Having recently completed a vendor evaluation cycle for a client's IAM stack, I'm struck by the pervasive market consolidation that seems to funnel teams towards the "big three" (Okta, Microsoft, OneLogin) even at a sub-100 user scale. While these platforms are robust, their total cost of ownership—encompassing licensing, administrative overhead, and the complexity tax of unused features—often doesn't align with the actual needs of a small, agile revenue operations or sales team.
My specific inquiry is for experiences with alternatives that satisfy these core requirements for a small team (25-75 users) where the primary use cases are:
* Web application SSO (SAML/OIDC) for a suite of 15-20 sales and marketing tools (e.g., CRM, enrichment, engagement platforms).
* Basic directory services for user provisioning, primarily from our HRIS (BambooHR).
* A pragmatic, enforceable MFA policy, with a strong preference for phishing-resistant methods (WebAuthn/FIDO2).
* A clear, auditable trail for access events.
* **Crucially:** A per-user pricing model that remains predictable and doesn't necessitate an enterprise agreement.
Platforms I've ruled out for this thread are Azure AD (due to its deep entanglement with the M365 ecosystem, which we are not fully committed to) and OneLogin (based on past client experiences with support responsiveness and API limitations for custom provisioning workflows).
I am currently examining:
* **JumpCloud:** Appears to position itself as a "full-stack" directory platform. Concerns are around whether its SSO and MFA capabilities are as polished and administrator-friendly as dedicated IAM tools.
* **Rippling:** While its strength is unifying HR and IT, I'm skeptical about the maturity and flexibility of its SSO and federation components versus its core device management.
* **Smaller, niche providers** like Zoho Directory or SecureAuth: The risk here is vendor longevity and the breadth of pre-integrated applications.
Key evaluation criteria beyond core features are:
* The administrative burden on a team with no dedicated IAM staff.
* The quality and clarity of logging and reporting for compliance (SOC2, etc.).
* The ease of implementing just-in-time provisioning and de-provisioning workflows, particularly for the sales tech stack.
I would appreciate insights from anyone who has implemented or migrated away from Okta for a similar small-team, business-application-focused scenario. Concrete experiences regarding hidden costs, support interactions, and limitations in SCIM implementation or conditional access policies would be particularly valuable.
I've been in that exact spot. The "big three" really do dominate the conversation, even when they're overkill.
For a team your size, you might want to look at **Pomerium** or **Zitadel**. Pomerium's angle is interesting - it's an identity-aware proxy, so it handles SSO and access policy in one go, which simplifies the architecture. It's open-source, and their SaaS tier's pricing is pretty straightforward per user. It nails the audit trail and supports WebAuthn. Zitadel is newer but built for this kind of use case, with a clean API for provisioning.
A caveat though: the "suite of 15-20 sales and marketing tools" could be a sticking point. Their pre-built connectors (like Okta's Integration Network) are a big time-saver. With these alternatives, be prepared for some manual SAML/OIDC config in each app. It's not *hard*, but it's an hour here and there that adds up.
Pipeline Pilot