# IAM Compared > Editorial rankings of identity tools by how far they reach into the applications and accounts an identity provider and an IGA platform do not cover: unmanaged apps, local accounts, service accounts and AI agents. Vendor facts read in September 2026, updated 2026-10-13. ## Rankings and method - [IAM rankings](https://iamcompared.com/iam-rankings): The full ranking, per-criterion scores, reach rosettes, the Outside-Estate Register and tools reviewed but not scored. - [Assessment method](https://iamcompared.com/assessment-method): The eight criteria, weights, scoring math, evidence rules and limitations. - [Set side by side](https://iamcompared.com/set-side-by-side): Two to five tools compared criterion by criterion. - [Coverage gap calculator](https://iamcompared.com/coverage-gap-calculator): Count applications outside SSO and provisioning, and re-weight the ranking. ## Tool profiles - [Orchid Security](https://iamcompared.com/identity-tool/orchid-security): Orchid Security scored on discovery of unmanaged apps, accounts inside apps, orchestration, execution, machine accounts, evidence and pricing. Where it leads and trails. - [Veza](https://iamcompared.com/identity-tool/veza): Veza scored on reach beyond the IdP and IGA: local, machine and service accounts, OAA for custom systems, lifecycle actions, and what is not documented. - [Saviynt](https://iamcompared.com/identity-tool/saviynt): Saviynt scored on reach beyond the IdP: disconnected and custom-built app onboarding, execution, evidence, and the discovery gap on its public pages. - [SailPoint Identity Security Cloud](https://iamcompared.com/identity-tool/sailpoint-identity-security-cloud): SailPoint Identity Security Cloud scored on reach beyond connected sources: lifecycle execution, Agentic Fabric, Application Management and discovery gaps. - [Microsoft Entra ID Governance](https://iamcompared.com/identity-tool/microsoft-entra-id-governance): Entra ID Governance scored on reach beyond the IdP: ECMA and on-prem connectors, the CSV path for unprovisioned apps, Agent ID and its published price. - [C1 (formerly ConductorOne)](https://iamcompared.com/identity-tool/c1): C1, formerly ConductorOne, scored on reach beyond the IdP: shadow app sign-up monitoring, Baton connectors, C1 Bridge for on-prem, and its pricing structure. - [Lumos](https://iamcompared.com/identity-tool/lumos): Lumos scored on reach beyond the IdP: shadow IT in Identity Analytics, revocation across local, custom and on-prem apps, MCP Governance and pricing. - [Apono](https://iamcompared.com/identity-tool/apono): Apono, now part of 1Password, scored on reach beyond the IdP: just-in-time access for people, machines and AI agents, what is not documented, and its AWS Marketplace price. ## Pairings - [Apono vs C1 (formerly ConductorOne)](https://iamcompared.com/apono-measured-against-c1): Apono and C1 compared on eight criteria. - [Apono vs Lumos](https://iamcompared.com/apono-measured-against-lumos): Apono and Lumos compared on eight criteria. - [Apono vs Microsoft Entra ID Governance](https://iamcompared.com/apono-measured-against-microsoft-entra-id-governance): Apono and Entra ID Governance compared on eight criteria. - [Apono vs Orchid Security](https://iamcompared.com/apono-measured-against-orchid-security): Apono and Orchid compared on eight criteria. - [Apono vs SailPoint Identity Security Cloud](https://iamcompared.com/apono-measured-against-sailpoint-identity-security-cloud): Apono and SailPoint compared on eight criteria. - [Apono vs Saviynt](https://iamcompared.com/apono-measured-against-saviynt): Apono and Saviynt compared on eight criteria. - [Apono vs Veza](https://iamcompared.com/apono-measured-against-veza): Apono and Veza compared on eight criteria. - [C1 (formerly ConductorOne) vs Lumos](https://iamcompared.com/c1-measured-against-lumos): C1 and Lumos compared on eight criteria. - [C1 (formerly ConductorOne) vs Microsoft Entra ID Governance](https://iamcompared.com/c1-measured-against-microsoft-entra-id-governance): C1 and Entra ID Governance compared on eight criteria. - [C1 (formerly ConductorOne) vs Orchid Security](https://iamcompared.com/c1-measured-against-orchid-security): C1 and Orchid compared on eight criteria. - [C1 (formerly ConductorOne) vs SailPoint Identity Security Cloud](https://iamcompared.com/c1-measured-against-sailpoint-identity-security-cloud): C1 