Identity And Access Management — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Identity Provider (IdP) Workforce Core
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAzure AD Free $0 up to 500k objects; Okta SSO $2/user/mo min $2000/yr, MFA add $4/user/mo total; Entra ID P1 $6/user/mo, P2 $9/user/mo; JumpCloud Free 10 users+10 devices then $9/user/mo
Customer Identity & Access (CIAM) Platform
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsAuth0 Free 7.5k MAU, 2 social IdPs; Essentials $35/mo for 500 MAU + $0.07/MAU over; B2B $150/mo; Clerk Free 10k MAU then $25/mo + $0.02/MAU; Supabase Auth Free unlimited on free project, Pro $25/mo
SSO Platform / Enterprise Federation (SAML/OIDC)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWorkOS SSO Free dev 1M API calls/mo then $99/mo per product, bundle SSO+DirSync+Audit Logs $149/mo; Okta SSO $2/user/mo min 100 users $200/mo; Azure AD P1 $6/user/mo includes SAML; BoxyHQ OSS Free self-host
MFA Provider / TOTP/Push Auth
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsDuo Free 10 users unlimited apps; Essentials $3/user/mo, Advantage $6/user/mo, Premier $9/user/mo; Authy Free 100 auths/mo then $0.05/auth; Okta MFA $3/user/mo add-on to SSO
Passwordless Authentication (WebAuthn/FIDO2)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSimpleWebAuthn OSS Free $0 self-host; Hanko Cloud Free 500 MAU then $39/mo; Corbado Free 1k MAU then $99/mo 5k MAU; Descope Free 7.5k MAU then $49/mo base + $0.05/MAU over
Secrets Management for IAM (Service Accounts & Keys)
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsVault OSS Free; HCP Vault Dedicated $0.03/hr ~$22/mo + storage $0.15/GB; Doppler Free 5 users then $12/user/mo; Infisical Free self-host, Cloud Free 1 project then $15/mo; AWS Secrets $0.40/secret/mo + $0.05/10k API calls
API Authorization / OAuth 2.1 Authorization Server
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsOry Hydra OSS Free; Ory Network Free 10k tokens/day then $0.15/1k tokens over; Keycloak OSS Free; FusionAuth Community Free, Cloud $37/mo; Auth0 authz included in MAU pricing $35/mo base
Session Management & Token Revocation / CAEP
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsRedis OSS Free self-host; Upstash Free 10k cmds/day then $10/mo 100k/day, $25/mo 500k/day; Keycloak Free sessions; Okta CAEP Continuous Access add-on $2/user/mo; Transmit $10k/yr base
Audit Logs WORM for IAM Events
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsWorkOS Audit Logs Free 10k events/mo then $0.01/event or $99/mo bundled; CloudTrail Free first copy, then $2.00/100k mgmt events; Axiom Free 500GB ingest 30d then $25/mo per 100GB; Panther $150/mo base + $10/GB
Zero Trust Network Access (ZTNA) for Admin
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsCloudflare Access Free 50 users then Teams Standard $7/user/mo; Tailscale Free 3 users 100 devices then Personal Pro $6/user/mo, Teams $10/user/mo; Zscaler ZPA $20/user/mo min 100 users $24k/yr; ZPA+ZIA bundle $45/user/mo
Directory Sync & SCIM Provisioning
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsBoxyHQ SCIM OSS Free; WorkOS DirSync Free dev 100 directories then $99/mo per product, trio bundle $149/mo; JumpCloud includes SCIM $9/user/mo; Okta Lifecycle $4/user/mo min $400/mo
Fine-Grained Authorization / Policy Engine (OPA/Zanzibar)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOPA OSS Free; OpenFGA OSS Free self-host; AuthZed Cloud Free 10k tuples then $60/mo starter, $250/mo scale; Permit.io Free 1k checks/day then $299/mo Pro 50k checks/mo + $0.001/check over; Oso Free 1k/day then $150/mo
Device Trust / Endpoint Verification
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCloudflare Gateway Free 50 users then $7/user/mo includes posture; Tailscale posture Free then Teams $10/user/mo; Duo Device Health requires Advantage $6/user/mo; CrowdStrike Falcon Go $59.99/device/mo
User Lifecycle Management / Automated Provisioning
Enterprise single sign-on and user provisioning. Usually required to sell to larger organizations.Pricing & free-tier limitsOkta Lifecycle $4/user/mo, Workflows add-on $3/user/mo; JumpCloud $9/user/mo includes lifecycle; SailPoint IdentityNow $12k/yr base + $6/user/mo; Keycloak OSS Free provisioning via SPIs
Certificate Authority for mTLS Client Auth / User Certs
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitsSmallstep OSS Free; Hosted $40/mo per 10 active certs; Let's Encrypt Free 100 certs/domain/wk; Cloudflare mTLS $10/mo + $10k/yr enterprise for client cert API; AWS Private CA $400/mo per CA root + $0.75/cert issued (short-lived $0.05)
Hardware Security Module (HSM) for IAM Signing Keys
