Access Management

The Buyer’s Compass for Access Management solutions is a structured starting point for selecting vendors by aligning product capabilities to the organization’s primary use cases. It guides teams to identify key use cases, weight functional and non-functional criteria accordingly, gather vendor information, score vendors, ask targeted questions, and then proceed to shortlists, deeper RFIs, and proofs of concept—while ensuring technical and organizational prerequisites are in place. The approach emphasizes focusing on the most important aspects of products and services relative to the desired outcomes, rather than treating selection as a purely feature-driven exercise.

Access Management is positioned as a convergence of Web Access Management (WAM) and Identity Federation, now spanning on-premises, cloud, hybrid, and even managed service delivery models. WAM traditionally places a control layer in front of web applications to handle authentication and coarse-grained authorization, often using HTTP header or credential injection for legacy apps. Identity Federation splits responsibilities between Identity Providers and Service Providers/Relying Parties using standards-based protocols; modern vendors increasingly combine both approaches, commonly supporting SAML v2, OAuth, and OIDC, while still needing to accommodate non-federation applications.

The document defines four priority use cases—Web Access Management, Hybrid Access Management, Workforce IAM, and Consumer IAM (CIAM)—and provides a matrix mapping these to functional criteria such as authentication (including MFA), adaptive authentication, authorization depth, session management, federation, backend integration, directory and sync, audit/reporting, protocol support, API security, orchestration, social login, privacy/consent, and developer/DevOps support. It also highlights non-functional criteria (deployment flexibility, time-to-value, vendor viability, ecosystem, roadmap, support, pricing) plus technical prerequisites (architecture fit, cloud feasibility, data center capacity, standards support, skills) and organizational prerequisites (governance, executive support, ROI visibility, SLAs, training, data policies, stakeholder alignment).

• Access Management capabilities include authentication, authorization, single sign-on, and identity federation.
• Web Access Management commonly adds a layer in front of web applications to handle authentication and typically coarse-grained authorization.
• HTTP header injection can be used to pass authorization information to back-end applications.
• Identity Federation splits authentication and authorization between an Identity Provider and a Service Provider or Relying Party using protocols.
• Integrated vendor solutions commonly support federation protocols such as SAML v2, OAuth, and OIDC.
• Solutions may be deployed on-premises, in the cloud, or in hybrid models.
• Managed service offerings are considered when the technology is owned by a Managed Service Provider.
• Four top use cases are defined: Web Access Management, Hybrid Access Management, Workforce IAM, and Consumer IAM.
• CIAM programs can include social identity integration, progressive profiling, fraud and risk intelligence, and identity analytics.
• CIAM deployments can require substantial storage for large consumer profile datasets, including preferences and unstructured files like audio and video.

• “This document is not a complete guideline for selecting vendors but should provide an excellent starting point to streamline the decision-making process.”
• “Focusing on the most important aspects of products and services offered compared to use cases helps during vendor selection.”
• “Adaptive authentication is increasingly becoming an expected capability.”
• “Not every aspect is of the same importance for every use case.”
• “These are just suggestions, based on our long-term experience in the field of cybersecurity.”
• “Whether you transition from an on-premises Access Management deployment to an IDaaS approach or start anew with an IDaaS implementation, you will still need to carefully assess the gap between the technical features desired by your operations team and offered by the Access Management vendor of choice.”
• “The organization should have the relevant technical knowledge and skills to deploy and manage Access Management services.”
• “In a hybrid IT environment, good governance is essential to ensure that all the various services meet business objectives effectively, economical, and compliant, irrespective of how they are delivered.”
• “The SLAs should also define included penalties and recoverability options in case of SLA breaches.”
• “Some organizations struggle with these topics, not because of technical weaknesses and wrong products, but because of a lack of organizational maturity.”