Identity Provisioning

The KuppingerCole Leadership Compass on Identity Provisioning examines a mature, crowded market where many vendors either deliver standalone provisioning with baseline governance or bundle provisioning and Access Governance into broader IGA suites. Because customer needs vary—some already have provisioning and add governance, others outsource fulfillment to managed services, and some only need one capability—KuppingerCole split its research into three distinct compasses: Identity Provisioning, Access Governance, and full IGA, complemented by views on comprehensive IAM suites and SMB-focused IGA.

Identity Provisioning is defined as automating the creation, update, and deletion of accounts and entitlements across target systems, supported by workflows, connectors and toolkits, identity repositories, reconciliation, self-service, and delegated administration. The report traces provisioning’s evolution from late-1990s automation of overwhelmed system administration toward workflow-based authorization, centralized repositories with reconciliation, and UI-driven business self-service. The evaluated scope is on-premises deployments (customer or MSP), excluding IDaaS.

Evaluation criteria span functionality and core provisioning components, plus differentiators such as connector “heritage,” ESB and SRM integration, SCIM/SPML support, deployment options, low-code customization and upgrade-safe transport, mobile access, strong authentication, fine-grained internal security, multi-tenancy, baseline governance (roles/SoD), and shopping-cart request models. Vendor selection should not rely on charts alone; it requires detailed fit analysis and proof-of-concept.

Overall Leadership is led by SailPoint, followed closely by Micro Focus, Oracle, and CA, with many additional leaders. The report also correlates Product, Innovation, and Market Leadership to highlight “Market Champions,” “Technology Leaders,” overperformers, and specialized challengers, then summarizes strengths and gaps of individual vendors and products.

• Three distinct Leadership Compass documents were created for Identity Provisioning, Access Governance, and full Identity Governance and Administration.
• The Identity Provisioning Leadership Compass evaluates on-premises offerings deployed at the customer or at a managed service provider.
• IDaaS offerings are excluded from this Leadership Compass.
• Identity Provisioning products commonly include workflow engines, connectors and toolkits, identity repositories, reconciliation, self-service, and delegated administration.
• Historical Identity Provisioning products largely originated in the late 1990s and early 2000s.
• The Overall Leaders list includes SailPoint, Micro Focus, Oracle, CA Technologies, IBM, and SAP among others.
• The market assessment considered close to 30 vendors, plus additional “vendors to watch.”
• Login Alliance is the only vendor placed in the Follower segment for Overall Leadership.
• Omada added its own Identity Provisioning capabilities starting in version 11.0 and its current version is 12.x.
• Microsoft Identity Manager 2016 discontinued former Access Governance capabilities that were based on BHOLD.

• “Identity Provisioning remains a core capability of IAM infrastructures.”
• “Some form of Identity Provisioning is inevitable for any mid-sized and large IT infrastructure.”
• “Selecting a vendor of a product or service must not be only based on the comparison provided by a KuppingerCole Leadership Compass.”
• “A thorough selection includes a subsequent detailed analysis and a Proof of Concept or pilot phase, based on the specific criteria of the customer.”
• “It is impossible to understand Identity Provisioning complexity without having a quick look backward.”
• “Before Identity Provisioning, it was common to wait days or even weeks for a user to get an account on a mainframe or network resource or application.”
• “As it was now simple to grant access to any resource, users had accounts on multiple systems, and the issue moved from ‘how do I grant access’ to ‘how do I control what John has access to?’”
• “Vendors above the line are sort of ‘overperformers’ when comparing Market Leadership and Product Leadership.”
• “Innovation is not limited to delivering a constant flow of new releases, but focuses on a customer-oriented upgrade approach.”
• “This distribution and correlation is typical for most markets with a significant number of established vendors plus some smaller vendors.”