Buyer's Guide: Identity-as-a-Service (IDaaS)

A buyer’s guide for Identity as a Service (IDaaS) is positioned as a structured starting point for vendor selection, helping organizations focus on the most important evaluation dimensions while still requiring deeper RFIs and proofs of concept later. It guides teams to clarify primary use cases, weight functional and non-functional criteria accordingly, collect vendor responses, ask targeted maturity and roadmap questions, shortlist, and confirm technical and organizational readiness.

IDaaS is defined as cloud-delivered traditional IAM capabilities, increasingly applicable across application delivery models (on-prem, SaaS, IaaS). Growth is driven by faster time-to-value than on-prem deployments, expanding SaaS adoption, adoption of global standards and external expertise, reduced internal cost/effort, and fewer internal IAM failures. The market is shaped by vendor origins—access management vendors, IGA vendors, and “born-in-cloud” entrants—which strongly influence capability depth, especially around governance.

Capabilities cluster into identity administration (lifecycle, repositories, connectors, self-service), access management (SSO, federation, authentication/authorization, standards support, emerging API security), and access governance (often least mature in IDaaS; integration with legacy systems and audit/reporting can be limiting). Adoption is inhibited by data residency concerns, reliance on provider security controls, and customization needs.

The guide highlights four dominant use cases—web access management, hybrid access management, workforce IAM, and consumer IAM (CIAM)—and provides a matrix to prioritize 15 functional criteria and 10 non-functional criteria by use case. It also lists technical prerequisites (architecture, internal security, availability, standards, mobility/cloud integrations), organizational prerequisites (responsibility shifts, SLAs, threat response, governance, value/ROI), and key vendor questions to uncover differentiators, update cadence, compliance posture, evolution, authentication roadmap, and customer references.

• The estimated global IDaaS market size at the end of 2017 was approximately $870 million.
• The estimated global IDaaS market CAGR was 22% in 2018.
• IDaaS is delivered as SaaS, hosted and managed by the IDaaS vendor.
• Providers offering hosted/managed IAM using other vendors’ software are not considered IDaaS vendors in this guide.
• Most IDaaS services are priced per managed identity or per active user per month.
• Some IDaaS functions, such as user authentication or fraud detection, can be priced per transaction.
• IDaaS capabilities are grouped into identity administration, access management, and access governance.
• Access governance capabilities are the least mature and largely absent from most IDaaS vendors’ portfolios.
• The guide identifies four primary IDaaS use cases: web access management, hybrid access management, workforce IAM, and consumer IAM.
• Okta acquired Stormpath and Ping Identity acquired UnboundID to strengthen CIAM features.

• “This document is not a complete guideline for selecting vendors but provides an excellent starting point to drive and streamline the decision-making process.”
• “IDaaS is a growing market segment of IAM characterized by cloud-based delivery of traditional IAM services.”
• “IDaaS market consolidates access management functions with few IGA and Access Governance capabilities thrown in – all delivered and managed as a service.”
• “API security and web access management gateways are fast becoming a differentiator for IDaaS vendors looking to offer competitive access management capabilities.”
• “Access governance represents the group of capabilities that are least mature and largely absent from the portfolio of most IDaaS vendors.”
• “An IDaaS technology adoption doesn’t make you immune to internal IAM inefficiencies.”
• “Outsourcing your IAM program risks through IDaaS implementation may not be a good idea.”
• “These criteria need to be adapted to your business and operational requirements.”
• “There’s a considerable shift of operational responsibilities involved in moving your IAM from a conventional IAM implementation to the IDaaS.”
• “Some organizations struggle with these topics, not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”