Access Management

Access Management encompasses capabilities traditionally delivered by Web Access Management (WAM) and Identity Federation, including authentication, authorization, single sign-on, and federation. WAM historically front-ends web applications to centralize authentication and typically coarse-grained authorization, sometimes injecting authorization data into HTTP headers or enabling authorization APIs. Identity Federation splits authentication/authorization between an Identity Provider and Service Provider using standards, and often relies on WAM as an interface for back-end enablement. The market is converging: vendors increasingly provide integrated access management supporting federation protocols such as SAML v2, OAuth, and OpenID Connect, while still needing traditional approaches (HTTP header injection, credential injection) for non-federation-enabled applications.

Business drivers include agility, compliance, innovation, and collaboration across industry networks, with rising demand for onboarding partners and customers, mobile access, hybrid IT, and using access data for “connected and intelligent enterprise” capabilities. IDaaS Access Management, delivered as SaaS and priced per identity/user (and sometimes per transaction), is overtaking on-prem IAM due to easier adoption and cloud-native integrations, though hybrid remains essential because of legacy and custom systems. Multi-tenant SaaS differs from managed services (single-tenant operations), with elasticity and pay-per-use as key considerations.

Success increasingly depends on open standards support (e.g., LDAP, Kerberos, OAuth, SAML, SCIM; optionally XACML/UMA), availability of APIs for automation/orchestration, and developer-ready toolkits. Fraud is rising across many industries, prompting more access management solutions to add fraud detection features (identity proofing, account takeover detection, profiling, UEBA), though depth varies and is weighted less than core AM capabilities in evaluations.

The Leadership Compass rates vendors across product, innovation, and market leadership, emphasizing out-of-the-box completeness, scalability, security, UX, and TCO. ForgeRock leads overall, followed closely by Microsoft; IBM, Ping Identity, and Micro Focus are also top performers. The market is crowded, with 28 evaluated vendors and no vendors classified as Followers.

• Access Management capabilities include authentication, authorization, single sign-on, and identity federation.
• Web Access Management commonly provides coarse-grained authorization and can inject authorization information into HTTP headers for back-end applications.
• Identity Federation splits authentication and authorization between an Identity Provider and a Service Provider (or Relying Party) using standard protocols.
• Integrated access management solutions commonly support federation protocols including SAML v2, OAuth, and OpenID Connect.
• IDaaS is delivered as SaaS hosted and managed by the IDaaS vendor.
• Many IDaaS services are priced per managed identity or active user per month, and some functions are charged per transaction.
• Pure-play SaaS solutions are multi-tenant by design, while managed service offerings are run independently per tenant.
• The Leadership Compass evaluates 28 vendors in the Access Management market segment.
• ForgeRock holds the leadership position in Overall Leadership for Access Management, closely followed by Microsoft.
• No vendors appear in the Follower segment of the Overall Leadership rating.

• “Access Management refers to the group of capabilities targeted at supporting an organizations' access management requirements traditionally found within Web Access Management & Identity Federation solutions.”
• “Web Access Management (WAM) & Identity Federation started as distinct offerings.”
• “However, most vendors today provide integrated solutions that support both a centralized access management based on federation protocols…”
• “Support for web applications without federation support through traditional approaches such as HTTP header injection or credential injection must still be considered.”
• “The business challenge to solve is how to support the growing ‘Connected and Intelligent Enterprise.’”
• “The IDaaS market, with its ease of adoption and cloud-native integrations, is slowly overtaking the on-premises IAM market.”
• “IDaaS is only delivered as SaaS, hosted, and managed by the IDaaS vendor itself.”
• “The support for open identity standards shapes the direction and defines AM implementations' success increasingly.”
• “Exposing key functionality via APIs allows for workflow and orchestration capabilities across environments and better DevOps support through automation.”
• “Ultimately selecting the right Access Management solution delivery model will depend on the customer requirements and their use cases.”