PAIRING · MEASURED SIDE BY SIDE
Microsoft Entra ID Governance vs Veza: reach beyond the IdP and IGA
The short answer
On our default weights Veza scores higher overall, 6.37 against 6.15 out of 10. Entra ID Governance scores higher on Executes changes itself, Machine, service and agent accounts and Pricing transparency; Veza scores higher on Accounts inside the app, Reach into apps without APIs or SCIM and Orchestrates through the existing stack. They tie on Unmanaged app discovery and Audit evidence. They sit in different layers (Governance add-on to an identity provider and Access graph and governance), so many teams run both.
By The Credential Desk · IAM Compared · Published 2026-10-08
Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.
How do they score on each criterion?
| Criterion | Weight | Entra ID Governance | Veza | Higher |
|---|---|---|---|---|
| Unmanaged app discovery | 18% | 3.5 Account discovery covers users inside connected apps; discovery of apps outside Entra is not described in the governance docs reviewed. | 3.5 Finds accounts outside identity platforms within the systems it integrates with; discovery of applications nobody connected is not described. | Tie |
| Accounts inside the app | 16% | 5.5 Account discovery shows app users that match no Entra ID user; apps without provisioning rely on a CSV export. | 8.0 Reveals local, machine and service accounts and dormant accounts, with effective permissions from the Access Graph. | Veza |
| Reach into apps without APIs or SCIM | 14% | 6.5 SCIM, LDAP, SQL, REST, SOAP, PowerShell and ECMA connectors, including on-prem apps; a manual CSV path for the rest. | 7.0 The Open Authorization API imports authorization metadata from any system, including custom or on-premise apps, through a JSON schema and REST API; someone has to build the feed. | Veza |
| Orchestrates through the existing stack | 14% | 5.0 Requires Entra ID P1 or P2 and fits best when Entra is the identity provider; manual removals can be routed to ServiceNow tickets. | 7.5 Adds visibility beside existing IdP and HR sources and writes changes back through OAA Write; now part of ServiceNow. | Veza |
| Executes changes itself | 12% | 8.0 Lifecycle workflows before start, at status change and at departure, plus HR-driven provisioning. | 7.2 Birthright access, role-change and offboarding automation, including local accounts, with Dry Run and Safety Limits. | Entra ID Governance |
| Machine, service and agent accounts | 10% | 8.0 Entra Agent ID is generally available, and workload identities are priced and governed in Entra. | 7.5 Reveals machine and service accounts; the acquisition post frames the combined offer as an agent identity control plane. | Entra ID Governance |
| Audit evidence | 10% | 7.0 Review decisions and assignments are recorded in Entra; no framework-mapped evidence pack described. | 7.0 Audit logging for lifecycle actions; a framework-mapped evidence export is not described on the pages reviewed. | Tie |
| Pricing transparency | 6% | 9.5 $7.00 per user per month, paid yearly, published, on top of Entra ID P1 or P2. | 2.0 No public pricing. | Entra ID Governance |
| Total | 100% | 6.15 | 6.37 | Veza |
What shape is each tool's reach?
- DISC
- Unmanaged app discovery
- 3.5
- INAPP
- Accounts inside the app
- 5.5
- NOAPI
- Reach into apps without APIs or SCIM
- 6.5
- ORCH
- Orchestrates through the existing stack
- 5.0
- EXEC
- Executes changes itself
- 8.0
- NHI
- Machine, service and agent accounts
- 8.0
- EVID
- Audit evidence
- 7.0
- PRICE
- Pricing transparency
- 9.5
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
- DISC
- Unmanaged app discovery
- 3.5
- INAPP
- Accounts inside the app
- 8.0
- NOAPI
- Reach into apps without APIs or SCIM
- 7.0
- ORCH
- Orchestrates through the existing stack
- 7.5
- EXEC
- Executes changes itself
- 7.2
- NHI
- Machine, service and agent accounts
- 7.5
- EVID
- Audit evidence
- 7.0
- PRICE
- Pricing transparency
- 2.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
Which parts of the estate does each document?
| Zone | Entra ID Governance | Veza |
|---|---|---|
| Unsanctioned SaaS | Not documented Discovery of apps outside Entra not described in the governance docs reviewed | Not documented Discovery of unconnected SaaS not described |
| On-prem and legacy apps | Documented ECMA connector host, LDAP and SQL for on-prem apps | Documented The Open Authorization API imports authorization metadata from custom or on-premise apps |
| Custom-built apps | Partial REST, SOAP and PowerShell connectors; CSV path otherwise | Documented Custom systems connect through OAA |
| Local accounts in apps | Partial Account discovery shows app users not matched to Entra users | Documented Reveals local accounts outside identity platforms |
| Service accounts and hardcoded credentials | Partial Workload identities priced and governed in Entra; hardcoded credentials in apps not described | Partial Reveals machine and service accounts; hardcoded credentials not described |
| AI agents | Documented Entra Agent ID generally available | Partial Acquisition post frames the combined offer as an agent identity control plane |
What do they cost?
Microsoft Entra ID Governance
Pricing
$7.00 per user per month, paid yearly. Requires Microsoft Entra ID P1 ($7.00) or P2 ($10.00). Microsoft Entra Suite $12.00 per user per month. Workload ID $3.00 per workload identity per month.
Source: Microsoft Entra pricing · Read 27 Sep 2026
Deployment
Microsoft cloud service, with an on-prem connector host for provisioning.
Which should you choose?
Choose Entra ID Governance if
- you need a published price before talking to sales
- you want the tool itself to provision and revoke access
Choose Veza if
- you need to see local, orphaned and dormant accounts inside each app
- you want to keep your current IdP, IGA and ticketing tools and feed them
Frequently asked questions
Which scores higher overall, Microsoft Entra ID Governance or Veza?
On our default weights Veza scores higher overall, 6.37 against 6.15 out of 10.
Where does Microsoft Entra ID Governance score higher than Veza?
Entra ID Governance scores higher on Executes changes itself (8.0 against 7.2), Machine, service and agent accounts (8.0 against 7.5) and Pricing transparency (9.5 against 2.0).
Can Microsoft Entra ID Governance and Veza be used together?
Often, yes. They sit in different layers (Governance add-on to an identity provider; Access graph and governance), and each one's pages describe working with existing identity tools.