and SailPoint compared on eight criteria. - [C1 (formerly ConductorOne) vs Saviynt](https://iamcompared.com/c1-measured-against-saviynt): C1 and Saviynt compared on eight criteria. - [C1 (formerly ConductorOne) vs Veza](https://iamcompared.com/c1-measured-against-veza): C1 and Veza compared on eight criteria. - [Lumos vs Microsoft Entra ID Governance](https://iamcompared.com/lumos-measured-against-microsoft-entra-id-governance): Lumos and Entra ID Governance compared on eight criteria. - [Lumos vs Orchid Security](https://iamcompared.com/lumos-measured-against-orchid-security): Lumos and Orchid compared on eight criteria. - [Lumos vs SailPoint Identity Security Cloud](https://iamcompared.com/lumos-measured-against-sailpoint-identity-security-cloud): Lumos and SailPoint compared on eight criteria. - [Lumos vs Saviynt](https://iamcompared.com/lumos-measured-against-saviynt): Lumos and Saviynt compared on eight criteria. - [Lumos vs Veza](https://iamcompared.com/lumos-measured-against-veza): Lumos and Veza compared on eight criteria. - [Microsoft Entra ID Governance vs Orchid Security](https://iamcompared.com/microsoft-entra-id-governance-measured-against-orchid-security): Entra ID Governance and Orchid compared on eight criteria. - [Microsoft Entra ID Governance vs SailPoint Identity Security Cloud](https://iamcompared.com/microsoft-entra-id-governance-measured-against-sailpoint-identity-security-cloud): Entra ID Governance and SailPoint compared on eight criteria. - [Microsoft Entra ID Governance vs Saviynt](https://iamcompared.com/microsoft-entra-id-governance-measured-against-saviynt): Entra ID Governance and Saviynt compared on eight criteria. - [Microsoft Entra ID Governance vs Veza](https://iamcompared.com/microsoft-entra-id-governance-measured-against-veza): Entra ID Governance and Veza compared on eight criteria. - [Orchid Security vs SailPoint Identity Security Cloud](https://iamcompared.com/orchid-security-measured-against-sailpoint-identity-security-cloud): Orchid and SailPoint compared on eight criteria. - [Orchid Security vs Saviynt](https://iamcompared.com/orchid-security-measured-against-saviynt): Orchid and Saviynt compared on eight criteria. - [Orchid Security vs Veza](https://iamcompared.com/orchid-security-measured-against-veza): Orchid and Veza compared on eight criteria. - [SailPoint Identity Security Cloud vs Saviynt](https://iamcompared.com/sailpoint-identity-security-cloud-measured-against-saviynt): SailPoint and Saviynt compared on eight criteria. - [SailPoint Identity Security Cloud vs Veza](https://iamcompared.com/sailpoint-identity-security-cloud-measured-against-veza): SailPoint and Veza compared on eight criteria. - [Saviynt vs Veza](https://iamcompared.com/saviynt-measured-against-veza): Saviynt and Veza compared on eight criteria. ## Moving off a tool - [Orchid Security alternatives](https://iamcompared.com/moving-off-orchid-security): Alternatives to Orchid, with the criteria where each scores higher or lower. - [Veza alternatives](https://iamcompared.com/moving-off-veza): Alternatives to Veza, with the criteria where each scores higher or lower. - [Saviynt alternatives](https://iamcompared.com/moving-off-saviynt): Alternatives to Saviynt, with the criteria where each scores higher or lower. - [SailPoint Identity Security Cloud alternatives](https://iamcompared.com/moving-off-sailpoint-identity-security-cloud): Alternatives to SailPoint, with the criteria where each scores higher or lower. - [Microsoft Entra ID Governance alternatives](https://iamcompared.com/moving-off-microsoft-entra-id-governance): Alternatives to Entra ID Governance, with the criteria where each scores higher or lower. - [C1 (formerly ConductorOne) alternatives](https://iamcompared.com/moving-off-c1): Alternatives to C1, with the criteria where each scores higher or lower. - [Lumos alternatives](https://iamcompared.com/moving-off-lumos): Alternatives to Lumos, with the criteria where each scores higher or lower. - [Apono alternatives](https://iamcompared.com/moving-off-apono): Alternatives to Apono, with the criteria where each scores higher or lower. ## Identity classroom - [Identity classroom](https://iamcompared.com/identity-classroom): Ten lessons in three tracks on the unmanaged estate. - [The Unmanaged Application Estate: What Your IdP