from a published monthly base
Hosted sign-in components priced by returning users, built for app developers
Ranked #6 of 12 in Best Identity and Access Management Software in 2026.
Free tierPublished pricingNorth America
Clerk's meter rewards apps with many one-time visitors, because a user who never returns is not counted. Prices are per app, and dashboard seats are limited to three on Hobby.
B2B organisations are included on every plan with up to 20 members each, while unlimited members and verified domains are an add-on. Moving away is documented: a dashboard export and an open-source migration tool handle the user data, but development data cannot move to production.
What stands out
Prebuilt UI
Retained-user pricing
Dashboard export
Where it costs you
Single sign-on connections beyond the first are billed per connection on Pro
The Hobby plan fixes the session lifetime at seven days
Right for
Web app teams that want finished login screens and few engineering hours
Wrong for
Organisations needing a directory for staff rather than app users
United StatesFree plan up to a retained-user cap; Pro and Business monthly, published
Enterprise SSO billed per customer connection, user login free to one million
Ranked #7 of 12 in Best Identity and Access Management Software in 2026.
Published pricingNorth America
WorkOS charges where your revenue appears. An enterprise buyer asks for SSO, you add one connection, and that connection is billed whether the customer has ten users or ten thousand.
The first fifteen connections share one per-connection rate, and the rate drops in steps up to 100. Audit log streaming to a SIEM and event retention are separate monthly items. Pass the connection charge into your own enterprise price list from day one.
What stands out
Per-connection
B2B SSO
Hosted login UI
Where it costs you
Every enterprise customer that wants SSO is one more monthly connection charge
A custom domain for the login page is a separate monthly line
Right for
B2B software vendors whose buyers demand SAML and directory sync
Wrong for
Companies looking for a directory to manage their own staff
United StatesUser management free up to a user cap; SSO and Directory Sync per connection, published
Cloud directory and SSO billed per user, bundled with device management
Ranked #8 of 12 in Best Identity and Access Management Software in 2026.
Published pricingNorth America
JumpCloud treats identity and device management as one purchase, so the first ninety days are about enrolling devices as much as users. The trial lasts 30 days with premium support included, and checkout is self-service by card or ACH.
Invoicing only appears above a monthly spend. The price grows with every added product: passwordless, LDAP, RADIUS and conditional access are each separate per-user lines. Add up the lines you need before comparing with a bundle.
What stands out
Directory plus devices
Single products
30-day trial
Where it costs you
Suspended users are billed in the same way as active ones
Listed prices exclude VAT, which matters to organisations that cannot reclaim it
Right for
IT teams that manage laptops, logins and Wi-Fi from one console
Wrong for
Software vendors wanting login for their own customers
United StatesPer user per month, published for single products; packages quoted; 30-day trial
Workforce and customer identity packages sold on annual contracts
Ranked #9 of 12 in Best Identity and Access Management Software in 2026.
Published pricingNorth America
Ping's page is built for enterprise procurement: a 30-day trial exists for both workforce and customer products, but production starts from an annual commitment. The no-code orchestration engine is part of Essential, so flows are designed in a drag-and-drop editor rather than in code.
Passwordless customer authentication is priced by contact only. Expect a sales process, a user minimum and a yearly renewal, and budget implementation time before the first login goes live.
What stands out
Annual contract
User minimum
Orchestration
Where it costs you
Workforce pricing assumes an annual contract of at least 5,000 users
Adaptive MFA and API access management need the higher customer package
Right for
Large organisations that want one vendor for staff and customer login
Wrong for
Teams under a few thousand users or without a procurement cycle
United StatesWorkforce per user per month with a user minimum, published; customer identity from a yearly floor; 30-day trial
Workforce identity suites per user, with a yearly contract minimum
Ranked #10 of 12 in Best Identity and Access Management Software in 2026.
Published pricingNorth America
Okta's suite structure means the entry price is for the entry suite only. Starter gives single sign-on, MFA, Universal Directory and five workflows; Essentials raises the per-user rate and adds adaptive MFA, privileged access, lifecycle management and access governance.
Device Access and threat protection move to Professional, which has no published price. The Integrator Free Plan for customer identity covers only 10 active users and non-production use. Build the quote from the features you need.
What stands out
Annual billing
Suite tiers
Integration network
Where it costs you
Adaptive MFA and lifecycle management require the higher Essentials suite
Workforce identity carries an annual contract minimum
Right for
Mid-sized companies buying staff single sign-on with a large app catalogue
Wrong for
Small teams below the contract minimum or wanting monthly billing
United StatesPer user per month, published for entry suites; higher suites quoted; billed annually; trial
Customer-login service owned by Okta, metered by monthly active users
Ranked #11 of 12 in Best Identity and Access Management Software in 2026.
