The best IAM tools depend on whose identities you're managing. For staff signing into work apps, look at workforce identity with single sign-on and strong MFA; for customers signing into your own product, look at customer identity or open source authentication you can host. Either way, require phishing-resistant MFA for admins first.
Identity and access management decides who can sign in to what, and what they can do once they're in. For a small business, that might mean one login for every work app and a quick way to remove access when someone leaves. For a software company, it means the sign-up and login screens your own customers use.
This list mixes workforce identity platforms, developer authentication and open source options. If your team still shares passwords, start with my guide to open source password managers, and for MFA on phones, see my roundup of authenticator apps.
IAM tools at a glance
Here's what each tool is, what it's good for and whether its own site names a free plan, a trial or neither. The list is alphabetical and in no particular order.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| authentik | Open source IdP | Self-hosted single sign-on | Yes |
| Descope | Customer identity | Passwordless sign-in flows | No |
| FusionAuth | Developer auth | Login you host or they host | Yes |
| JumpCloud | Directory and devices | Small IT teams managing everything | Trial only |
| Keycloak | Open source IAM | Adding login to your own apps | Yes |
| Microsoft Entra ID | Workforce identity | Microsoft 365 organisations | Trial only |
| Okta | Workforce and customer identity | Staff and customer sign-in | Trial only |
| Ory | Open source identity | Developers building at scale | Yes |
| SuperTokens | Open source auth | Startups owning their login | Yes |
| Zitadel | Identity infrastructure | Open source with enterprise options | Yes |
Identity and access management platforms
authentik
Best for: Technical teams who want to run their own identity provider, keep control of user data and avoid per-user licences.
Descope
Best for: Product teams adding passwordless and social login to their app who want customer and AI agent identity handled by one platform.
FusionAuth
Best for: Developers who want an authentication server they can download and self-host, or run in the cloud as their app grows.
JumpCloud
Best for: Small and midsize businesses without a big IT department who want users, devices and single sign-on managed from one console.
Keycloak
Best for: Development teams who want single sign-on and social login for their own applications from an open source project without a commercial licence.
Microsoft Entra ID
Best for: Businesses already running Microsoft 365 who want staff sign-in, conditional access and single sign-on in the directory they already have.
Okta
Best for: Organisations connecting staff to many different cloud apps who want one sign-in for all of them, plus customer login from the same supplier.
Ory
Best for: Engineering teams who want open source building blocks for identity, permissions and OAuth, with a managed network option when they need it.
SuperTokens
Best for: Startups who want to own their authentication code and user data with an open source login system they can run themselves.
Zitadel
Best for: Software companies who want identity infrastructure that mixes open source code with enterprise authentication features as they grow.
Getting the basics of IAM in place
- List every app your team signs into and who owns each one.
- Connect the important apps to single sign-on, so one account controls access.
- Turn on MFA for everyone, and the strongest available method for admins.
- Set up joiner, mover and leaver steps, so access changes when roles change.
- Review who has admin rights every quarter and remove anything that isn't needed.
Which MFA methods are strongest?
The National Cyber Security Centre describes FIDO2 credentials, on a trusted device or a roaming security key, as one of the most secure yet usable methods of MFA. Its guidance lists app-based and hardware code generators separately, and puts message-based methods such as email, SMS and calls in their own lower category.
When you compare IAM tools, check which MFA methods each one supports and whether you can require the strongest ones for particular groups. Admin accounts and anyone with access to sensitive data should be the first to move to passkeys or security keys.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Workforce identity or customer identity?
Workforce identity connects your staff to the apps they use at work, with a directory, single sign-on and device rules. Customer identity handles sign-up, login, social login and user profiles inside your own product, often at much larger scale.
Some platforms do both, and some open source projects are built mainly for developers adding login to their apps. Decide which problem you're solving before you compare features, because the two lists look similar and work very differently.
Access mistakes I see in small businesses
- Shared logins for social media, banking or admin panels.
- Former staff still able to sign in weeks after leaving.
- Everyone given admin rights because it was quicker.
- MFA turned on for some apps and not others.
- No record of which apps hold customer data.
None of these need a big project to fix. One identity platform and a short checklist for joiners and leavers solves most of them.
Joiners, movers and leavers
Most access problems come from people changing roles or leaving. Write down what access each role needs, connect your identity platform to your HR records if you can, and make removing access part of the leaving checklist, not something IT finds out about later.
Movers are the quiet risk. Someone who changes team keeps their old access as well as their new one, and over a few years ends up able to see far more than their job needs. A quarterly review catches it.
Do you make identity and access management tools? Tool makers can ask to be considered for a featured place on this list.
My advice on choosing IAM tools
Start with your leaver process. If you can't remove a departing employee's access to every app within an hour, fix that before anything else, because it's where small businesses are most exposed.
If you're choosing open source, be realistic about who'll run it. Self-hosting identity gives you control, but someone has to patch, monitor and back it up, because when it fails nobody can log in.
Identity and access is a deep field, and if it's yours, my technology contributor guidelines tell you how to send me an article.
Frequently asked questions
What are IAM tools?
IAM tools manage digital identities and access rights, covering sign-in, single sign-on, MFA, user directories and permissions.
What's the difference between IAM and SSO?
SSO lets people use one login for many apps. IAM is broader and includes SSO, MFA, user lifecycle and access rules.
Are there open source IAM tools?
Yes. Several tools here are open source, so you can self-host them, though you'll need the skills to run them securely.
Which MFA method is most secure?
The NCSC describes FIDO2 credentials, such as passkeys and security keys, as one of the most secure yet usable methods of MFA.
Do small businesses need IAM software?
If staff use several cloud apps, yes. One identity platform makes it far easier to control access and remove it when people leave.