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsSoftHSM OSS Free dev; YubiHSM 2 $650 one-time (no fee); AWS CloudHSM $1.88/hr ~$1,370/mo per HSM; Azure Managed HSM $2.50/hr ~$1,825/mo; Google Cloud HSM $1.37/hr + $1/key version $0.03/10k ops
Fraud Detection & Bot Prevention for Login
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsTurnstile Free unlimited solves; Bot Mgmt in Pro $20/mo basic, Enterprise $200/mo min; hCaptcha Free 10k solves/mo then $99/mo; Friendly Captcha Free 1k/mo then $35/mo; Arkose custom $25k/yr min; DataDome $30k/yr base
Privileged Access Management (PAM) Vault
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsTeleport Community Free 10 nodes; Enterprise $20k/yr base for 50 users + $250/user/yr over; StrongDM Free 10 users then $70/user/mo; Boundary OSS Free, HCP Boundary $0.10/hr per worker + $15/mo; CyberArk PAM $100k/yr min self-host + $150/user/mo; BeyondTrust $50k/yr + $120/user/mo
Entitlement Management / RBAC Platform
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsCasbin OSS Free; Cerbos OSS Free; Cerbos Cloud Free 10k decisions/day then $200/mo Starter 1M/mo, $600/mo Pro; WorkOS Roles Free bundled $0; PlainID $60k/yr min; Saviynt entitlements $5/user/mo
Privileged Session Monitoring & Recording
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsTeleport recording included in Enterprise $20k/yr (50TB cloud retention $0.15/GB over); StrongDM $70/user/mo includes replay 1yr; CyberArk PSM add-on $30k/yr + $100/user/mo; Balabit/One Identity Safeguard $40k/yr base + $180/user/mo
Service-to-Service Auth / Workload IAM (SPIFFE/SPIRE)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsSPIRE OSS Free self-host; Istio SPIFFE Free; Smallstep OSS Free, hosted from $40/mo; Teleport Workload Identity included $20k/yr Enterprise; Aembit $2k/mo base + $0.02/workload/hr (~$14/workload/mo)
Identity Verification / KYC (ID Proofing)
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsStripe Identity $1.50/verification no min; Persona Free dev 100 checks then $250/mo + $0.80/verification (doc+selfie), gov ID $1.20; Onfido $1.20/check min $1k/mo; Jumio $2/check min $2k/mo; Veriff $0.95/check
Adaptive / Risk-Based Authentication
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKeycloak adaptive SPI Free; Firebase App Check Free 100k attest/day then $0.01/10k; Auth0 anomaly detection included Free; Okta Adaptive MFA $5/user/mo (requires P1 $6/user/mo); Transmit $15k/yr base + $3/user/mo
Just-In-Time (JIT) Access & Ephemeral Elevation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTeleport JIT Free community, Enterprise $20k/yr; Common Fate OSS Free self-host, Cloud $500/mo base up to 25 users + $15/user/mo; P0 Security $15/user/mo min $1k/mo; ConductorOne $20/user/mo min $2k/mo
Break-Glass / Emergency Access Workflow
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSlack OSS workflow Free; Opsgenie Free 5 users then $23/user/mo Standard; PagerDuty Free 5 users then $29/user/mo Pro; CyberArk Emergency $25k/yr add-on; ConductorOne Break-Glass $20/user/mo min $2k/mo includes audit
Managed PKI for Device Certificates
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsSmallstep OSS Free; Managed $40/mo per 10 active certs, $250/mo for 100; AWS Private CA $400/mo per CA + $0.75/cert (long) $0.05 short-lived; DigiCert IoT $4k/yr base + $3/cert; Venafi SaaS $60k/yr min + $1.50/cert/mo
Key Management & Rotation for JWT/SAML Keys
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Transit Free; HCP Vault $0.03/hr ~$22/mo; Doppler $12/user/mo includes 50 auto-rotate integrations; AWS KMS $1/key/mo + $0.03/10k requests; Azure Key Vault $0.03/10k ops Standard, Premium $1/key/mo; key rotation labor Free OSS via jsonwebkey auto-rotate
Identity Analytics & Risk Scoring
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsWazuh OSS Free self-host, Cloud $200/mo per 10GB; Exabeam Fusion Free 500GB/mo then $500/mo per TB; Okta ITDR Risk Scoring $4/user/mo add-on; Gurucul $50k/yr base + $8/user/mo; SailPoint IQ AI $20k/yr + $10/user/mo
Compliance Reporting for IAM (SOC2/ISO/FedRAMP)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenComply OSS Free; Scrut $8k/yr base + $3k for IAM module; Vanta $10k/yr base + $250/integration (SSO/MFA) + $3k IAM controls pack; Drata $12k/yr + $15k IAM module + $35k FedRAMP add-on; WorkOS audit logs $0.01/event for evidence
Cross-Domain Federation / B2B Collaboration Trust
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsAzure AD B2B Free first 50k MAU then $0.03/MAU; Auth0 Organizations included $150/mo B2B Essentials (1k orgs); Okta Org2Org $2/user/mo per remote org link; PingFederate $50k/yr base + $10k per connection pack 25 conns
How this professional identity and access management checklist works.
Each requirement below is something a professional identity and access management build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.