- Ten tools mapped to the layer they cover
- Why leaving means building a stack
- The identity layer: sign-in and SSO
- The device layer: Apple first, or everything
- Patching and network access
- All ten in alphabetical order
- Advice on the order to replace things
- Questions to put to every demo
- Frequently asked questions
No single product replaces the whole bundle. You'll usually assemble a stack: an identity provider for sign-in and single sign-on, a device management tool for laptops and phones, and a patching tool, plus network access if you leaned on directory-backed Wi-Fi or VPN. Map what you use today, then fill each layer in turn.
Here are all ten, laid out by the layer each one covers. Read the table as a parts list for rebuilding a stack, not a league table.
Ten tools mapped to the layer they cover
| Tool | Layer | Good for |
|---|---|---|
| Action1 | Patch management | Patching Windows, macOS and Linux |
| Addigy | Apple MDM | Macs, iPhones and iPads with remote monitoring |
| Automox | Endpoint patching | Governance across Windows, macOS and Linux |
| Foxpass | Cloud RADIUS and LDAP | Wi-Fi and VPN access without shared passwords |
| Iru (formerly Kandji) | Apple and cross-platform MDM | Apple-first fleets adding Windows and Android |
| Jamf | Apple device management | All-Apple fleets of any size |
| Miradore | Cross-platform MDM | Mixed mobile and desktop devices |
| Okta | Identity and access | Company-wide sign-in and authentication |
| OneLogin | SSO and MFA | Single sign-on with multi-factor authentication |
| Rippling IT | Identity and device management | Joiners and leavers across apps and devices |
Why leaving means building a stack
JumpCloud bundles a directory, single sign-on and device management in one product. Almost nothing on the market replaces all three in one go, so the realistic plan is to pick an identity provider, a device management tool and a patching tool, and connect them. That sounds like more work at first, and it will be. The upside is that each layer can be the best fit for your fleet rather than a compromise.
Before you look at a single vendor, list what you use today: which apps sign in through the directory, which devices are enrolled, what patch policies run and whether Wi-Fi or VPN access depends on it. That list becomes your shopping list.
The identity layer: sign-in and SSO
Okta describes an identity platform for secure access, authentication and automation. OneLogin covers single sign-on, multi-factor authentication and lifecycle management. Rippling IT ties identity, access and devices to each person's time at the company, which suits businesses that want joiners and leavers handled in one place, per its site.
The device layer: Apple first, or everything
If your fleet is mostly Apple, Jamf manages Mac, iPhone, iPad and Apple TV. Addigy is an Apple MDM platform with real-time remote monitoring. Iru is the new name for Kandji, per the vendor's own site, and it says it's bringing Apple device features to Windows and Android. For a mixed fleet from day one, the platform that trades as LogMeIn Miradore covers Android, iOS, macOS and Windows on one console.
Patching and network access
Automox patches and governs Windows, macOS and Linux endpoints. Action1 covers patching and vulnerability remediation on the same three systems. If you relied on the directory for Wi-Fi or VPN sign-in, Foxpass offers Cloud RADIUS and Cloud PKI with LDAP included, and its pages show it's now sold under Splashtop.
Run an identity, device or patching product that should sit in one of these layers? Ask for it to be reviewed for the next update of this page.
All ten in alphabetical order
Alphabetical and in no particular order of merit; each line picks out a different claim from the vendor's own pages.
Action1
Best for: Autonomous patching and vulnerability fixes on Windows, macOS and Linux, with the vendor saying it's free forever for your first endpoints, with no feature limits.
Addigy
Best for: IT teams wanting Apple management that, in the vendor's words, works for IT at any scale.
Automox
Best for: Patching and governing Windows, macOS and Linux endpoints, where the vendor promises to patch what's patchable and mitigate what isn't.
Foxpass
Best for: Ending shared Wi-Fi passwords and enforcing zero-trust access, per the vendor.
Iru (formerly Kandji)
Best for: Apple device management and security that the vendor says it's extending to Windows and Android under its new name.
Jamf
Best for: All-Apple fleets of any size, which the vendor says it handles from a handful of devices upwards.
Miradore
Best for: Getting MDM running quickly, since the vendor says you can launch it in minutes.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Okta
Best for: Companies that want identity at the heart of business security and growth, as the vendor frames it.
OneLogin
Best for: Firms wanting what the vendor calls enterprise-grade security for sign-in.
Rippling IT
Best for: Instant access provisioning and endpoint security on one platform, as the vendor puts it.
Advice on the order to replace things
Move identity first. Sign-in touches every app and every person, so it's the layer where mistakes hurt most and where you want the longest overlap with the old setup. Devices come next, ideally enrolled in waves by team. Patching and network access come last, because they're the easiest to run in parallel without anyone noticing.
For deeper comparisons within each layer, see my SSO providers list, the MDM software guide and the endpoint management roundup.
Questions to put to every demo
- Which directory or identity provider does this connect to, and which way does user data sync?
- What happens to a device the moment someone leaves the company?
- Can I see a full audit trail of admin changes?
- Which operating systems are fully supported, and which only partly?
- How do we move off this product later if we need to?
Ask all five on every call and write the answers side by side; the gaps show up fast.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Can one tool replace a directory, SSO and MDM together?
Rarely in full. A few products cover identity and devices together, but most teams leaving a bundle end up with two or three tools that each handle one layer.
Do I still need a directory if I use an identity provider?
Usually the identity provider becomes your directory for cloud apps. Check whether any local systems, printers or network gear still expect LDAP or RADIUS.
What's the difference between MDM and patch management?
MDM enrols and configures devices, sets policies and can wipe them. Patch management keeps the operating system and apps updated. Some tools do both; many specialise.
How do I manage Macs and Windows laptops together?
Either pick a cross-platform MDM, or run an Apple-focused tool alongside a Windows tool. The second route gives deeper Apple control but means two consoles to run.
What happens to Wi-Fi access when I leave a directory service?
If your Wi-Fi or VPN checked passwords against the directory, you'll need a new RADIUS or certificate service before you switch, or people will lose access.
How long does an identity migration take?
It depends on how many apps sign in through it. Plan app by app, test each one with a small group and keep the old sign-in working until every app has moved.