Misses](https://iamcompared.com/identity-classroom/the-unmanaged-application-estate): Three kinds of unmanaged app, where they come from and why they matter. - [Local Accounts and Hardcoded Credentials Inside Applications](https://iamcompared.com/identity-classroom/local-accounts-inside-applications): The accounts an application creates for itself, and why offboarding misses them. - [Shadow Authentication Paths: Sign-Ins That Bypass SSO](https://iamcompared.com/identity-classroom/shadow-authentication-paths): Why an app on single sign-on can still be entered another way. - [Service Accounts and Non-Human Accounts Inside Applications](https://iamcompared.com/identity-classroom/non-human-accounts-inside-applications): Machine accounts that applications create for themselves. - [IdP, IGA, Access Graph and Discovery: Which Layer Does What](https://iamcompared.com/identity-classroom/identity-stack-layers): Who signs people in, who governs, who maps and who finds. - [Identity Orchestration: What the Term Means for Each Vendor](https://iamcompared.com/identity-classroom/identity-orchestration-defined): One term, three meanings, and the questions that separate them. - [Connector Methods for Apps Without APIs or SCIM](https://iamcompared.com/identity-classroom/connector-methods-for-apps-without-apis): Seven ways to get account data in and out of a hard application. - [Assigning an Owner to Every Application Account](https://iamcompared.com/identity-classroom/application-account-ownership): Why unowned accounts are the ones that stay open. - [Application Access in SOX IT General Controls](https://iamcompared.com/identity-classroom/sox-itgc-application-access): Why the user list is the evidence auditors test first. - [Measuring Identity Coverage: Numbers for a Quarterly Report](https://iamcompared.com/identity-classroom/measuring-identity-coverage): Five numbers that show whether the gap is closing. ## Reference - [Identity vocabulary](https://iamcompared.com/identity-vocabulary): Plain definitions of identity terms used on the site. - [Reader questions](https://iamcompared.com/reader-questions): Answers to common questions about the rankings, the tools and the unmanaged estate. ## The Dossier - [The Dossier](https://iamcompared.com/dossier): Dated analysis from The Credential Desk. - [Orchid Security and SailPoint: Discovery Meets Governance](https://iamcompared.com/dossier/orchid-sailpoint-discovery-meets-governance): One finds the applications, the other governs them. What buyers should check. - [Identity Consolidation in 2026: Who Bought Whom](https://iamcompared.com/dossier/identity-consolidation-2026): Six ownership and name changes in identity security this year, and the questions they raise. - [Microsoft Entra's Path for Apps Without Provisioning, Step by Step](https://iamcompared.com/dossier/entra-path-for-apps-without-provisioning): The CSV route Microsoft documents, and what it asks of your team. - [Open Connectors Compared: C1 Baton, Veza OAA and Entra ECMA](https://iamcompared.com/dossier/open-connectors-baton-oaa-ecma): Build-your-own routes into hard applications, and who maintains them. - [Identity Coverage After an Acquisition: The First 90 Days](https://iamcompared.com/dossier/identity-coverage-in-mergers-and-acquisitions): What arrives with an acquired company, and what to find first. - [Zero Trust Stops at the Applications It Cannot See](https://iamcompared.com/dossier/zero-trust-and-the-unmanaged-app): A policy engine decides only on the requests that reach it. - [Why Discovery Tools and IGA Platforms Score Differently Here](https://iamcompared.com/dossier/why-discovery-tools-and-iga-score-differently): The same scores under three other sets of weights. - [Four Ways Tools Find Shadow SaaS, and What Each Misses](https://iamcompared.com/dossier/finding-shadow-saas-four-routes): Sign-ups, analytics, the browser and in-app discovery compared. ## Site - [Contact](https://iamcompared.com/contact): Questions, corrections to vendor information, privacy requests and copyright notices. - [Privacy policy](https://iamcompared.com/privacy-policy): What data the site handles. - [Cookie policy](https://iamcompared.com/cookie-policy): The site sets no cookies. - [Terms of use](https://iamcompared.com/terms-of-use): Terms for using the site. - [DMCA](https://iamcompared.com/dmca): Copyright notices.