Executive Summary
About This ShortList
Access Management governs how employees, partners, customers, service accounts and AI agents gain, use and retain access to applications, data and infrastructure. The category has moved beyond sign-on and static entitlement management. Organizations now need phishing-resistant authentication, adaptive authorization, least-privilege enforcement, privileged access controls, identity governance and telemetry that can feed detection and response.
This ShortList focuses on platforms that help organizations reduce identity-related risk while supporting business access at scale. Buyers should look for solutions that unify authentication, authorization, governance and privileged access; integrate with cloud, SaaS, legacy and developer environments; and provide policy automation, audit evidence and risk signals for security operations. The strongest offerings balance security, usability and administrative efficiency across hybrid work, cloud migration and expanding non-human identity populations.
Threshold Criteria
Constellation considers the following criteria for these solutions:
- Unified identity administration: Centralizes identity lifecycle, provisioning, deprovisioning and policy administration across employees, contractors, partners and non-human identities.
- Single sign-on and federation: Provides secure, standards-based access to enterprise applications and services through SSO, federation and directory integrations.
- Strong and phishing-resistant authentication: Supports MFA, passkeys and other phishing-resistant methods while reducing unnecessary friction for low-risk access.
- Adaptive and risk-based access: Uses context such as device, location, session, user behavior and resource sensitivity to adjust access decisions in real time.
- Authorization and least privilege: Supports RBAC, ABAC and policy-based controls that limit access to what users and systems need for their role or task.
- Privileged access and session controls: Protects administrative and high-risk access through vaulting, just-in-time access, session monitoring and approval workflows.
- Governance, certification and compliance evidence: Automates access reviews, separation-of-duties checks, entitlement analysis and audit reporting.
- Identity threat detection and response: Collects and analyzes access telemetry to identify suspicious authentication, entitlement, privilege and session activity.
- Integration and operational scalability: Integrates with cloud, SaaS, legacy, developer and security operations environments while supporting policy automation at enterprise scale.
The Constellation ShortList™
Constellation evaluates more than 34 solutions categorized in this market. This Constellation ShortList is determined by client inquiries, partner conversations, customer references, vendor selection projects market share and internal research.
- CyberArk
- ForgeRock
- Ping Identity
- IBM
- ManageEngine
- Microsoft
- Okta
- OneLogin
- OpenText
- Veza
Frequency of Evaluation
Each Constellation ShortList is updated at least once per year. Updates may occur after six months if deemed necessary.
Evaluation Services
Constellation clients can work with the analyst and research team to conduct a more thorough discussion of this Constellation ShortList. Constellation can also provide guidance in vendor selection and contract negotiation.