Hi everyone! New here and trying to learn. My team is looking at identity security tools, specifically for managing access to our SaaS apps and cloud infra.
We've seen demos for Clutch Security, but I'm curious what other good options are out there. We're a mid-size company, mostly using Azure AD and AWS. I've heard names like Okta, CyberArk, and SailPoint thrown around, but they seem huge and complex.
For those who've evaluated this space, what are the best alternatives for a team that's not giant? Main needs are SSO, maybe some JIT access for AWS, and clear reporting. What should I be looking at? 😅
Hi there! I'm Helen, and I manage our community here, but my day job is as a security lead for a mid-market tech company with a similar stack - Azure AD as our IDP and a growing AWS footprint. We've been in production with an identity security tool for about two years now.
When we were evaluating, a few key criteria stood out that might help you:
1. **Mid-market fit and pricing:** Clutch, Okta Workforce Identity, and competitors like OneLogin or JumpCloud target different segments. Okta's full suite can easily hit $12-18/user/month and feels built for large enterprises. We found options like JumpCloud or even Azure AD Premium P2 (if you're already in the ecosystem) were more in the $6-11/user/month range, which fit our budget better. Watch for hidden identity lifecycle or advanced reporting modules that add 20-30% to the base cost.
2. **Cloud infra JIT access complexity:** For true just-in-time AWS access, you often need an extra piece. Tools like SailPoint or CyberArk are overkill for this. A simpler combo might be your core SaaS SSO tool plus something like Entra Permissions Management (formerly CloudKnox) for cloud-specific JIT. Setting that up added about 6-8 weeks of integration time for us.
3. **Azure AD integration depth:** If Azure AD is your core, the native tools (Entra ID Governance, Access Reviews) are surprisingly capable for reporting and access certification. The limitation is they're Microsoft-first; reporting for non-Microsoft SaaS apps is less polished.
4. **Support and vendor agility:** At our size, we valued responsive support. We had better initial implementation support with mid-market focused vendors versus the large players, where we were just a ticket number. Response times for Sev-2 issues were under 2 hours with our current vendor versus 8+ hours during trials with the giants.
My pick for your stated needs (SSO, some AWS JIT, clear reporting) would be to look hard at **Azure AD Premium P2 combined with a dedicated cloud infrastructure entitlement management (CIEM) tool.** It covers your primary SaaS SSO and reporting natively at a predictable cost, and you can add JIT for AWS specifically. If that feels too fragmented, tell us more about your team size and whether you need to govern non-SaaS app access (like legacy on-prem systems) - that would change the recommendation.
Keep it constructive.
Your point about JIT complexity is correct. The overhead for integrating a separate cloud JIT tool is often under-scoped. We used Azure AD P2 with Entra Permissions Management for AWS and GCP.
The timeline you gave, 6-8 weeks for integration, is optimistic if you're aiming for full audit logging and automated role revocation. Our implementation took nearly 12 weeks because we had to build custom runbooks for the cleanup workflows that Entra doesn't cover.
Have you found a way to automate those cleanup steps, or is it still a manual process in your environment?
Five nines? Prove it.
That timeline sounds about right for custom workflows. Did you have to dedicate a lot of internal engineering time to build those runbooks, or did your vendor provide good enough APIs to make it manageable?
We're looking at Entra too, and hearing that the default cleanup isn't fully automated is a bit of a red flag. It makes me wonder if other tools like Saviynt or even a lighter option like SailPoint IdentityNow handle those offboarding and permission revocation steps more cleanly out of the box.