Free tierPublished pricingNorth America
Auth0 is easy to start and costly to stretch. The free plan includes passwordless login, passkeys, unlimited social connections and five organisations. Professional adds custom database connections and Cross App SSO, and the machine-to-machine token allowance is small until the add-on is bought.
Profile data exports to JSON or CSV from the dashboard or the Management API, which is a real exit path. Price your user count at paid rates before launch.
What stands out
Owned by Okta
Monthly active users
Hash export by request
Where it costs you
Password hashes and MFA secrets are exported only through a support case, PGP encrypted
Custom database connections are not included below the Professional plan
Right for
Developer teams wanting hosted customer login with many ready connections
Wrong for
Consumer apps with large user bases and thin margins
United StatesFree plan up to a monthly-active-user cap; paid tiers published for B2C and B2B
Microsoft directory and sign-in service, tied to Azure subscriptions
Ranked #12 of 12 in Best Identity and Access Management Software in 2026.
Free tierPublished pricingNorth America
Entra ID is a licence-count decision. The Free edition stays free of charge but forces an Azure subscription; P1 and P2 are priced per user per month when paid yearly, and Entra Suite adds network access and governance on top of Microsoft 365.
Customer identity is a separate product, Entra External ID, billed pay-as-you-go. Lock-in grows with each add-on, so decide early whether Microsoft is your only identity vendor or merely your first.
What stands out
Azure subscription
Conditional Access
Log retention by edition
Where it costs you
Audit and sign-in logs are kept only seven days on the Free edition
Risk-based Conditional Access needs the higher P2 edition
Right for
Organisations already running Microsoft 365 and Azure that want one directory
Wrong for
Teams wanting login for customers without any Azure subscription
United StatesFree edition with an Azure subscription; Premium per user per month, published
How to choose identity and access management software
Identity and access management software stores user identities and controls how people and applications authenticate, through single sign-on, multi-factor authentication, directories and permissions, for staff systems or customer-facing products. The differences that matter are rarely in the feature list, so this is
the order we would work through them.
01
Decide whether you need a published price
11 of the 12 tools here publish what they cost; the other 1 quote per organisation. The ones you can compare without a sales call: authentik, Zitadel, Ory, FusionAuth, Clerk, WorkOS, JumpCloud, Ping Identity, Okta, Auth0, Microsoft Entra ID.
02
Decide how much the jurisdiction matters
These 12 vendors are established in 3 countries across 3 regions (North America 10, Europe 1, Elsewhere 1). That decides whose disclosure law applies to what the vendor holds, wherever the servers are.
03
Consider whether you want the source
4 of these are open source: Keycloak, authentik, Zitadel, Ory. Hosting one yourself trades a subscription for maintenance.
Self-run or vendor-run: Keycloak, authentik and Zitadel against hosted services
The first decision in identity is who keeps the server alive. Keycloak is Apache 2.0 software under the Cloud Native Computing Foundation, and authentik offers no hosted version at all, so both mean your own PostgreSQL, backups and upgrades. Zitadel runs either as a cloud service or on your own infrastructure under AGPL-3.0, and FusionAuth lets you run its Community edition yourself or pay for hosting.
Hosted-only products such as Clerk and WorkOS remove the operating work but tie your login to their price list. A self-run server costs engineering hours every month, and an outage of the login server stops every application that depends on it.
Name the person who will patch and restore the identity server.
Ask the vendor which versions get security fixes and for how long.
Rehearse a restore from backup before the first real user signs in.
The meter decides the bill: users, active users, retained users or connections
Identity vendors count different things, so list prices cannot be compared directly. Okta and JumpCloud charge per user per month. Auth0 counts monthly active users, Zitadel counts daily active users, and Ory meters active daily users, machine tokens and permission checks separately.
Clerk counts a user as retained only after they return a day later, which suits apps with many one-time visitors. WorkOS counts customer connections instead of people. Ping Identity's workforce price assumes at least 5,000 users on an annual contract. Run your real user numbers through each meter, including the month your traffic peaks, before comparing totals.
Estimate monthly, daily and retained users for the busiest month.
Ask whether service accounts and machine tokens are counted.
Check for an annual contract minimum or a minimum user count.
Single sign-on for customers is where the invoice grows
A software vendor starts with email and password and then meets a buyer who demands SAML single sign-on. Clerk includes one SSO connection on Pro and bills each extra connection monthly. WorkOS charges per connection at a flat rate that steps down with volume, regardless of how many people the customer has.
Auth0 includes one enterprise connection on its free plan and moves self-service SSO and SCIM to separate tiers. Ory places B2B authentication in the Growth plan rather than Production. The question for each vendor is who pays when ten customers ask at once, you or them through a price list that passes the cost on.
Count how many enterprise customers will request SSO in year one.
Ask whether SCIM provisioning is priced separately from SSO.
Decide whether you will pass connection costs into your own price.
Getting users out: exports, hashes and the first renewal
Identity data is the hardest to move, because users will not reset every password at once. Clerk documents a dashboard export that includes hashed passwords, and a migration tool for importing. Auth0 exports profiles as JSON or CSV, but password hashes and MFA secrets leave only through a PGP-encrypted support case.
Keycloak exports realms to JSON, yet its guide warns the export is not a backup mechanism and omits sessions and events. Microsoft Entra ID keeps sign-in logs for seven days on the Free edition and 30 days on Premium, so evidence for audits needs its own storage. Test the exit before you commit users.
Request a sample export and check that password hashes are included.
Confirm how long audit and sign-in logs remain available.
Ask what the vendor does with your data after the contract ends.
What goes wrong most often when buying identity and access management software
Comparing a per-user price with a per-active-user price without converting both to your real monthly numbers.
Choosing a free hosted plan for launch and discovering that the paid tier starts with a few hundred users included.
Treating SSO as a checkbox, then paying a monthly connection charge for every enterprise customer who asks.
Running a self-hosted identity server without a tested restore, so a failed upgrade locks everyone out.
07
Frequently asked questions
8 answers
What is the best identity and access management software in 2026?
Keycloak leads our ranking of 12. Keycloak is an Apache 2.0 project hosted by the Cloud Native Computing Foundation, so there is no licence fee that can rise and no partner you must buy through.
The cost moves to your own staff, who install, upgrade and secure the server. Realm export to JSON exists, but its guide says it is not a backup mechanism and leaves out events and persisted sessions.
Which identity and access management tools publish their pricing?
11 of the 12, with the pricing model each one publishes:
authentik: Open source core, self-hosted; enterprise tier per user per month, published.
Zitadel: Cloud free tier capped by daily active users; Pro monthly, published; self-hosted option.
Ory: Free developer tier; Production and Growth yearly with usage rates, published.
FusionAuth: Self-hosted Community edition free; hosted tiers from a published monthly base.
Clerk: Free plan up to a retained-user cap; Pro and Business monthly, published.
WorkOS: User management free up to a user cap; SSO and Directory Sync per connection, published.
JumpCloud: Per user per month, published for single products; packages quoted; 30-day trial.
Ping Identity: Workforce per user per month with a user minimum, published; customer identity from a yearly floor; 30-day trial.
Okta: Per user per month, published for entry suites; higher suites quoted; billed annually; trial.
Auth0: Free plan up to a monthly-active-user cap; paid tiers published for B2C and B2B.
Microsoft Entra ID: Free edition with an Azure subscription; Premium per user per month, published.
The other 1 quote per organisation.
Is there a free identity and access management tool?
Zitadel, Ory, Clerk, Auth0, Microsoft Entra ID offer a free tier or a free self-hosted edition.
Where are these identity and access management software vendors established?
In 3 countries across 3 regions: North America 10, Europe 1, Elsewhere 1.
Keycloak: Not stated by the vendor.
authentik: United States.
Zitadel: Switzerland.
Ory: United States.
FusionAuth: United States.
Clerk: United States.
WorkOS: United States.
JumpCloud: United States.
Ping Identity: United States.
Okta: United States.
Auth0: United States.
Microsoft Entra ID: United States.
Which identity and access management tools are open source?
Keycloak, authentik, Zitadel, Ory.
Which identity and access management tools can you host yourself?
Keycloak, authentik, Zitadel, FusionAuth. The other 8 are hosted by the vendor only.
What should you use instead of Keycloak?
authentik and Zitadel are the next two on this page. authentik is for small teams with an infrastructure engineer needing SSO, LDAP and RADIUS together; Zitadel is for Product teams that want a hosted start now and a self-hosted exit later.
Who should not buy Keycloak?
Teams without an engineer to patch and monitor a server. Installation, upgrades and security patching are work for your own team.
If your identity and access management software product belongs among these 12, tell us what it does and who it is for. Inclusion is an editorial call; what a listing is and is not is set out under software advice.
